iot-overview
Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks, wireless protocol sidebands (BLE, Zigbee, Z-Wave, LoRaWAN, sub-GHz).
66
80%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
IoT / Embedded Operator Skill Catalog
This catalog covers the surface area between hardware reconnaissance and runtime exploitation of IoT and embedded targets. Wireless sidebands (BLE / Zigbee / Z-Wave / LoRaWAN / sub-GHz) live alongside firmware-level attacks because IoT engagements routinely chain across both.
Playbooks
| Skill | Use for |
|---|---|
/skills/standard/iot/firmware-acquisition/SKILL.md | Vendor portals, OTA capture, SPI flash dump, eMMC chip-off |
/skills/standard/iot/binwalk-extract/SKILL.md | binwalk + firmware-mod-kit extraction; squashfs / jffs2 mount |
/skills/standard/iot/hardcoded-creds/SKILL.md | Strings, shadow, busybox httpd, telnet logs |
/skills/standard/iot/bootloader-uboot/SKILL.md | U-Boot console interrupt; environment variables; secure-boot bypass |
/skills/standard/iot/dev-mem/SKILL.md | /dev/mem, /dev/kmem, MTD writes on embedded Linux |
/skills/standard/iot/ble-gatt/SKILL.md | GATT enumeration, characteristic read/write without auth, pairing downgrade |
/skills/standard/iot/zigbee-touchlink/SKILL.md | Touchlink commissioning abuse, well-known transport key, ZCL command abuse |
/skills/standard/iot/z-wave/SKILL.md | S0 derivation flaw, S2 ECDH analysis, replay on unauthenticated nodes |
/skills/standard/iot/lorawan-otaa/SKILL.md | OTAA join, frame-counter replay, downlink injection |
/skills/standard/iot/sub-ghz/SKILL.md | 433/868/915 MHz capture + replay (HackRF, Flipper Zero, RTL-SDR) |
Workflow
- Inventory hardware: photograph PCB; identify SoC, flash, debug pads (UART = 4-pin pattern; JTAG = TAP; SWD = 2-pin SWDIO/SWCLK).
- Acquire firmware: vendor update portal first; OTA proxy capture second; SPI flash dump third; eMMC chip-off last.
- Extract:
binwalk -eM <fw.bin>, then mount squashfs / jffs2 / ubifs. - Triage: search strings for credentials, AWS keys, MQTT topics, hardcoded IPs; identify backdoor accounts (busybox /etc/passwd, telnet/SSH stanzas).
- Wireless co-channels: if the device speaks BLE / Zigbee / Z-Wave / LoRaWAN, capture commissioning, replay, attempt key extraction.
- Cloud-IoT: if the device backhauls to a vendor cloud, pivot to the mobile companion app and the cloud API.
Hardware bench tools (sandbox tools)
- Logic analyzer: Saleae Pro 8 / Sigrok PulseView.
- Flash interface: ch341a + SOIC clip.
- Debug interface: BusPirate v5, J-Link, Black Magic Probe.
- Glitching: ChipWhisperer-Nano / Pico.
- Wireless: HackRF One, Sonoff Zigbee 3.0 Dongle E, RTL-SDR Blog v4.
Safety
IoT engagements often touch consumer devices that the operator owns but
that have shared cloud accounts (vendor telemetry). RoE must enumerate
which clouds may be probed. ConOps blue_team field should declare the
vendor IR contact when in scope so a fail-safe trip can be reported.
- Repository
- PurpleAILAB/Decepticon
- Commit
0cf691e
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.