# Iot Pentesting Hardware Hacking

> Use when testing IoT device and hardware security.

- Skill: `loopyluci/iot-pentesting-hardware-hacking` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/iot-pentesting-hardware-hacking`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/iot-pentesting-hardware-hacking/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/iot-pentesting-hardware-hacking

---


# IoT Pentesting and Hardware Hacking

Testing IoT device security — from firmware analysis and UART/JTAG debugging through flash dumping, side-channel attacks, and hardware backdoors.

## When to Use

- Assessing physical IoT device security
- Extracting firmware for vulnerability analysis
- Hardware debugging interfaces (UART, JTAG, SWD)
- Side-channel and fault injection analysis
- Wireless protocol analysis on IoT devices

## Hardware Hacking Techniques

```python
HARDWARE_TECHNIQUES = {
    'firmware_extraction': 'Dump flash via SPI, chip-off, UART bootloader, or update file analysis',
    'uart_debug': 'Connect to UART (TX/RX/GND) at 115200 baud — often gives root shell',
    'jtag_swd': 'Debug port via JTAG/SWD — full device control, memory read/write',
    'eeprom_i2c': 'Read configuration EEPROM via I2C — credentials, API keys, certs',
    'flash_dump': 'Dump SPI flash (Winbond, Macronix) with Bus Pirate, flashrom, or chip-off',
    'side_channel': 'Power analysis, electromagnetic, timing — extract crypto keys',
    'fault_injection': 'Glitch power/clock to bypass secure boot, authentication',
}

# Firmware analysis workflow
FIRMWARE_ANALYSIS = [
    "binwalk firmware.bin — extract filesystem",
    "strings firmware.bin | grep -E 'password|key|secret|token|http://|https://'",
    "firmwalker firmware.extracted/ — find interesting paths and configs",
    "checksec --file=extracted/sbin/init — check binary mitigations",
    "Ghidra decompile: analyze binaries for hardcoded creds and backdoors",
]
```

## Verification Checklist

- [ ] Physical interfaces identified (UART, JTAG, SWD, SPI, I2C)
- [ ] UART console accessed (baud rate detection, root shell)
- [ ] Flash/firmware dumped (via SPI or chip-off)
- [ ] Firmware analyzed (filesystem, binaries, hardcoded secrets)
- [ ] Default credentials tested (admin/admin, root:root)
- [ ] OTA update mechanism analyzed (signed? encrypted? replay?)
- [ ] Wireless protocols tested (Zigbee, Z-Wave, BLE, WiFi)
- [ ] Physical security assessed (tamper switches, epoxy, potting)
- [ ] No destructive testing on production devices (unless authorized)