# Iot Overview

> Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks, wireless protocol sidebands (BLE, Zigbee, Z-Wave, LoRaWAN, sub-GHz).

- Skill: `purpleailab/iot-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/iot-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/iot-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/iot-overview

---


# IoT / Embedded Operator Skill Catalog

This catalog covers the surface area between hardware reconnaissance and
runtime exploitation of IoT and embedded targets. Wireless sidebands
(BLE / Zigbee / Z-Wave / LoRaWAN / sub-GHz) live alongside firmware-level
attacks because IoT engagements routinely chain across both.

## Playbooks

| Skill | Use for |
|---|---|
| `/skills/standard/iot/firmware-acquisition/SKILL.md` | Vendor portals, OTA capture, SPI flash dump, eMMC chip-off |
| `/skills/standard/iot/binwalk-extract/SKILL.md` | binwalk + firmware-mod-kit extraction; squashfs / jffs2 mount |
| `/skills/standard/iot/hardcoded-creds/SKILL.md` | Strings, shadow, busybox httpd, telnet logs |
| `/skills/standard/iot/bootloader-uboot/SKILL.md` | U-Boot console interrupt; environment variables; secure-boot bypass |
| `/skills/standard/iot/dev-mem/SKILL.md` | /dev/mem, /dev/kmem, MTD writes on embedded Linux |
| `/skills/standard/iot/ble-gatt/SKILL.md` | GATT enumeration, characteristic read/write without auth, pairing downgrade |
| `/skills/standard/iot/zigbee-touchlink/SKILL.md` | Touchlink commissioning abuse, well-known transport key, ZCL command abuse |
| `/skills/standard/iot/z-wave/SKILL.md` | S0 derivation flaw, S2 ECDH analysis, replay on unauthenticated nodes |
| `/skills/standard/iot/lorawan-otaa/SKILL.md` | OTAA join, frame-counter replay, downlink injection |
| `/skills/standard/iot/sub-ghz/SKILL.md` | 433/868/915 MHz capture + replay (HackRF, Flipper Zero, RTL-SDR) |

## Workflow

1. **Inventory hardware**: photograph PCB; identify SoC, flash, debug pads
   (UART = 4-pin pattern; JTAG = TAP; SWD = 2-pin SWDIO/SWCLK).
2. **Acquire firmware**: vendor update portal first; OTA proxy capture
   second; SPI flash dump third; eMMC chip-off last.
3. **Extract**: `binwalk -eM <fw.bin>`, then mount squashfs / jffs2 / ubifs.
4. **Triage**: search strings for credentials, AWS keys, MQTT topics, hardcoded
   IPs; identify backdoor accounts (busybox /etc/passwd, telnet/SSH stanzas).
5. **Wireless co-channels**: if the device speaks BLE / Zigbee / Z-Wave /
   LoRaWAN, capture commissioning, replay, attempt key extraction.
6. **Cloud-IoT**: if the device backhauls to a vendor cloud, pivot to the
   mobile companion app and the cloud API.

## Hardware bench tools (sandbox tools)

- Logic analyzer: Saleae Pro 8 / Sigrok PulseView.
- Flash interface: ch341a + SOIC clip.
- Debug interface: BusPirate v5, J-Link, Black Magic Probe.
- Glitching: ChipWhisperer-Nano / Pico.
- Wireless: HackRF One, Sonoff Zigbee 3.0 Dongle E, RTL-SDR Blog v4.

## Safety

IoT engagements often touch consumer devices that the operator owns but
that have shared cloud accounts (vendor telemetry). RoE must enumerate
which clouds may be probed. ConOps `blue_team` field should declare the
vendor IR contact when in scope so a fail-safe trip can be reported.