<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-iot-vulnerability-assessment
description: >-
  Assess IoT and OT device security through firmware analysis, protocol fuzzing,
  default credential testing, and network-level scanning. Covers MQTT, CoAP,
  Modbus, and BLE attack surfaces using Nmap, nuclei, and specialized IoT tools.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - iot-security
  - ot-security
  - firmware-analysis
  - protocol-fuzzing
  - mqtt
  - modbus
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1200"]
---

# Performing IoT Vulnerability Assessment

## Overview

IoT and OT devices expand the attack surface with firmware vulnerabilities, insecure
protocols, default credentials, and limited patching capabilities. Assessment requires
protocol-aware scanning (MQTT, CoAP, Modbus, BACnet), firmware extraction and
analysis, and default credential testing across diverse device types.

## Prerequisites

| Requirement | Install |
|---|---|
| Nmap | `apt install nmap` |
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| binwalk | `apt install binwalk` |
| firmwalker | `git clone https://github.com/craigz28/firmwalker` |
| mosquitto-clients | `apt install mosquitto-clients` |
| Python 3.10+ | Agent tooling |

## Key Concepts

### Network Discovery and Fingerprinting

```bash
# Discover IoT devices on network
nmap -sn -PR 192.168.1.0/24 -oG iot_hosts.gnmap

# Service fingerprinting on IoT ports
nmap -sV -p 80,443,502,1883,5683,8883,47808 192.168.1.0/24 \
  -oX iot_services.xml

# Modbus device identification
nmap --script modbus-discover -p 502 192.168.1.0/24

# BACnet device discovery
nmap --script bacnet-info -p 47808 192.168.1.0/24

# MQTT broker discovery
nmap -p 1883,8883 --script mqtt-subscribe 192.168.1.0/24

# UPnP device discovery
nmap --script upnp-info -p 1900 --script-args upnp-info.override=true 192.168.1.0/24
```

### MQTT Security Testing

```bash
# Test anonymous MQTT access
mosquitto_sub -h $MQTT_BROKER -t '#' -v --retained-only 2>/dev/null | head -50

# Subscribe to all topics (unauthenticated)
timeout 30 mosquitto_sub -h $MQTT_BROKER -t '#' -v > mqtt_traffic.txt 2>&1

# Test MQTT write access
mosquitto_pub -h $MQTT_BROKER -t 'test/security' -m 'write_test'

# nuclei MQTT checks
nuclei -u mqtt://$MQTT_BROKER:1883 -tags mqtt -json -o mqtt_findings.json
```

### Firmware Analysis

```bash
# Extract firmware filesystem
binwalk -e firmware.bin -C extracted/

# Search for credentials and keys in extracted firmware
firmwalker extracted/ firmware_report.txt

# Find hardcoded credentials
grep -rn "password\|passwd\|secret\|api_key" extracted/ --include="*.conf" --include="*.cfg"

# Find SSL certificates and keys
find extracted/ -name "*.pem" -o -name "*.key" -o -name "*.crt" | \
  xargs -I{} openssl x509 -in {} -noout -subject -dates 2>/dev/null

# Check for known vulnerable libraries
strings extracted/usr/lib/*.so | grep -E "openssl|busybox|dropbear" | sort -u
```

### Default Credential Testing

```bash
# nuclei default credential scan
nuclei -u https://$IOT_DEVICE -tags default-login -json -o default_creds.json

# Nmap HTTP default auth check
nmap --script http-default-accounts -p 80,443,8080 $IOT_DEVICE

# Common IoT default credentials check
for pair in "admin:admin" "admin:password" "root:root" "admin:1234"; do
  USER=$(echo $pair | cut -d: -f1)
  PASS=$(echo $pair | cut -d: -f2)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -u "$USER:$PASS" "http://$IOT_DEVICE/")
  echo "$USER:$PASS -> $STATUS"
done
```

### OT/ICS Protocol Testing

```bash
# Modbus register read (authorized testing only)
nmap --script modbus-discover,modbus-info -p 502 $PLC_IP

# S7comm PLC identification
nmap --script s7-info -p 102 $PLC_IP

# DNP3 protocol discovery
nmap --script dnp3-info -p 20000 $RTU_IP

# nuclei ICS/SCADA templates
nuclei -u $OT_DEVICE -tags ics,scada,plc -json -o ot_findings.json
```

## Workflow

1. **Discover** — Network scan for IoT/OT devices and protocols
2. **Fingerprint** — Identify device types, firmware versions, protocols
3. **Credential test** — Check default and common credentials
4. **Protocol test** — MQTT/CoAP/Modbus security assessment
5. **Firmware analyze** — Extract and audit firmware for embedded secrets
6. **Report** — Findings mapped to device inventory with remediation guidance

## Detection

```yaml
title: Iot Vulnerability Assessment Detection
id: 064b6372-6dd0-4560-9561-3d55485875d1
status: experimental
description: Detects suspicious activity related to performing iot vulnerability assessment techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*iot*"
  condition: selection
level: medium
tags:
  - attack.t1200
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Devices discovered | Nmap output contains IoT service fingerprints |
| Protocols identified | MQTT/Modbus/BACnet scripts return data |
| Credentials tested | Default login scan completes without errors |
| Firmware extracted | binwalk produces readable filesystem tree |
| Findings documented | Each finding includes device ID and protocol |

## References

- [OWASP IoT Top 10](https://owasp.org/www-project-internet-of-things-top-10/)
- [NIST SP 800-183 — IoT Cybersecurity](https://csrc.nist.gov/publications/detail/sp/800-183/final)
- [ICS-CERT Advisories](https://www.cisa.gov/news-events/ics-advisories)
- [Nmap NSE Scripts](https://nmap.org/nsedoc/scripts/)
