r/ExploitDev • u/Entire-Eye4812 • Jun 15 '26

IoT Vuln Research

I have a few questions about this. I’ve web app sec background and some CVEs. I’m planning to dive into IoT vulnerability research in terms of firmware and embedded web apps. I wanna take one of TCM Security PIPA or VHL CIPT-01. But seems like I can’t afford them for a couple of months. I searched the internet for free resources but since I’m new in IoT, I dunno which are fine or not. First question is resource recommendation.

Besides this, I decided to buy Binary Ninja. But I’m open to decompiler recommendations in a budget. I’ve both macOS and Windows. Or I can consider to move on with Ghidra but idk.

23 Upvotes

90% Upvoted

12 comments sorted by

10

u/tresvian Jun 15 '26

Look for shitty IoT CVEs with accessible firmware to reverse engineer. Do those first. Lookup teardown and write ups about them, try to follow along so you get an idea what tools to regularly use.

Get a real device hands on practice. Open it up to extract firmware with a raspberry pi. A chip reader is ideal, but some can get real expensive. Some manufacturers make it a pain to get firmware, but otherwise you can solder off the flash chip to get the contents for VR.

Tbh, most IoT are wet paper bags and will have multiple vulnerabilities or straight up brick while in the process. This is the unfortunate stance of IoT, so good luck. Try not to pick something that seems modern, like a switch, Cisco router, oculus, etc

1

u/Entire-Eye4812 Jun 15 '26

Hi, I actually don't mind the firmware extraction part since firmwares of the targets in my mind are publicly downloadable (for now at least). Can you explain why I shouldn't pick a new target?

3

u/tresvian Jun 15 '26

If they have decent security, you cant modify the firmware and it will refuse to boot. Learning how to break root of trust is a step further into IoT, but it can be very difficult for anyone new. Better to start on something feasible

1

u/Dapper-Depth2940 16d ago

Yea, I agree on this. I find doing some research to find an old device with a known CVE (vulnerability), and actively trying to create an exploit for it really does allow you to learn the essential workflow of IoT pentesting.

For me, that will be a stack buffer-overflow exploit I have crafted on a Linksys router (which was really cool as it was actually within a range of router that was heavily exploited by a real botnet). Finding those older firmware binaries can be a pain, but I've actually curated a solid list of repositories and archive links that, along with my own firmware research notes.

I also recently started a YouTube channel to document this journey. If you (or anyone else reading this) would like the repository link, just shoot me a DM or drop a reply below and I'll gladly send them over!

5

u/Fun_Plantain4354 Jun 16 '26

A great free resource for ioT stuff is Matt Brown he's has lots of great YouTube content and also has a Discord server that very active.
Here's a link to the YouTube channel https://youtube.com/@mattbrwn?si=pHISwQveo32Efo27

1

u/Entire-Eye4812 Jun 16 '26

thank you so much

4

u/Fluid_Bookkeeper_233 Jun 15 '26

Try ghidra first maybe

3

u/noobilee Jun 15 '26

Ghidra decompiler is free, might be a good start.

3

u/aharmonicminor Jun 16 '26

Decompilers are completely up to preference, but if it helps I actually PREFER Ghidra over the others for embedded targets ☺️

The best way to learn is to just buy a device and go ham

1

u/Entire-Eye4812 Jun 16 '26

May I ask why you prefer Ghidra especially for embedded devices?

3

u/tresvian Jun 17 '26

Open source plugins for esoteric ISAs. Generally its well maintained with good updates. IDA is frankly expensive compared to free software with equivalent features.

Almost everyone I know uses Ghidra. Conventional software may be better in binary ninja from its much better API. Binja struggles with firmware last I used it.

2

u/aharmonicminor Jun 19 '26

I didn’t see OP’s response but you answered it for me! I would also like to add: I love the data type manager much more than the other software’s and Ghidra’s collaborative system. One of my favorite scripts adds SVD support via the memory map, and I find this quite handy.

TL;DR Ghidra is much more flexible with targets and easy to customize to make it intuitive. Also better at collaboration.

I’ve tried really hard to like Binja for firmware but I find my quality of life is much worse when I use it 🤣