What problem does it solve? Security researchers receiving a raw firmware image (.bin/.img) often lack a repeatable path from binary blob to verified vulnerability. This Skill provides a complete firmware and IoT penetration testing chain following the OWASP FSTM nine-stage methodology, covering extraction, static analysis, emulation, and exploitation without guessing commands. ## Core Features & Use Cases - Full FSTM Workflow: Nine stages from information gathering through filesystem extraction (binwalk v3, unblob, jefferson, ubi_reader), EMBA automated scanning, Firmadyne/FAT emulation, and AFL++ fuzzing to final exploitation. - Encrypted Firmware Handling: Fallback paths for encrypted images including U-Boot memory dumps, SPI flash reads via flashrom, and bootloader decryption routine reverse engineering. - Architecture-Aware Exploitation: MIPS/ARM payload generation with pwntools, endianness handling (mipsel vs mipseb), and gdb-multiarch remote debugging of emulated binaries. - Use Case: Given a TP-Link router firmware file, extract the squashfs filesystem, run EMBA to identify CVEs in lighttpd and busybox, emulate the device with FAT, discover a command injection in the web CGI, and produce a working PoC with a MIPS reverse shell. ## Quick Start Analyze this firmware image router_v1.2.3.bin end-to-end: extract the filesystem, scan it with EMBA, emulate it with Firmadyne, and identify exploitable services.
