awesome-iot-security-resource
awesome iot exploit resource
https://github.com/f1tao/awesome-iot-security-resource
Last synced: 11 days ago
JSON representation
Blog
Other
Exploitation Method
BSS Overflow
Heap Overflow
Heap Spray
- MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
- MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
Uninitialized Pointer Vulnerability
Firmware
Firmware Analysis
- IoT漏洞研究（一）固件基础
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
- OpenWRT中的Flash简析
Firmware Emulation
Firmware Extraction
- Breaking Fortinet Firmware Encryption
- Zyxel firmware extraction and password analysis
- MindShare: Dealing With Encrypted Router Firmware
- Reverse Engineering Yaesu FT-70D Firmware Encryption
- Intro to Embedded RE: UART Discovery and Firmware Extraction via UBoot
- Dumping Flash Content
- 智能设备漏洞挖掘之固件提取
- Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1)
Fundamental
Hardware Crack
Fault Injection
- Bypassing Secure Boot using Fault Injection
- KERNELFAULT: R00ting the Unexploitable using Hardware Fault Injection
- KERNELFAULT: Pwning Linux using Hardware Fault Injection
- HARDENING SECURE BOOT ON EMBEDDED DEVICES FOR HOSTILE ENVIRONMENTS
Heap Overflow
- Exception(al) Failure - Breaking the STM32F1 Read-Out Protection
- Extract Firmware from OT Devices for Vulnerability Research
- Methods for Extracting Firmware from OT Devices for Vulnerability Research
- Hacking Some More Secure USB Flash Drives (Part I)
- Hacking Some More Secure USB Flash Drives (Part II)
- Hardware Hacking to Bypass BIOS Passwords
Specification
Firmware Extraction
Tool
Debug Tool
Firmware Analysis
Firmware Emulation
Firmware Extraction
Other
Vulnerability Writeup
ASUS
BootLoader
- [胖猴小玩闹
- Breaking Secure Boot on the Silicon Labs Gecko platform
- [胖猴小玩闹
- Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
- [胖猴小玩闹
Camera
- HiSilicon DVR hack
- Exploiting: Buffer overflow in Xiongmai DVRs
- Hacking the Furbo Dog Camera: Part I
- Hacking the Furbo Dog Camera: Part II
- Hacking the Furbo Dog Camera: Part III Fun with Firmware
- Hacking a Tapo TC60 Camera
- Black Hat 2013 - Exploiting Network Surveillance Cameras Like a Hollywood Hacker
Car
- How I Hacked my Car
- How I Hacked my Car Part 2: Making a Backdoor
- How I Hacked my Car Part 3: Making Software
- NFC RELAY ATTACK ON TESLA MODEL Y
- 浅谈车机IVI漏洞挖掘
- 新型车机，如何攻防？
- APK逆向分析入门-以某车载音乐APP为例
- Rooting Bosch lcn2kai Headunit
- 浅谈车机IVI漏洞挖掘
- APK逆向分析入门-以某车载音乐APP为例
Cisco
- Analysis of Unauthenticated Command Execution Vulnerability in Cisco IOS XE System WebUI
- Cisco RV130 – It’s 2019, but yet: strcpy
- Exploiting CVE-2019-1663
- Breaking Cisco RV110W, RV130, RV130W, and RV215W. Again.
- Ghetto Patch Diffing a Cisco RV110W Firmware Update
- Patch Diffing a Cisco RV110W Firmware Update (Part II)
- Cisco RV340 SSL VPN Unauthenticated Remote Code Execution as root
- Cisco IOS XE CVE-2023-20198 and CVE-2023-20273: WebUI Internals, Patch Diffs, and Theory Crafting
- Cisco IOS XE CVE-2023-20198: Deep Dive and POC
Citrix
- CVE-2023-3519
- Reversing Citrix Gateway for XSS
- Analysis of CVE-2023-3519 in Citrix ADC and NetScaler Gateway
ConnectedIO
D-Link
- THE ANATOMY OF A BUG DOOR: DISSECTING TWO D-LINK ROUTER AUTHENTICATION BYPASSES
- Debugging D-Link: Emulating firmware and hacking hardware
- D-Link DIR-816 A2路由器安全研究分享
- Reverse Engineering a D-Link Backdoor
- D-Link DAP-X1860: Remote Command Injection
- SSD ADVISORY – D-LINK DIR-X4860 SECURITY VULNERABILITIES
F5 BIG-IP
- CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures
- CVE-2023-22374: F5 BIG-IP Format String Vulnerability
- Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747
Fortigate
- Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN
- Producing a POC for CVE-2022-42475 (Fortinet RCE)
- CVE-2022-42475
- Xortigate, or CVE-2023-27997 - The Rumoured RCE That Was
- XORtigate: Pre-authentication Remote Code Execution on Fortigate VPN (CVE-2023-27997)
- HEXACON2023 - XORtigate: zero-effort, zero-expense, 0-day on Fortinet SSL VPN by Charles Fol
- CVE-2023-27997-FortiGate-SSLVPN-HeapOverflow
- Building an Exploit for FortiGate Vulnerability CVE-2023-27997
- Two Bytes is Plenty: FortiGate RCE with CVE-2024-21762
GL.iNET
Juniper
- CVE-2023-36844 And Friends: RCE In Juniper Devices
- Fileless Remote Code Execution on Juniper Firewalls
MikroTik
MQTT Protocol
NAS
- A Pain in the NAS: Exploiting Cloud Connectivity to PWN your NAS: WD PR4100 Edition
- A Pain in the NAS: Exploiting Cloud Connectivity to PWN your NAS: Synology DS920+ Edition
- Synology NAS DSM Account Takeover: When Random is not Secure
Netgear
- CVE-2021-33514：Netgear 多款交换机命令注入漏洞
- Feral Terror vulnerability (some NETGEAR smart switches UPDATED 3
- Seventh Inferno vulnerability (some NETGEAR smart switches)
- Draconian Fear vulnerability (some NETGEAR smart switches)
- COOL VULNS DON'T LIVE LONG - NETGEAR AND PWN2OWN
- PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749
- Puckungfu: A NETGEAR WAN Command Injection
- nday exploit: netgear orbi unauthenticated command injection (cve-2020-27861)
- NETGEAR NIGHTHAWK R7000P UPNPD BUFFER OVERFLOW REMOTE CODE EXECUTION VULNERABILITY
- Reverse Engineering a Netgear Nday
- NETGEAR NIGHTHAWK R7000P AWS_JSON UNAUTHENTICATED DOUBLE STACK OVERFLOW VULNERABILITY
- Our Pwn2Own journey against time and randomness (part 1)
- Our Pwn2Own journey against time and randomness (part 2)
- Pwn2Own Toronto 22: Exploit Netgear Nighthawk RAX30 Routers
- NetGear 夜鹰 RAX40V2 设备与固件分析
Other
- Tetsuji: Remote Code Execution on a GameBoy Colour 22 Years Later
- Your not so "Home Office" - SOHO Hacking at Pwn2Own
Palo Alto
Printer
- DryOS PIXMA Printer Shell
- A Sheep in Wolf’s Clothing – Finding RCE in HP’s Printer Fleet
- FAXPLOIT: SENDING FAX BACK TO THE DARK AGES
- TREASURE CHEST PARTY QUEST: FROM DOOM TO EXPLOIT
- Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup
- Your printer is not your printer ! - Hacking Printers at Pwn2Own Part I
- Your printer is not your printer ! - Hacking Printers at Pwn2Own Part II