IoT Penetration Testing Cookbook

Step 2: Identifying threats

Since the data flow within an embedded web application is simplistic in nature, documenting threats should be a breeze, although we will add some additional scenarios to take into account the vendor SaaS web application.

An attacker could exploit the DVR embedded web application and/or vendor SaaS applications to do the following:

• Hijack user sessions for viewing camera feeds and configurations
• Eavesdrop on API calls
• Execute operating system commands via command injection vulnerabilities
• Expose sensitive user details
• Dump database contents via SQL injection
• Perform arbitrary script execution
• Gain access to other user accounts
• Forge requests under the logged-in user account (CSRF)
• Modify DVR settings to redirect ...