IoT Hardware Guide

Intro to Hardware Hacking - Dumping Your First Firmware

An Introduction to Hardware Hacking

Hardware Toolkits for IoT Security Analysis

Hardware Hacking for IoT Devices - Offensive IoT Exploitation

Identifying UART Interface

An in depth explanation of the UART protocol.

Serial Terminal Basics

Reverse Engineering Serial Ports

Intro to Embedded RE: UART Discovery and Firmware Extraction via UBoot

Using UART to Connect to a Chinese IP Cam

A Journey into IoT Hardware Hacking: UART

Accessing and Dumping Firmware Through UART

UART Connections and Dynamic Analysis on Linksys e1000

Hardware Hacking 101: Introduction to JTAG

How to Find the JTAG Interface

Analyzing JTAG

Bus Pirate JTAG Connections with OpenOCD

Extracting Firmware from External Memory via JTAG

The Hitchhacker's Guide to iPhone Lightning and JTAG Hacking

Debugging AVR Microcontrollers Through JTAG

SWD Protocol Overview - HardBreak Wiki

Unveiling Vulnerabilities: Exploring SWD Attack Surface in Hardware

Introduction to ARM Serial Wire Debug Protocol

Serial Wire Debug and CoreSight Architecture

LibSWD - Serial Wire Debug Open Library

Hardware Hacking and Exploitation Bootcamp - SWD

Hardware Hacking 101: Identifying and Dumping eMMC Flash

Dumping Firmware from Router Using Bus Pirate - SPI

Extracting Flash Memory over SPI

Extracting Firmware from Embedded Devices (SPI NOR Flash)

How to Flash Chip of a Router with a Programmer

TPM 2.0: Extracting Bitlocker Keys Through SPI

IoT Security Part 16: Hardware Attack Surface I2C

I2C Exploitation - HackTricks

Non-invasive I2C Hardware Trojan Attack Vector (PDF)

Hardware Hacking: I2C Injection with Bus Pirate

Safeguarding SPI, I2C, and I3C Protocols

Introduction to TPM (Trusted Platform Module)

Trusted Platform Module Security Defeated in 30 Minutes

eMMC Protocol

RPMB: A Secret Place Inside the eMMC

eMMC Data Recovery from Damaged Smartphone

Unleash Your Smart-Home Devices: Vacuum Cleaning Robot Hacking

Hands-On IoT Hacking: Rapid7 at DEF CON 30

Side Channel Attacks - Yifan Lu

Attacks on Implementations of Secure Systems

Fuzzing, Binary Analysis, IoT Security Collection

NAND Glitching Attack on Wink Hub

Voltage Glitching with Crowbars Tutorial

Voltage Glitching Attack using iCEstick Glitcher

FPGA Glitching and Side Channel Attacks - Samy Kamkar

Hardware Power Glitch Attack - rhme2

Keys in Flash - Glitching AES Keys from Arduino

Implementing Practical Electrical Glitching Attacks

How to Voltage Fault Injection

Glitcher Part 1 - Reproducible Voltage Glitching on STM32 Microcontrollers

STM32L05 Voltage Glitching

Breaking AES with ChipWhisperer

ChipWhisperer Wiki

Rowhammer Bit Flips to Steal Crypto Keys

Dumping the Amlogic A113X Bootrom

Retreading The AMLogic A113X TrustZone Exploit Process

Reverse Engineering an Unknown Microcontroller

Hacking Microcontroller Firmware Through a USB

There's A Hole In Your SoC: Glitching The MediaTek BootROM

A Practical Tutorial on PCIe for Total Beginners on Windows - Part 1

A Practical Tutorial on PCIe for Total Beginners on Windows - Part 2

PCIe DMA Attack against a Secured Jetson Nano (CVE-2022-21819)

Complete Course in Software Defined Radio - Michael Ossmann

Understanding Radio

Introduction to Software Defined Radio

Introduction to GNU Radio Companion

Creating a Flow Graph in GNU Radio Companion

Analyzing Radio Signals 433MHz

Recording Specific Radio Signals

Replay Attacks with Raspberry Pi and rpitx

Reverse Engineering a Car Key Fob Signal

GRCON 2021 - Capture the Signal

Awesome Bluetooth Security

Traffic Engineering in a Bluetooth Piconet

BLE Characteristics: A Beginner's Tutorial

Intro to Bluetooth Low Energy (PDF)

Bluetooth LE Security Study Guide

Reverse Engineering BLE Devices

My Journey Towards Reverse Engineering a Smart Band - Bluetooth-LE RE

Intel Edison as Bluetooth LE Exploit Box

Reverse Engineering and Exploiting a Smart Massager

I Hacked MiBand 3

GATTacking Bluetooth Smart Devices

Examining the August Smart Lock

Practical Introduction to BLE GATT Reverse Engineering

MojoBox - Yet Another Not So Smartlock

Bluetooth Smartlocks

Bluetooth Beacon Vulnerability

Denial of Pleasure: Attacking Unusual BLE Targets with a Flipper Zero

Grand Theft Auto: A peek of BLE relay attack

How I Hacked Smart Lights: CVE-2022-47758

Finding Bugs in Bluetooth

Sweyntooth Vulnerabilities

BrakTooth: Causing Havoc on Bluetooth Link Manager

BLUFFS: Bluetooth Forward and Future Secrecy Attacks (CVE-2023-24023)

AirDrop Leak - Sniffing BLE Traffic from Apple Devices

BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution

BRAKTOOTH: Causing Havoc on Bluetooth Link Manager (PDF)

Norec Attack: Stripping BLE encryption from Nordic's Library (CVE-2020-15509)

BlueDucky - HID Injection on Unpatched Android (CVE-2023-45866)

Microsoft Bluetooth Driver Spoofing - CVE-2024-21306

Bluetooth Auracast / LE Audio Security Analysis

Blue2thprinting: WTF Am I Even Looking At?

Open Wounds: Last 5 Years Have Left Bluetooth to Bleed

Sniffing Bluetooth Through My Mask During the Pandemic

Bluing - Intelligence Gathering for Bluetooth

BlueToolkit - Bluetooth Classic Vulnerability Testing

btproxy

hcitool and bluez

Testing with GATT Tool

crackle - Cracking BLE Encryption

Crack and decrypt BLE encryption.

bettercap

The Swiss Army knife for 802.11, BLE, HID, CAN-bus, IPv4 and IPv6 networks reconnaissance and MITM attacks.

GATTacker

BTLEjack - BLE Swiss Army Knife

Based on the micro:bit, it provides everything you need to sniff, jam and hijack Bluetooth Low Energy devices.

DEDSEC Bluetooth Exploit

BrakTooth ESP32 PoC

SweynTooth BLE Attacks

ESP32 Bluetooth Classic Sniffer

Bluetooth Hacking Collection

nRF52840 Dongle

Ubertooth One

CSR 4.0 Bluetooth Dongle

ESP32

Sena UD100

ESP-WROVER-KIT

ice9-bluetooth-sniffer

InternalBlue - Bluetooth Experimentation Framework

Bluetooth experimentation framework based on the Reverse Engineering of Broadcom Bluetooth Controllers

Hacking Bluetooth to Brew Coffee from GitHub Actions - Part 1

Hacking Bluetooth to Brew Coffee from GitHub Actions - Part 2

Hacking Bluetooth to Brew Coffee from GitHub Actions - Part 3

Introduction and Protocol Overview

ZigBee and Z-Wave Security Brief

Hacking ZigBee Networks

Hacking IoT Devices with Attify Zigbee Framework

Zigator: Analyzing Security of Zigbee-Enabled Smart Homes

Security Analysis of Zigbee with Zigator and GNU Radio

Low-Cost ZigBee Selective Jamming

Killerbee

Framework for Testing & Auditing ZigBee and IEEE 802.15.4 Networks.

ZigDiggity

Zigator

Z3sec

zigbear

ApiMote

RaspBee

ATUSB IEEE 802.15.4 Adapter

USRP

LoRaWAN Security Overview - Tektelic

Security Vulnerabilities in LoRaWAN

Low Powered and High Risk: Attacks on LoRaWAN Devices

LAF - LoRaWAN Auditing Framework

ChirpOTLE - LoRaWAN Security Framework

LoRaWAN Security Survey - ScienceDirect

LoRaWAN - Wikipedia

Millions of Devices Using LoRaWAN Exposed - SecurityWeek

Do You Blindly Trust LoRaWAN Networks? - IOActive

LoRaWAN Encryption Keys Easy to Crack - Threatpost

LoPT: LoRa Penetration Testing Tool (PDF)

LoRa Craft - Packet Interception

Open Source LoRaWAN Hacking Tool

LoRaWAN Hackaday Projects

Matter Standard - CSA-IoT

Matter Protocol Wikipedia

Matter Protocol Complete Guide 2025

How to Secure Smart Home Devices with Matter

Smart Home Device Solutions for Matter - DigiCert

Security Vulnerabilities and Attack Scenarios in Smart Home with Matter

Trust Matters: Uncovering Vulnerabilities in Matter Protocol - Nozomi

Matter over Thread Security

State-of-the-Art Review on IoT Wireless PAN Protocol Security

Matter Smart Home - Krasamo

Threadbare: Practical Attacks on Thread Networks (Black Hat USA 2024)

Matter Specification 1.3 - Connectivity Standards Alliance

Thread Group Security Analysis

Awesome Cellular Hacking

Introduction to GSM Security

Breaking LTE on Layer Two

5Ghoul - 5G NR Attacks and Fuzzing

Exploiting CSN.1 Bugs in MediaTek Basebands

SIM Hijacking

SigPloit - Telecom Signaling Exploitation Framework

Signaling security testing framework dedicated to telecom security for researching vulnerabilites in the signaling protocols used in mobile (cellular phone) operators.

LTE Sniffer

5G NR Jamming, Spoofing and Sniffing

LTrack: Stealthy Tracking of Mobile Phones in LTE

Open5GS - Open Source 5G/4G Core

Open5GS is a C-language Open Source implementation for 5G Core and EPC, i.e. the core network of LTE/NR network (Release-19)

SCAT - Signaling Collection and Analysis Tool for Cellular

GSM Security Part 2

What is Base Transceiver Station

Introduction to SS7 Signaling

SS7 Network Architecture

Introduction to SIGTRAN

How to Build Your Own Rogue GSM BTS

GSM Vulnerabilities with USRP B200

Security Testing 4G (LTE) Networks

Case Study of SS7/SIGTRAN Assessment

ss7MAPer - SS7 Pentesting Toolkit

Fake BTS Detector (SCL-8521)

Awesome RFID/NFC Security Talks

RFID Discord Group

SoK: Security of EMV Contactless Payment Systems

NFC Relay Attack on Tesla Model Y

Real Time Interception of DECT Cordless Telephone

Eavesdropping on Unencrypted DECT Voice Traffic

Decoding DECT Voice Traffic: In-depth Explanation

Framing Frames: Bypassing Wi-Fi Encryption by Manipulating Transmit Queues

Man-in-the-Middle Attacks without Rogue AP: When WPAs Meet ICMP Redirects

WPAxFuzz: Sniffing Out Vulnerabilities in Wi-Fi Implementations

Untangling the Knot: Breaking Access Control in Home Wireless Mesh Networks

Over The Air: Exploiting Broadcom's Wi-Fi Stack (Part 1)

Over The Air: Exploiting Broadcom's Wi-Fi Stack (Part 2)

Over The Air: Exploiting The Wi-Fi Stack on Apple Devices

Reverse-engineering Broadcom wireless chipsets

Exploiting Qualcomm WLAN and Modem Over the Air

Windows Wi-Fi Driver RCE Vulnerability - CVE-2024-30078

When a Wi-Fi SSID Gives You Root on an MT02 Repeater - Part 1

When a Wi-Fi SSID Gives You Root on an MT02 Repeater - Part 2

Reverse Engineering WiFi on RISC-V BL602

Unveiling secrets of the ESP32: creating an open-source MAC Layer

Unveiling secrets of the ESP32: reverse engineering RX

ALL ABOUT USB-C: INTRODUCTION FOR HACKERS

Hi, My Name is Keyboard

How to Weaponize the Yubikey

UWB Real Time Locating Systems: How Secure Radio Communications May Fail in Practice

All cops are broadcasting: TETRA under scrutiny

TETRA:BURST - Five Vulnerabilities in TETRA Standard (Midnight Blue)

TETRA:BURST 2:ELECTRIC BOOGALOO - End-to-End Encryption Broken (BlackHat USA 2025)

TETRA Decoder - Open Source TETRA Receiver

Practical TETRA Sniffing with SDR

Introduction to Firmware Analysis - OWASP

OWASP Firmware Security Testing Methodology

IoT Security Verification Standard (ISVS)

Reversing 101

by Kevin Thomas

Hands-on Firmware Extraction, Exploration, and Emulation

Router Analysis Part 1: UART Discovery and SPI Flash Extraction

Hardware Hacking Tutorial: Dumping and Reversing Firmware

Firmware Samples - firmware.center

BasicFUN Series: Hardware Analysis / SPI Flash Extraction

BasicFUN Series: Reverse Engineering Firmware / Reflashing SPI Flash

Retrofitting encrypted firmware is a Bad Idea

EMBA - Embedded Linux Firmware Analyzer

FACT - Firmware Analysis and Comparison Tool

Binwalk v3

Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.

Firmwalker

Searches extracted firmware images for interesting files and information.

fwanalyzer

Analyze security of firmware based on customized rules. Intended as additional step in DevSecOps, similar to CI.

fwhunt-scan - UEFI Firmware Analysis

ByteSweep

BINSEC

unblob - Extraction Framework

Checksec.sh

bash script to check the properties of executables (like PIE, RELRO, PaX, Canaries, ASLR, Fortify Source)

Firmware Modification Kit

Firmadyne - Automated Firmware Emulation

Tries to emulate and pentest a firmware.

FirmAE - Firmware Analysis and Emulation

QEMU

is a fast processor emulator using a portable dynamic translator. QEMU emulates a full system, including a processor and various peripherals. It can be used to launch a different Operating System without rebooting the PC or to debug system code.

PANDA - Architecture-Neutral Dynamic Analysis

[Platform for Architecture-Neutral Dynamic Analysis]

Avatar2 - Dynamic Firmware Analysis

Renode - Embedded Systems Emulator

a virtual development tool for multinode embedded networks.

Unicorn Engine - CPU Emulator

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)

Qiling Framework

HALucinator

FirmWire - Baseband Firmware Emulation

SymQEMU

S2E - Selective Symbolic Execution

Bochs - x86 Emulator

SAME70 Emulator

Emulate Until You Make it

Firmware Emulation with QEMU

Emulating ARM Router Firmware - Azeria Labs

Emulating IoT Firmware Made Easy

IoT Binary Analysis and Emulation Part 1

Cross Debugging for ARM/MIPS with QEMU

QEMU + Buildroot 101

Simulating and Hunting Firmware Vulnerabilities with Qiling

Qiling and Binary Emulation for Automatic Unpacking

Debugging D-Link: Emulating Firmware and Hacking Hardware

Adaptive Emulation Framework for Multi-Architecture IoT

Automatic Firmware Emulation through Invalidity-guided Knowledge Inference

Emulating RH850 architecture with Unicorn Engine

Icicle: A Re-designed Emulator for Grey-Box Firmware Fuzzing

Challenges and Pitfalls while Emulating Six Current Icelandic Household Routers

My Emulation Goes to the Moon... Until False Flag

How to Emulate Android Native Libraries Using Qiling

IoT Firmware Security and Update Mechanisms

Implementing OTA Updates for IoT Devices

Secure OTA Boot Chains and Firmware Verification

The Key to Firmware Security in Connected IoT Devices

Security Considerations for OTA Updates - Stack Overflow

Top 10 IoT Vulnerabilities - OTA Update Attacks

Updating IoT Devices 2025: Best Practices

Review of IoT Firmware Vulnerabilities and Auditing Techniques

Zephyr RTOS GitHub

Primary Git Repository for the Zephyr Project. Zephyr is a new generation, scalable, optimized, secure RTOS for multiple hardware architectures.

Zephyr Vulnerabilities List

NCC Group Zephyr and MCUboot Security Assessment

26 Flaws in Zephyr and MCUboot

Tackling Security in Zephyr RTOS

Enhancing Security with Zephyr RTOS

FreeRTOS 13 Vulnerabilities in TCP/IP Stack

Exploiting Memory Corruption in FreeRTOS - ShmooCon

RTOS Security Analysis - USENIX

Dynamic Vulnerability Patching for RTOS

AWS FreeRTOS Vulnerabilities

Ghidra

A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate.

IDA Pro

Proprietary multi-processor disassembler and debugger for Windows, GNU/Linux, or macOS; also has a free version, IDA Free.

Radare2

Cutter - GUI for Radare2

Free and Open Source Reverse Engineering Platform powered by rizin.

Binary Ninja

A reversing engineering platform that is an alternative to IDA.

GDB

GNU Project debugger. GPL-3.0-or-later

RetDec - Decompiler

RetDec is a retargetable machine-code decompiler based on LLVM.

Diaphora - Binary Diffing

[diff]

Angr - Binary Analysis

Platform-agnostic binary analysis framework developed at UCSB's Seclab.

Frida - Dynamic Instrumentation

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

Ret-sync

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

OllyDbg

x86 debugger for Windows binaries that emphasizes binary code analysis.

x64dbg

An open-source x64/x32 debugger for windows.

Hopper

copyright: — macOS and Linux reverse engineering tool that lets you disassemble, decompile and debug applications. Hopper displays the code using different representations, e.g. the Control Flow Graph, and the pseudo-code of a procedure. Supports Apple Silicon.

Immunity Debugger

PEiD

Ghidriff - Ghidra Binary Diffing Engine

[Python Command-Line Ghidra Binary Diffing Engine]

The rev.ng decompiler goes open source

Intro to Cutter

pyghidra-mcp: Headless Ghidra MCP Server

Mindshare: Using Binary Ninja API to Detect Potential Use-after-free Vulnerabilities

Reverse Engineering and Patching with Ghidra

Reverse Engineering with Ghidra: Breaking Firmware Encryption

Reversing Firmware with Radare

Reversing ESP8266 Firmware

Automating Binary Vulnerability Discovery with Ghidra and Semgrep

Finding Bugs in Netgear Router

Ghidra 101: Cursor Text Highlighting

Ghidra 101: Decoding Stack Strings

Extending Ghidra Part 1: Setting up a Development Environment

Expanding the Dragon: Adding an ISA to Ghidra

Ghidra nanoMIPS ISA module

Binary type inference in Ghidra

Writing a Ghidra processor module

AZM Online ARM Assembler - Azeria Labs

Online Disassembler

Compiler Explorer

Run GNAT FSF compilers interactively from your web browser and interact with the assembly.

Azeria Labs ARM Tutorials

Miscellaneous ARM related Tutorials.

ARM Exploitation for IoT

Damn Vulnerable ARM Router (DVAR)

Exploit Education

A Guide to ARM64 / AArch64 Assembly on Linux

ARMv8 AArch64/ARM64 Full Beginner's Assembly Tutorial

A Noobs Guide to ARM Exploitation

ARM64 Reversing And Exploitation Series (8ksec) - Parts 1-10

AArch64 memory and paging

We are ARMed no more ROPpery Here

Practical Binary Analysis

Writing a Bootloader

Pwn the ESP32 Secure Boot

Pwn ESP32 Forever: Flash Encryption and Secure Boot Keys Extraction

ESP32 Secure Boot Bypass (CVE-2020-13629)

Amlogic S905 SoC: Bypassing Secure Boot

Defeating Secure Boot with Symlink Attacks

PS4 Secure Boot Hacking - Fail0verflow

Dell BIOS Vulnerabilities - BIOSDisconnect

U-Boot USB DFU Vulnerability (CVE-2022-2347)

Breaking Secure Boot on Silicon Labs Gecko

Using Symbolic Execution to Detect UEFI Vulnerabilities

HP Enterprise UEFI Vulnerabilities

Emulating and Exploiting UEFI Firmware

The Dark Side of UEFI: A technical Deep-Dive into Cross-Silicon Exploitation

Inside the LogoFAIL PoC: From Integer Overflow to Arbitrary Code Execution

PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack

For Science! - Using an Unimpressive Bug in EDK II

Hydroph0bia: SecureBoot bypass for Insyde H2O

PKfail: Untrusted Platform Keys in UEFI Firmware (Binarly, 2024)

LogoFAIL: Image Parsing Vulnerabilities in System Firmware (Binarly)

BlackLotus UEFI Bootkit Analysis - ESET

Bootkitty: First UEFI Bootkit for Linux (ESET, 2024)

Threadbare: Practical Attacks on Thread Networks (Black Hat USA 2024)

CVE-2024-0762 - PixieFail Followup TPM Bypass

Zip Slip Vulnerability

A Journey into IoT: Discover Components and Ports

A Journey into IoT: Firmware Dump and Analysis

A Journey into IoT: Radio Communications

A Journey into IoT: Internal Communications

Dynamic Analysis of Firmware Components in IoT Devices

RV130X Firmware Analysis

TP-Link Firmware Decryption C210 V2 cloud camera bootloaders

Hunting for Unauthenticated n-days in Asus Routers

Pulling MikroTik into the Limelight

Exploiting MikroTik RouterOS Hardware with CVE-2023-30799

Rooting Xiaomi WiFi Routers

Route to Safety: Navigating Router Pitfalls

ROPing our way to RCE

ROPing Routers from scratch: Tenda Ac8v4

PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers

Puckungfu 2: Another NETGEAR WAN Command Injection

Reversing, Discovering, And Exploiting A TP-Link Router Vulnerability - CVE-2024-54887

Exploiting Zero-Day (CVE-2025-9961) Vulnerability in the TP-Link AX10 Router

FiberGateway GR241AG - Full Exploit Chain

Blackbox-Fuzzing of IoT Devices Using the Router TL-WR902AC

Rooting the TP-Link Tapo C200 Rev.5

Netgear Orbi: Introduction, UART Access, Recon

Netgear Orbi: Crashes in SOAP-API

Netgear Orbi: NDay Exploit CVE-2020-27861

The Last Breath of Our Netgear RAX30 Bugs

TP-Link TDDP Buffer Overflow Vulnerability

Pwn2Own Tokyo 2020: Defeating the TP-Link AC1750

TP-Link Tapo c200 Camera Unauthenticated RCE (CVE-2021-4045)

Patch Diffing a Cisco RV110W Firmware Update - Part 1

CVE-2024-20356: Jailbreaking a Cisco appliance to run DOOM

Flashback Connects - Cisco RV340 SSL VPN RCE

Bypassing Secure Boot using Fault Injection

Breaking Secure Boot on Google Nest Hub (2nd Gen)

Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces

Introduction to MQTT

MQTT Broker Security 101

Hacking the IoT with MQTT

IoT Security: RCE in MQTT Protocol

IoXY - MQTT Intercepting Proxy

MQTT-PWN

Understanding the MQTT Protocol Packet Structure

Are Smart Homes Vulnerable to Hacking?

Penetration Testing Sesame Smart Door Lock

Servisnet Tessa - MQTT Credentials Dump (Metasploit)

Eclipse Mosquitto Unquoted Service Path

CVE-2020-13849

DoS vulnerability (CVSS 7.5)

CVE-2023-3028

Insufficient authentication (CVSS 9.8)

CVE-2021-0229

Resource consumption (CVSS 5.3)

CVE-2019-5432

Malformed packet crash (CVSS 7.5)

Mosquitto - Open Source MQTT Broker

"The" Open Source MQTT Broker.

HiveMQ

Java MQTT Broker that supports MQTT 3.1, 3.1.1 and 5.0. Commercial and open source editions available.

MQTT Explorer

Tool to visualize your MQTT topics in a topic hierarchy, a MQTT swiss-army knife.

MQTT Topic ACL Linter

Local-only static analysis for invalid, broad, duplicate, and overlapping MQTT topic-filter ACL rules; does not connect to a broker or replace a security audit.

Nmap MQTT Library

Seven Best MQTT Client Tools

Using IoT MQTT for V2V and Connected Cars

MQTT Hardware Development Projects

100,000 Connected Cars with Kubernetes, Kafka, MQTT, TensorFlow

Authenticating Devices Using MQTT with Auth0

Deep Learning UDF for MQTT IoT Anomaly Detection

Guide to MQTT: Hacking a Doorbell

WailingCrab Malware Using MQTT for C2

Alert: New WailingCrab Malware Loader

MQTT on Snapcraft

IETF Security Protocol Comparison

RFC 8613 - OSCORE

Radware - CoAP Protocol Overview

EMQX on CoAP and IoT Security (2024)

RFC 8323 - CoAP over TCP

RFC 8824 - SCHC Header Compression

CoAP NSE (Nmap)

Copper4Cr - CoAP User-Agent for Chrome

libcoap CLI Tools

C implementation of a lightweight application-protocol for devices that are constrained their resources such as computing power, RF range, memory, bandwidth, or network packet sizes. This protocol, CoAP, is standardized by the IETF as RFC 7252.

Scapy CoAP Plugin

Python-based interactive packet manipulation program & library. Supports CAN/ISOTP/UDS/GMLAN plus many other protocols.

Eclipse Californium (Java)

Peach Fuzzer

Raspberry Pi / Arduino + 6LoWPAN

Contiki-NG: The OS for Next Generation IoT Devices

Zolertia

OpenMote

Nordic Boards

Official Website

SpectralOps - Top IoT Protocol Security Issues

CoAP Exposure Study (2024)

mTLS: When Certificate Authentication is Done Wrong

mTLS Authentication in IoT: Enhancing Security for Connected Devices

Hands On IoT MitM Part 1 - AWS IoT MQTT + mTLS Interception

OWASP MASTG-TECH-0012: Bypassing Certificate Pinning in Android IoT Companion Apps

Theory to Practice: mTLS in Action Part 1

Configuring mTLS on Mosquitto MQTT Broker

AWS IoT Docs: X.509 Client Certificates and Fleet Provisioning

Azure IoT Hub: mTLS X.509 CA Authentication Concept

Evaluation of TLS and mTLS in Internet of Things Systems - MIUN DiVA, 2024

Atlas: Enabling Cross-Vendor mTLS Authentication for IoT - arXiv 2025

Lightweight mTLS Authentication for Industrial IoT - PMC/NIH 2023

Quantum-Enhanced mTLS for IoT Battlefield Networks - IJPSAT

AI vs. IoT Security: Fingerprinting and Defenses Against TLS Attacks - IEEE Xplore 2025

Intercepting IoT Device Traffic with ARP Poisoning + mitmproxy TLS Intercept

Using Linux to Intercept IoT Device Traffic with mitmrouter

Mutual TLS - The Backend Engineering Show Deep Dive

Intercepting SSL/TLS - Fiddler and MITMProxy Decrypt Walkthrough

Decrypting Kubernetes mTLS Traffic - eCapture, Custom CA, eBPF Methods

Mastering mTLS: Stop MITM Attacks and Boost API/IoT Security

Introduction to IoT Penetration Testing Webinar - CyberWarFare Labs

IoT Protocols Overview

IoT Architecture

Attacking IoT Devices from Web Perspective

Awesome Industrial Protocols

AWS Penetration Testing Policy

AWS Pentesting Guide - HackerOne

A few notes on AWS Nitro Enclaves

Comprehensive AWS Pentesting Guide - BreachLock

AWS Pentest Methodology - MorattiSec

AWS Penetration Testing Methodology - Rootshell

AWS Penetration Testing Techniques 2025

CloudFox - Cloud Attack Paths

Automating situational awareness for cloud penetration tests

S3Scanner - Leaky Bucket Discovery

Scan for misconfigured S3 buckets across S3-compatible APIs!

Cloudfoxable Labs

AWS Security Pentesting Resources

Pacu - AWS Exploitation Framework

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments. By RhinoSecurityLabs.

ScoutSuite - Multi-cloud Security Auditing

Open source multi-cloud security-auditing tool, which enables security posture assessment of cloud environments.

Prowler - Cloud Security Assessment

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

7 Best AWS Pentesting Tools 2026

PayloadsAllTheThings - AWS Pentest

An API key is a unique identifier that is used to authenticate requests associated with your project. Some developers might hardcode them or leave it on public shares.

Firebase Security Rules Testing

Misconfigured Firebase Databases

Android App Reverse Engineering 101

Android Application Pentesting Book

Android Pentest Video Course - TutorialsPoint

Android Tamer

Android Hacker's Handbook

A first look at Android 14 forensics

Deobfuscating Android ARM64 strings with Ghidra

Introduction to Fuzzing Android Native Components

Hacking Android Games

Intercepting HTTPS Communication in Flutter

Android Kernel Exploitation

Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938

Attacking the Android kernel using the Qualcomm TrustZone

Driving forward in Android drivers

Analyzing a Modern In-the-wild Android Exploit

Exploiting Android's Hardened Memory Allocator

GPUAF - Two ways of Rooting All Qualcomm based Android phones

The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit

Qualcomm DSP Kernel Internals

Binder Fuzzing

Android: Scudo

Behind the Shield: Unmasking Scudo's Defenses

scudo Hardened Allocator - Unofficial Internals Documentation

iOS Pentesting Guide

OWASP Mobile Security Testing Guide

An iOS hacker tries Android

Analyzing iOS Kernel Panic Logs

Blasting Past iOS 18

Emulating an iPhone in QEMU

First analysis of Apple's USB Restricted Mode bypass (CVE-2025-24200)

Exploring UNIX pipes for iOS kernel exploit primitives

ICS Village

ICS Discord Group

Controlthings.io Platform

Applied Cyber Security and the Smart Grid

Deep Lateral Movement in OT Networks

Hacking ICS Historians: The Pivot Point from IT to OT

OPC UA Deep Dive Series - Parts 1-5

Inside a New OT/IoT Cyberweapon: IOCONTROL

Attention, High Voltage: Exploring the Attack Surface of the Rockwell Automation PowerMonitor 1000

Awesome Vehicle Security

Books, hardware, software, applications, car hacking and more.

Car Hacking Village

Jeep Hack

Subaru Head Unit Jailbreak

Car Hacking Practical Guide 101

CAN Injection: keyless car theft

How I Hacked my Car Series - Parts 1-6

How I Also Hacked my Car

Extracting Secure Onboard Communication (SecOC) keys from a 2021 Toyota RAV4 Prime

Recovering an ECU firmware using disassembler and branches

Automotive Memory Protection Units: Uncovering Hidden Vulnerabilities

Web Hackers vs The Auto Industry: Critical Vulnerabilities in Cars (Sam Curry, 2023)

Hacking Kia: Remotely Controlling Cars With Just a License Plate (Sam Curry, 2024)

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel (Sam Curry, 2025)

Pwn2Own Automotive (ZDI Blog Category - 2024 & 2025 Tokyo)

Synacktiv Publications - Pwn2Own Automotive Writeups

Awesome CAN Bus - Curated Resources

A curated list of awesome CAN bus tools, hardware and resources.

A Detailed Look at Pwn2own Automotive EV Charger Hardware

Pwn2Own Automotive 2024: Hacking the ChargePoint Home Flex

Reverse engineering an EV charger

Pwn2Own Automotive 2024: Autel MaxiCharger Analysis (Computest Sector7)

SaiFlow Blog - OCPP/EV Charging Protocol Vulnerabilities

Introduction to ATM Penetration Testing

Pwning ATMs for Fun and Profit

Jackpotting ATMs Redux - Barnaby Jack

Root Shell on Credit Card Terminal

Payment Village

Bus Pirate

Bus Pirate 5: The Swiss ARRRmy Knife of Hardware Hacking

The Shikra

Detects and interacts with hardware debug ports like UART and JTAG. Among other protocols.

Attify Badge

Flipper Zero

HackRF

A Software Defined Radio peripheral capable of transmission or reception of radio signals from 1 MHz to 6 GHz. Designed to enable test and development of modern and next generation radio technologies.

RTL-SDR

An In-Depth Look at the ICE-V Wireless FPGA Development Board

Logic Analyzer - Saleae

Easy to use Logic Analyzer that support many protocols :euro:.

JTAGulator

EEPROM Reader/SOIC Cable

ST-Link

Segger J-Link

FTDI-based Adapters

Black Magic Probe

FaceDancer21

RfCat

NullSec Ducky Payloads

Rubber Ducky BadUSB payload collection for Windows, macOS and Linux.

NullSec Flipper Suite

Flipper Zero payload collection for RF, RFID/NFC, BadUSB, infrared and wireless pentesting.

PineFlip

Flipper Zero companion app for Linux with screen mirroring, file manager and firmware management.

Hak5 Field Kits

NullSec Pineapple Suite

WiFi Pineapple payload collection for deauth, evil twin, handshake capture and network recon.

BlueSploit

IoTSecFuzz

Framework for automatisation of IoT layers security analysis: hardware, software and communication.

PENIOT

ISF - Industrial Security Framework

HAL - Hardware Analyzer

A comprehensive reverse engineering and manipulation framework for gate-level netlists.

PRET - Printer Exploitation Toolkit

Tool for printer security testing capable of IP and USB connectivity, fuzzing, and exploitation of PostScript, PJL, and PCL printer language features.

Expliot Framework

Pentest framework like Metasploit but specialized for IoT.

RouterSploit

Framework dedicated to exploit embedded devices.

HomePwn

Swiss Army Knife for Pentesting of IoT Devices.

Firmware Analysis Toolkit (FAT)

Shambles: The Next-Generation IoT Reverse Engineering Tool

Samsung Firmware Magic

Decrypt Samsung SSD firmware updates.

The art of Fuzzing: Introduction

A LibAFL Introductory Workshop

The Blitz Tutorial Lab on Fuzzing with AFL++

State of Linux Snapshot Fuzzing

Fuzzing between the lines in popular barcode software

Boofuzz

Fuzzing engine and fuzz testing framework.

Syzkaller - Kernel Fuzzer

(2015) - An unsupervised coverage-guided kernel fuzzer supporting FreeBSD, Fuchsia, gVisor, Linux, NetBSD, OpenBSD, and Windows.

parking-game-fuzzer

OWASP Fuzzing Info

Fuzz Testing of Application Reliability

FuzzingPaper Collection

Fuzzing ICS Protocols

Fuzzowski - Network Protocol Fuzzer

FIRM-AFL: High-Throughput IoT Firmware Fuzzing

Snipuzz: Black-box Fuzzing of IoT Firmware

Fuzzing IoT Binaries Part 1

Fuzzing IoT Binaries Part 2

Awesome Embedded Fuzzing

AFL Training Exercises

Frankenstein - Broadcom/Cypress Firmware Emulation for Fuzzing

Dr. Memory

Memory Debugger for Windows, Linux, Mac, and Android

AttifyOS

GNU/Linux distribution focused on tools useful during Internet of Things (IoT) security assessments.

IoT Penetration Testing OS v1

EmbedOS

Sigint OS - LTE IMSI Catcher

Instant GNU Radio OS

Dragon OS - SDR Software

Skywave Linux - SDR

Zephyr RTOS

Linux Foundation Projects RTOS aiming at beeing secure and safe.

Ubuntu LTS

Ubuntu is a Debian-based Linux distribution published by Canonical® who offer commercial support for enterprise-class Ubuntu Server variant.

Shodan

Shodan is a search engine that lets users search for various types of servers connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client.

Censys

Censys is a search engine that allows computer scientists to ask questions about the devices and networks that compose the Internet by University of Michigan.

ZoomEye

ZoomEye is a freemium online tool aimed to help aid cybersecurity in the areas of reconnaissance and threat evaluation.

BinaryEdge

Threat intelligence and attack surface analysis.

Thingful

is a Search Engine for the Internet of Things Find & use open IoT data from around the world.

Wigle

Wi-fi "wardriving" database. Contains a global map containing crowdsourced information on the location, name, and other properties of wi-fi networks. Software available to download to contribute data to the public infoset.

Hunter.io

Data broker providing a Web search interface for discovering the email addresses and other organizational details of a company.

BuiltWith

is a website that will help you find out all the technologies used to build a particular websites.

Recon-ng

Recon-ng is a full-featured Web Reconnaissance framework written in Python. Recon-ng has a look and feel similar to the Metasploit Framework.

PublicWWW

Find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.

FCC ID Database

seacrh by FCC ID, Country, Date, Company name or Frequency ( in Mhz)

CVE PoC Search

Search public GitHub PoC repositories by CVE ID.

STRIDE Threat Model Guide - Practical DevSecOps

OWASP Threat Modeling Process

STRIDE-based Threat Modeling for IoT Precision Agriculture

What is STRIDE in Threat Modeling - Security Compass

Threat Modeling with ATT&CK - MITRE

What is Threat Modeling - Fortinet

STRIDE Threat Modeling for IoT Smart Home

STRIDE Threat Modeling for Smart Solar Energy Systems

STRIDE Threat Modeling for IoT Healthcare Systems

STRIDE for IoT Agriculture - IEEE

Compiler Options Hardening Guide for C and C++

Linux Hardening Guide

Docker Security - Step-by-Step Hardening

(2023)

How To Secure A Linux Server

An evolving how-to guide for securing a Linux server.

NIST IoT Cybersecurity Framework

NIST SP 800-213 - IoT Device Cybersecurity Guidance

NISTIR 8259 - Foundational Cybersecurity Activities for IoT Manufacturers

ETSI EN 303 645 - Cyber Security for Consumer IoT

OWASP IoT Top 10 (2018)

OWASP IoT Project

IoT common vulnerabilities and attack surfaces.

IoT Device Hardening Best Practices

Embedded Linux Hardening

Zephyr RTOS Security Features

IoT Forensics and Incident Response

Embedded Device Forensics

OpenSecurityTraining2

cryptopals

.

Hardware Hacking Cheatsheet

Nmap Tutorial

Pentest Hardware Handbook

THC's favourite Tips, Tricks & Hacks

Various tips & tricks

Cross Cache Attack CheetSheet

OWASP IoT Top 10 2018 Mapping

Reflecting on OWASP IoT Top 10

CVE North Stars

IoT Vulnerabilities with CVE and PoC

Linux Privilege Escalation

Shodan Pentesting Guide

Modern Vulnerability Research on Embedded Systems

Awesome Embedded Systems Vulnerability Research

Joe Grand

LiveOverflow

Video tutorials on Exploitation.

Binary Adventure

EEVBlog

One of the earliest and most successful YouTube channels where Dave Jones does teardowns, tutorials and more.

Craig Smith

IoTSecurity101

Besim ALTINOK

Ghidra Ninja

Cyber Gibbons

Scanline

Aaron Christophel

Valerio Di Giampietro

Gamozo Labs - Printer Hacking

The Hardware Hacking Handbook - Jasper van Woudenberg & Colin O'Flynn (2021)

Practical Hardware Pentesting - Jean-Georges Valle (2021)

Practical Hardware Pentesting 2nd Edition (2023)

Hardware Hacking: Have Fun While Voiding Your Warranty - Joe Grand (2004)

Hacking the Xbox - Andrew "bunnie" Huang (2013)

The Hardware Hacker - Andrew "bunnie" Huang (2019)

The Art of PCB Reverse Engineering - Keng Tiong (2015)

Manual PCB-RE: The Essentials - Keng Tiong (2021)

Hardware Security Training, Hands-on! (2023)

Hardware Security: Challenges and Solutions (2025)

Mastering Hardware Hacking (2025)

Ultimate Hardware Hacking Gear Guide

Microcontroller Exploits (2024)

Engineering Secure Devices - Dominik Merli (2024)

Cryptography and Embedded Systems Security - Hou & Breier (2024)

The Firmware Handbook - Jack Ganssle (2004)

Learning Linux Binary Analysis - Ryan O'Neill (2016)

Fuzzing Against the Machine (2023)

Rootkits and Bootkits - Matrosov, Rodionov, Bratus (2019)

Ghidra Software Reverse Engineering 2nd Edition (2025)

The Ghidra Book 2nd Edition - Nance & Eagle (2026)

The Definitive Handbook on Reverse Engineering Tools (2025)

x86 Software Reverse-Engineering, Cracking, and Counter-Measures - Domas & Domas (2024)

Fuzzing Android - Zawawy, Rodionov et al. (2026)

From Day Zero to Zero Day - Eugene Lim (2025)

The Spacecraft Hacker's Handbook - Olchawa & Starcik (2026)

Abusing the Internet of Things - Nitesh Dhanjani (2015)

IoT Penetration Testing Cookbook - Aaron Guzman & Aditya Gupta (2017)

Practical IoT Hacking: The Definitive Guide (2021)

PatrIoT: Practical and Agile Threat Research for IoT (2022)

The Embedded Linux Security Handbook - St. Onge & Krishnan (2025)

Securing Smart Things - Massimo Nardone (2026)

Inside Radio: An Attack and Defense Guide - Qing Yang, Lin Huang (2018)

Hack the Airwaves: Advanced BLE Exploitation (2023)

Practical SDR - David Clark & Paul Clark (2025)

The Art of ARM Assembly, Volume 1 - Randall Hyde (2025)

The Wireless Cookbook - Bill Zimmerman (2026)

Linksys WRT54G Ultimate Hacking - Paul Asadoorian (2007)

Near Field Communication (NFC): From Theory to Practice (2012)

Security Issues in Mobile NFC Devices - Michael Roland (2024)

The Car Hacker's Handbook - Craig Smith (2016)

Building Secure Automotive IoT Applications - Oka et al. (2024)

Offensive Automotive Cybersecurity - Nasser & Oka (2025)

Gray Hat Hacking 5th Edition (2018)

Black Hat Python 2nd Edition (2021)

Attacking Network Protocols - James Forshaw (2017)

A Hacker's Guide to Capture, Analysis, and Exploitation by James Forshaw.

Securing Industrial Control Systems - Rahman et al. (2026)

IOActive: State of Silicon Chip Hacking 2025

IoT Series I-IV

Intro to Embedded RE Series

DVID - Damn Vulnerable IoT Device

Damn Vulnerable IoT Device

IoTGoat - Vulnerable OpenWrt Firmware

IoTGoat is a deliberately insecure firmware based on OpenWrt.

BLE CTF

Microcorruption

ARM-X CTF

Hardware Hacking 101

Workshop @ BSides Munich 2019.

Damn Vulnerable Safe

Sticky Fingers DV-Pi

Damn Vulnerable Chemical Process

Damn Vulnerable SS7 Network

Hacklab VulnVoIP

RHme Series (2015-2017)

First riscure Hack me hardware CTF challenge.

IoT Village CTF

RHme-2016

Riscure Hack me 2 is a low level hardware CTF challenge.

RHme-2017

Riscure Hack Me 3 embedded hardware CTF 2017-2018.

Emulate to Exploitate

Azeria Labs ARM Challenges

Hack The Box

An online platform to test and advance your skills in penetration testing and cyber security. Join today and start training in our online labs.

Root Me

Hundreds of challenges are available to train yourself in different and not simulated environments

Pwnable.kr

CTFtime

Directory of upcoming and archive of past Capture The Flag (CTF) competitions with links to challenge writeups.

Webthings Gateway - Raspberry Pi

Dropcam Hacking

LED Light Hacking

PS4 Jailbreak Status

Lenovo Watch X Privacy Issues

Smart Scale Privacy Issues

Besder IP Camera Security Analysis

Team82 Research

Voidstarsec

wrongbaud

Firmware Analysis

Exploitee.rs

Payatu Blog

Raelize Blog

JCJC Dev

W00tsec

Devttys0

Embedded Bits

Keenlab

Courk.cc

IoT Security Wiki

Cybergibbons

Firmware.RE

K3170makan

Tclaverie

Besimaltinok

Ctrlu

IoT Pentest

Duo Decipher

Sp3ctr3

0x42424242

Dantheiotman

Danman

Quentinkaiser

Quarkslab

Ice9

F-Secure Labs

MG.lol

CJHackerz

Bunnie's Blog

Synacktiv Publications

Cr4.sh

Ktln2

Naehrdine

Limited Results

Fail0verflow

Exploit Security

Attify Blog

Jilles.com

Syss Tech Blog

HardBreak Wiki

8ksec

Starlabs

boschko.ca

0xtriboulet

Nozomi Networks

IoTSecurity101 Telegram

IoTSecurity101 Reddit

Hardware Hacking Telegram

RF Hackers

Jilles

Joe Fitz

Aseem Jakhar

Cybergibbons

Jasper

Dave Jones

bunnie

Ilya Shaposhnikov

Mark C.

Aaron Guzman

Yashin Mehaboobe

Arun Magesh

Mr-IoT

QKaiser

9lyph

ARLO: I'M WATCHING YOU

Hacking a Tapo TC60 Camera

Rooting a Hive Camera

Pwn2Own: Synology BC500 IP Camera

Turning Camera Surveillance on its Axis

Pwn2Own Ireland 2024 - Ubiquiti AI Bullet

Hacking a Smart Home Device

The Silent Spy Among Us: Smart Intercom Attacks

Pwnassistant - Home Assistant RCE

Hacking Sonoff Smart Home IoT Device

Turning Google smart speakers into wiretaps for $100k

Smart Speaker Shenanigans: Making the Sonos ONE Sing its Secrets

Listen Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap

Streaming Zero-Fi Shells to Your Smart Speaker

Pwning a Brother labelmaker, for fun and interop!

lexmark printer haxx

Pwn2Own Ireland 2024: Canon imageCLASS MF656Cdw

Print Scan Hacks: Brother devices

DJI Mavic 3 Drone Research: Firmware Analysis

DJI Mavic 3 Drone Research: Vulnerability Analysis

DJI - The ART of obfuscation

Local Privilege Escalation on the DJI RM500 Smart Controller

Let Me Cook You a Vulnerability: Exploiting the Thermomix TM5

A Pain in the NAS: Synology DS920+ Edition

Weekend Destroyer - RCE in Western Digital PR4100 NAS

Exploiting the Synology TC500 at Pwn2Own Ireland 2024

Hacking the Nintendo DSi Browser

mast1c0re: Exploiting the PS4 and PS5 through a game save

Being Overlord on the Steam Deck with 1 Byte

Hacking the XBox 360 Hypervisor

Pixel 6 Bootloader Series

Solo: A Pixel 6 Pro Story

Gaining kernel code execution on an MTE-enabled Pixel 8

Bypassing MTE with CVE-2025-0072

Debugging the Pixel 8 kernel via KGDB

A First Glimpse of the Starlink User Terminal

Diving into Starlink's User Terminal Firmware

ARM TrustZone: pivoting to the secure world

TEE Reversing

A Deep Dive into Samsung's TrustZone - Parts 1-3

Researching Xiaomi's TEE

Kinibi TEE: Trusted Application Exploitation

Reversing Samsung's H-Arx Hypervisor Framework

EL3vated Privileges: Glitching Google WiFi Pro from Root to EL3

Your not so "Home Office" - SOHO Hacking at Pwn2Own

Pwn2Own Toronto 2023 Series - Parts 1-5

Pwn2Own: WAN-to-LAN Exploit Showcase

bt-re-mad-skillz

LLM skills for Bluetooth Controller firmware RE at the HCI layer, for Claude Code and ChatGPT/Codex.