OWASP Internet of Things

OWASP Internet of Things - An OWASP lab project

About OWASP Internet of Things

Description

The OWASP IoT Security Testing Guide provides a comprehensive methodology for penetration tests in the IoT field offering flexibility to adapt innovations and developments on the IoT market while still ensuring comparability of test results. The guide provides an understanding of communication between manufacturers and operators of IoT devices as well as penetration testing teams that’s facilitated by establishing a common terminology. The methodology, the underlying models and the catalog of test cases present tools that can be used separately and in conjunction with each other. Check out the projects GitHub for more details: https://github.com/OWASP/owasp-istg

• https://github.com/OWASP/owasp-istg

Description

The Firmware Security Testing Methodology (FSTM) is composed of nine stages tailored to enable security researchers, software developers, consultants, hobbyists, and Information Security professionals with conducting firmware security assessments. Stage|Description 1. Information gathering and reconnaissance|Acquire all relative technical and documentation details pertaining to the target device’s firmware 2. Obtaining firmware|Attain firmware using one or more of the proposed methods listed 3. Analyzing firmware|Examine the target firmware’s characteristics 4. Extracting the filesystem|Carve filesystem contents from the target firmware 5. Analyzing filesystem contents|Statically analyze extracted filesystem configuration files and binaries for vulnerabilities 6. Emulating firmware|Emulate firmware files and components 7. Dynamic analysis|Perform dynamic security testing against firmware and application interfaces 8. Runtime analysis|Analyze compiled binaries during device runtime 9. Binary Exploitation|Exploit identified vulnerabilities discovered in previous stages to attain root and/or code execution

Description

ByteSweep is a Free Software IoT security analysis platform. This platform will allow IoT device makers, large and small, to conduct fully automated security checks before firmware is shipped.

Description

The Firmware Analysis Project provides: Security testing guidance for vulnerabilities in the “Device Firmware” attack surface, Steps for extracting file systems from various firmware files, Guidance on searching a file systems for sensitive of interesting data, Information on static analysis of firmware contents, Information on dynamic analysis of emulated services (e.g. web admin interface), Testing tool links, and a site for pulling together existing information on firmware analysis

Project Resources

Project Leaders

ized remote control

ization

lacking or weak encryption

a lack of input

output filtering

Project Information

Lab Project

Classification

Other

Language

License

MIT License

Contributors

GitHub Stars

938

Downloads

57038

Corporate Supporters

OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.

OWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.

OWASP Internet of Things | OWASP Foundation