https://github.com/umair9747/genzai

The IoT security toolkit to help identify IoT related dashboards and scan them for default passwords and vulnerabilities.
https://github.com/umair9747/genzai

cybersecurity golang hacking iot iot-security penetration-testing pentesting redteam security security-scanner security-tools

Last synced: about 10 hours ago
JSON representation

The IoT security toolkit to help identify IoT related dashboards and scan them for default passwords and vulnerabilities.

• Host: GitHub
• URL: https://github.com/umair9747/genzai
• Owner: umair9747
• License: apache-2.0
• Created: 2024-01-20T10:56:54.000Z (10 months ago)
• Default Branch: main
• Last Pushed: 2024-11-16T13:14:06.000Z (4 days ago)
• Last Synced: 2024-11-16T13:18:18.043Z (4 days ago)
• Topics: cybersecurity, golang, hacking, iot, iot-security, penetration-testing, pentesting, redteam, security, security-scanner, security-tools
• Language: Go
• Homepage:
• Size: 11.4 MB
• Stars: 152
• Watchers: 2
• Forks: 22
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
Genzai

The IoT Security Toolkit



Description • Features • Setup & Usage • Acknowledgements • Contact Me




  

  

  

  














 Description 

Genzai helps you identify IoT or Internet of Things related dashboards across a single or set of targets provided as an input and furthermore scan them for default password issues and potential vulnerabilities based on paths and versions.




An example would be an admin panel for a home automation device acceessible over the internet. The tool will firstly fingerprint the IoT (product) based on a set of signatures from signatures.json and then based on the product identified, and the relevant templates in its DBs (vendor-logins.json and vendor-vulns.json), scan it for vendor-specific default passwords like  admin:admin as well as look for any potential vulnerabilities.





Genzai currently supports fingerprinting over 20 IoT-based dashboards and has the same amount of templates to look for default password issues across them. It currently has a total of 10 vulnerability templates which will increase with coming updates.







 Features 


Fingerprinting - The Wappalyzer of IoT Devices

With Genzai, you can fingerprint the IoT Product running over a target based on the HTTP response received through it. With a support of 20 templates and counting, Genzai can look for categories such as:




- Wireless Router

- Surveillance Camera

- HMI or Human Machine Interface

- Smart Power Control

- Building Access Control System

- Climate Control

- Industrial Automation

- Home Automation

- Water Treatment System

Default Password Checks

Based on the IoT product identified and the presence of a relevant template in Vendor Logins DB, Genzai will also check if the target is still using a vendor-specific default password considering how several devices across the internet still use a default password letting anyone to log in as an administrative user.



Vulnerability Scanning

Also based on the IoT product identified and with the presence of a relevant template in Vendor Vulns DB, Genzai will check for any potential vulnerabilities across the target. While some of the templates actively flag issues based on an exposed endpoint or file, others may flag based on a vulnerable version.




 Acknowledgements 

Genzai has been or will be noticed at,



Black Hat Asia 2024 [Arsenal]

GISEC Armory Edition 1 Dubai 2024








 Let's Connect! 

If you have any questions or feedback about Genzai or just want to connect with me, feel free to reach out via LinkedIn or Email.



Legal Disclaimer

Usage of Genzai for scanning or attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.