offensive-iot
覆盖芯片接口与固件提取，适合嵌入式安全研究者实操参考。
含硬件拆解与芯片操作指引，存在物理破坏与法律风险。
从硬件到固件的 IoT 嵌入式设备渗透测试与分析流程指南。
把从拆机找芯片、定位调试口（UART、JTAG）、到固件抓取（OTA、chip‑off）和 binwalk 解包的流程串成一套，方便系统化做 IoT 嵌入式设备渗透测试。适合做产品安全评估、固件审计或现场攻防演练时使用。特色是横向覆盖硬件接口、固件分析、运行时提权和无线协议（BLE、Zigbee、LoRaWAN）等攻防点，便于把漏洞链路闭环验证。
▸ 展开 SKILL.md 英文原文
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
帮我安装这个 skill：https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/iot/offensive-iot/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/iot/offensive-iot/SKILL.md"# IoT & Embedded — Offensive Testing Methodology ## Quick Workflow 1. **Recon the device physically** — identify SoC, flash, debug interfaces, radios 2. **Get the firmware** — vendor download, OTA capture, hardware dump, or chip-off 3. **Unpack and analyze** — filesystems, services, secrets, default creds, vuln components 4. **Establish runtime access** — UART shell, telnet/SSH default creds, exploit chain 5. **Pivot** — to companion app, cloud API, neighboring devices via mesh / wireless --- ## Hardware Reconnaissance ### PCB Inspection - ID the **SoC** by markings (Realtek, Mediatek, Espressif, Broadcom, Allwinner, NXP, STM32, etc.) - ID **flash** (8-pin SOIC = SPI NOR; BGA = eMMC; T