IoT Penetration Testing Full Guide

IoT pentesting is a new domain that have entered in penetration testing. With the growing risk of IoT security, attack on various IoT devices, often pentesters are asked by various companies to check their systems. But the problem is that most security service providers don't yet have IoT specialist for testing, it is usually done by regular security team. In this article we will try to see what exactly is IoT penetration testing.

The difficulty level and the steps to perform the testing is almost similar to that of regular testing but if you are discovering flaws via analyzing firmware or via analyzing wireless communications then its going to be difficult.

The benefits to pen testing Iot include strengthening device security, protecting against unauthorized usage, avoiding Elevation of Privileges, Lower reducing the risk of compromise, better user and data privacy, and setting strong Encryption to avoid man-in-the-middle (MTM) attacks.

Most of the currenct research focus on vulnerabilities on the device but it is important to have a look at other areas too. Areas pentesters needs to focus

  • The devices themselves
  • The operating system that runs on the devices
  • The software on the devices
  • The mobile application
  • The servers themselves
  • The build on the servers

Basic IoT Architecture

An attacker gets many ways to breach an IOT system as its architecture compromises a number of elemets that becomes potential hacker's target

IoT architecture consists of the following components :

Things: Smart devices equipped with sensors and actuators.

IoT field Gateways: Border elements that provide connectivity between things and the cloud part of an IoT solution.

Cloud gateways: Components facilitating data compression and transmission between the gateways and cloud servers.

Streaming data processor: An element ensuring a smooth transition of input data to a big data warehouse and control applications.

Data storage: Consists of a data lake (stores unprocessed data in the form of “streams”) and a big data warehouse (stores filtered and structured data, as well as context information about smart devices, sensors, commands from control applications).

Data analytics: A unit that uses information from the big data warehouse to establish data patterns and gain meaningful insights.

Machine learning: Generates and regularly updates models based on the historical data accumulated in a big data warehouse which is used by control applications.

Control applications: Components that send automatic commands and alerts to actuators.

Client-server system: Consists of a user business logic component (the server side), a mobile application and a web application (the client side).

Penetration testing is executed on the following elements of things:

  • UART, JTAG, SWD ports. Exposed ports allow a pentester to get root access, view and modify sensitive data.
  • Flash memory chips to detect a possibility to dump firmware.
  • Bus sniffing. Hackers may sniff clear text data between components and get access to sensitive information.

Book to follow

IoT is interesting and yet a hard topic to follow. Here is a book which i recommend which you can use to learn more about IoT . here is a book by popular security researcher Aditya Gupta who is an expert in Iot Pentesting

List of must have security apps for your mobile [ 2018 ]

Mobile security is increasingly important. We all keep plenty of data on our phones, and some of that data is either personal or sensitive. From the credit card info that’s attached to your Amazon app, to the login data from your banking app, there stuff that we just don’t want other people to know. Or maybe your web browsing history isn’t quite as squeaky clean as it should be. Getting the right kind of security apps for your mobile is essential, but which ones should you choose?

What We’re Looking For.

We’re looking for apps that increase the security on your phone. Useful apps. We’ve dismissed anti-virus or malware apps from this list, since there are tons of them as well as plenty of resources telling you which are the best. So we’re looking at more specialised apps. In addition, a couple of our choices aren’t marketed as security apps as such, they simply have a side effect of increasing security. But if you’re looking to make your data secure, then these are the apps you should think about downloading.

Find My Device

We’re starting out with a no brainer here. Find My Device is by far one of the most useful security apps around. Originally using the name Android Device Manager, Find My Device is a simply little app that tracks your phone. That’s useful if you’ve lost your mobile, had it stolen, or simply can’t remember where it is. You just head to the Find My Device web page on your computer and you’ll get a little blip on a map telling you where your phone is.

But that’s not the real reason we’ve chosen Find My Device. Because the app also has extra features. It allows you to remotely lock your phone, so if you happen to have left it at the office no one can pick it up and get your data. It also allows you to remotely wipe your phone, so if it has been stolen you can erase all that personal data with the press of a button and thieves will never get hold of it. Find My Device is free, and is an absolute essential if you’ve got a mobile phone.

DuckDuckGo Privacy Browser

We all know how much data websites collect about us, and if that thought bothers you, then DuckDuckGo should be one of the first apps that you download. It’s a free, super secure web browser that doesn’t track your web history. It’s sort of like constantly browsing in incognito mode. Once you exit the app, it will no longer remember anything about your last web session. It’s a basic browser and doesn’t have many features other than privacy, but it’s great at what it does. It’s also free, though there are some (non-intrusive) ads.


Haven is a very unique addition to this list, but also a very cool one. Essentially, it lets you turn a secondary device into a security phone. You download Haven onto an old mobile that you no longer use and that mobile will become your security device (you will need a SIM card for certain notifications so your best bet is looking for a low cost rolling sim only deal). It will record sound through the phone’s microphone, it detects light (if someone opens a door, or opens your luggage, for example). And if you stick that secondary phone into your suitcase or handbag it will set off an alarm when that case or bag is moved. Okay, it’s pretty specialised, but it’s also free and could be a great addition for frequent travellers.


If you’re serious about security, then a password manager is a must, and LastPass is the grand-daddy of them all. It stores your individual passwords, so you don’t have to remember all of them (thus encouraging you to use different passwords for different sites, as well as longer, more complicated and therefore more secure passwords). It will also generate super secure passwords for you. It syncs across platforms, so it’ll work on your computer too. And it’s free. There’s a pro version available, but the free version should do everything that the average user needs. Having a password isn’t enough to ensure security. Having a password manager is.


A VPN isn’t just an excuse to be able to watch US Netflix from the UK, or to hide your illegal streaming activity. A good VPN will hide everything you do, from inputting a password into a site, to your web browser history. And ProtonVPN, despite being pretty new, is an excellent choice. It’s free, and has full encryption, so anything you do on your mobile whilst the VPN is switched on will be scrambled. The disadvantage here is that speeds on your phone will be a little slower with a VPN switched on, but that’s a small price to pay for complete privacy.

Resilio Sync

Resilio Sync is another fairly unique app. In basic terms, it allows you to create your own cloud storage system. Let’s say that someone sends you a sensitive document on your phone. You want to be able to back up that document, but you don’t want to send such sensitive info to your DropBox or G Drive account. Resilio Sync creates a cloud of storage on your home computer. So you can back up that document from your phone straight to your own PC without it going through the cloud first. Now that’s security. Resilio Sync is free.

Signal Private Messenger

Finally, if you want to send text messages in absolute privacy you actually have a few options. But with the drama surrounding Facebook, WhatsApp (owned by FB) might not be your first choice anymore. And that’s where Signal Private Messenger comes in. Complete end to end encryption of your messages, group messaging, the ability to have messages disappear after a certain amount of time, and absolutely zero data storing in the app, this is the king of private messaging. It’s free, and the only real downside is that you’ll have to persuade all your friends to download the app too.

Utilities of an Ethical hacking Course

Computer hacking involves various nuances. What prompts a hacker is an intent, benign or malicious, to hack a particular application. “Ethical hacking”, a term coined by the cyber industry, describes the actions of hacking that are purely ethical means a hacker exploits a network with the permission of its owner. This distinction keeps Ethical hackers aka white hat hackers separated from black-hatted bad guys.
 Why Use Ethical Hacking?
What can you expect to get when you pay to someone to hack into your application or website? Expose of security vulnerabilities! Being a part of the cyber world, you need to think like a criminal to prevent attacks. Ethical hackers use the same methods as their counterparts to test a security system, but they do it to report problems. The Federal government practices ethical hacking since the 1970s, and most companies employ white hat teams within their information security practice to attain the highest level of security. Other slang terms for ethical hackers are “sneakers,” “red teams”, and “tiger teams”. A variety of certification authorities train and certify your skills in implementing cybersecurity practices in an organization successfully.

Today, application security revolves around penetration testing. Companies perform “Pen tests” by artificially developing the scenarios of hacking and try to mimic what a bad hacker could achieve in reality. For manual application testing, cyber experts attempt to exploit the app and report the findings. From simple information-gathering exercises to outright attacks, different tests are performed which would cause damage if happened actually. Moreover, social engineering techniques have become an integral part of core ethical hacking, for example, tricking emailing staff for revealing passwords and other account details.
Free and Open Source Ethical Hacking Tools to Use:
A wide pool of ethical hacking tools is available to choose from according to challenges and requirements you have for cybersecurity. The tools mentioned below offer just a slice of the available offerings, but they are reliable and come for free. 
Being one of the most preferred penetration testing frameworks for networks and IT infrastructure, Armitage is designed for more user-friendly front-end version for the Metasploit framework.
Nmap or you can say Network Mapper is an open-sourced utility which works a security auditing tool. By finding a network services out, it hosts to develop a network map, which it further analyzes.
This tool is even featured as the go-to hacking tool in many movies and TV shows.
Its offerings include network protocol capture and real-time analysis which make it a standard tool amongst others. Using this tool gives you a wider look into network traffic and zoom in on individual packets while providing naives a detailed intro to TCP/IP.
This tool has transformed the way to perform pentesting. It has scored 6th rank on the top security tools list by  It plays a major role in analysis, indexation, and distribution of the data.
 International standards followed by ethical hackers
Being an ethical hacker, you are expected to follow industry trends to carry out penetration testing. An important trend is Payment Card Industry Data Security Standard. With a global set of recognised policies and procedures, this trend enhances the securities of credit, debit in addition to cash card transactions, and safeguards cardholders personal information.
Apart from having large teams of employees as ethical hackers, organizations own ethical hacking labs like Trustwave Holdings Inc., heading towards comprehensive cybersecurity which includes the tracking of vulnerabilities in ATMs, POS devices along with surveillance systems.
Hacking is a passion, but it must be ethical in all aspects. It’s a good career option, but only if you have good  knowledge of advanced tools and techniques. Proceeding with an ethical hacking course will make you think of, work for, and make decisions for like a professional hacker.