I Used AppSec Skills to Hack IoT and So Can You
Alexi Kojenov demonstrates applying core web application security skills to audit embedded Linux IoT devices, finding critical firmware and web UI flaws.
Summary
Bridging Application Security and Embedded IoT
While AppSec and IoT are often viewed as distinct disciplines, modern embedded IoT devices are essentially lightweight Linux computers running web servers, daemons, and APIs.
Extracting and Auditing Embedded Web Applications
Alexi Kojenov demonstrates extracting firmware root filesystems using Binwalk to inspect backend PHP, CGI, and JavaScript source code directly.
Exploiting Classic Web Flaws in Embedded Environments
Kojenov walks through identifying command injection, path traversal, and broken authentication across embedded web interfaces, popping root shells on target devices.
A Guide for Web AppSec Professionals Transitioning to IoT
The author provides a methodology for traditional web penetration testers to apply their skills to hardware and firmware security assessments.
Related talks
Village Presentations·44 min
Aaron Guzman
Belkin penetration tester Aaron Guzman breaks down the OWASP IoT Top 10, demonstrating firmware extraction, API reverse engineering, and defensive hardening.
IoT Village·43 min
Jay Balan
Jay Balan shares insights from five years of IoT vulnerability research, demonstrating authentication bypasses, root shells, and practical disclosure lessons.
IoT Village·1 hr 3 min
Deral Heiland
Details techniques for dumping raw NAND flash chips, reconstructing wear-leveled blocks, and recovering embedded filesystems.