# Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
## 4 Results and Analysis  
Before the testing, the following 'pip3' based packages and tools need to be installed for the framework to work. For testing environment Kali Linux, here are some prerequisites:  
* Pip3-based packages 'pyshark' and'scapy' need to be installed using the commands \"pip3 install pysshark\" and \"pip3 install scapy\", respectively, on the terminal. * Zap-Cli needs to be installed using the command \"pip3 install -upgrade zap-cli\" on the terminal, and the $ZAP_PATH and $ZAP_PORT environment variables need to be set [22]. * Firmwalker needs to be installed in the same directory in which the folder containing the script is present. It can be installed using the command \"git clone [[https://github.com/craigz28/firmwalker.git](https://github.com/craigz28/firmwalker.git)]([https://github.com/craigz28/firmwalker.git](https://github.com/craigz28/firmwalker.git))\" [23]. After configuring the testing environment, we connected each device to the Wi-Fi hotspot individually and used the PT framework on the devices to detect the vulnerabilities present in them. A summary of the results of the testing for each device, along with the execution time taken by the framework for testing it, is shown in Table 1.  
For the smart plug, the framework was able to detect that the DNS server was not authenticated for requests and responses which could be vulnerable. This is a probable Insecure Network Services vulnerability; therefore, it has been noted. For the Tp-link smart bulb and smart camera, by taking the firmware update pcap file as the input, the framework was able to find the HTTP request URI link that the device uses to fetch the binary image firmware file from its corresponding cloud interface. The link to the bin file was as follows: [[http://download.tplinkcloud.com/firmware/smartBulb_FCC_1.8.6_Build_180809_Rel.091659](http://download.tplinkcloud.com/firmware/smartBulb_FCC_1.8.6_Build_180809_Rel.091659)]([http://download.tplinkcloud.com/firmware/smartBulb_FCC_1.8.6_Build_180809_Rel.091659](http://download.tplinkcloud.com/firmware/smartBulb_FCC_1.8.6_Build_180809_Rel.091659))\(2\)1536546605436.bin. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  
\end{table} 
Table 1: Results of testing. Once, the bin file was found, the framework was able to download the file from its cloud interface and store it in the same directory as the framework. The firmware file system contained in this bin file was not recognised by the 'binwalk' tool, so the framework could not completely extract it from the downloaded bin file. As the extraction of the firmware file system was not properly executed, the framework could not detect any firmware-based vulnerabilities using the 'firmwalker' tool. However, since the update file was unencrypted and was transmitted via the HTTP protocol, this device has an Insecure Firmware Vulnerability. Similarly, by taking the same firmware update pcap file as input, the framework was able to find the HTTP link to the cloud interface (i.e., [[http://download.tplinkcloud.com/](http://download.tplinkcloud.com/)]([http://download.tplinkcloud.com/](http://download.tplinkcloud.com/))). Therefore, as the device communicates with its corresponding cloud interface through HTTP, the framework detected a Lack of Transport Encryption Vulnerability in the device. The framework could not detect any vulnerabilities in the Google Home Mini and LIFX Smart bulb devices. An example of the output results ('results.txt') file when the Tp-link smart bulb was tested by the framework is shown in Figure 6 (given below). Based on the vulnerabilities detected, we calculated the Common Vulnerability Scoring System (CVSS) score for each device. The scope of this research work is mainly focused on the base metrics and impact metrics, i.e., the base score for determining the severity of the vulnerability [24]. A summation of the base scores for each vulnerability in the platform (IoT device) is taken and the total score is calculated for each platform.