Scribd Logo
Upload

Welcome to Scribd!

  • 19 views

    CPENT Module 10 IoT Penetration Testing

    Uploaded by

    Oleg Pelsch

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CPENT Module 10 IoT Penetration Testing

    Uploaded by

    Oleg Pelsch
    19 views11 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    19 views11 pages

    CPENT Module 10 IoT Penetration Testing

    Uploaded by

    Oleg Pelsch

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 11

    EC-Council Certified Penetration Testing Professional

    Certified Penetration Testing Professional

    Methodology: IoT Penetration Testing

    Penetration Tester:
    Organization:
    Date: Location:

    Confidential 1 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Test 1: IoT Penetration Testing

    Test 1.1: Attack Surface Mapping

    Target Organization
    URL
    Target IoT Device
    Tests Performed 1.
    2.
    3.
    4.
    5.

    Attack Surface Mapping Successful? Yes No


    Identified Attack Surfaces
    Attack Surface Criticality Nature of Exploitation
    1.
    2.
    3.
    4.
    5.
    Tools/Services Used 1.
    2.
    3.
    4.
    5.

    Confidential 2 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Results Analysis:

    Confidential 3 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Test 1.2: Analyzing the IoT Hardware

    Target Organization
    URL
    Target IoT Device
    Step-1: Research the Device
    Information 1.
    obtained through
    2.
    Research
    3.
    4.
    5.

    Step-2: Identify the Components


    Components of the 1.
    IoT Device
    2.
    3.
    4.
    5.

    Step-3: Identify the Debugging Ports


    Debugging Ports of 1.
    the IoT Device
    2.
    3.
    4.
    5.

    Step-4: Dump the Flash


    Information 1.
    Extracted from
    2.
    Memory Dump
    3.

    Confidential 4 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    4.
    5.

    Step-5: Extract/Analyze the firmware


    Results of Firmware 1.
    Analysis
    2.
    3.
    4.
    5.

    Identified 1.
    Vulnerabilities
    2.
    3.
    4.
    5.

    Tools/Services Used 1.
    2.
    3.
    4.
    5.

    Results Analysis:

    Confidential 5 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Test 1.3: Attack Surface Map

    Target Organization
    URL
    Target IoT Device
    Attack Surface Mapping Successful? Yes No
    Information Collected
    FCC ID Components Attack Vectors Attack Vector Rating
    1. 1. 1.
    2. 2.
    3. 3.

    2. 1. 1.
    2. 2.
    3. 3.

    3. 1. 1.
    2. 2.
    3. 3.

    4. 1. 1.
    2. 2.
    3. 3.

    5. 1. 1.
    2. 2.
    3. 3.

    6. 1. 1.
    2. 2.
    3. 3.

    Confidential 6 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Tools/Services Used 1.
    2.
    3.
    4.
    5.

    Results Analysis:

    Confidential 7 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Test 1.4: Binwalk to Extract the File System

    Target Organization
    URL
    Target IoT Device
    Commands Used

    Extracted File System Successfully? Yes No


    Data Obtained
    Decimal Hexadecimal Description
    1.
    2.
    3.
    4.
    5.
    6.
    7.
    8.
    9.
    10.
    Tools/Services Used 1.
    2.
    3.
    4.
    5.

    Confidential 8 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Results Analysis:

    Confidential 9 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Test 1.5: Explore the File System

    Target Organization
    URL
    Target IoT Device
    Commands Used

    Explored the File System Successfully? Yes No


    File System Type Squashfs
    Cramfs
    JFFS2
    YAFFS2
    ext2
    Any Other, Specify________________
    Compression Type LZMA
    Gzip
    Zip
    Zlib
    Arj
    Any Other, Specify________________
    Vulnerabilities Identified 1.
    2.
    3.
    4.
    5.

    Confidential 10 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.
    EC-Council Certified Penetration Testing Professional

    Tools/Services Used 1.
    2.
    3.
    4.
    5.

    Results Analysis:

    Confidential 11 CPENT Template Copyright © by EC-Council


    All Rights Reserved. Reproduction is Strictly Prohibited.

    You might also like