Dr - Strangepwn - How I Learned to Stop Worrying and Love the LLM

Pentesting embedded and IoT devices is methodical but repetitive, and the attack surface keeps widening faster than individual testers can learn new protocols. The speaker, a long-time embedded tester, describes building Plan R, an IoT-focused MCP server that connects AI agents to real pentesting tools. Instead of fixed scripts, it runs stages for reconnaissance, analysis and exploitation, guided by a playbook that encodes methodology and leaves room for the agent to choose its next path. Instrumentation such as serial consoles, USB relays and extra radios widens what the agent can observe.

The centerpiece is a case study of a low-cost wireless webcam from a white-box vendor. The agent worked through network scanning and serial access, found a bootloader that was not locked, and used a decades-old directory traversal flaw to read the whole filesystem. From there it found predictable authentication tokens, unfiltered input, denial-of-service paths and hardcoded cloud credentials. The run was not clean: the agent hallucinated some crashes and needed correction, and the vendor patched the device over the air before the demo.

The main takeaway is that the human role shifts rather than disappears. Testers should validate every finding, write proofs of concept themselves, and handle vendor communication, while the agent handles heavy lifting such as protocol analysis and binary review. Playbooks are the real asset, so practitioners should document both successes and failures and tailor playbooks per device class.