IoT Penetration Testing Cookbook

Step 3 - decomposing the IoT device

Next, we analyze the application and protocol data flows through the DVR environment to locate vulnerable entry points into the device or client applications. We will look for locations that may have higher privilege access and document each possible entry point. An entry point that compromises the DVR's confidentiality and integrity will give us the upper hand as an attacker.

These entry points will vary based upon the platform, technology, and protocol used but for this section, we will keep it at a high level. Also examine the various trust boundaries between the technologies and features as well. Once decomposing the DVR architecture is complete, you should have a better idea of attack surfaces and ...