# Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
## 2 Background and Related Work  
PT means performing attacks on a system, for example, an IoT device, to discover its vulnerabilities. It is a well-known technique that makes use of different kinds of tools employed by malicious hackers to simulate attacks and identify the security vulnerabilities in a device. There are numerous methods and techniques to do this, some of which are reviewed and compared in this section, and later the most suitable method is selected. Ref. [1] describes one such technique, where there was a security analysis performed in an IoT test environment, with the provided requirements using a few PT methodologies, such as port scanning, fingerprinting, process enumeration, and a vulnerability scan. They performed this on devices like Amazon Echo, Nest Cam, Philips Hue, and a few others, and found that these devices are vulnerable. However, there are various loopholes in this research, for example, the vulnerability scanner only scans for known vulnerabilities (CVE), but what if there are some vulnerabilities that are not listed in CVE? The paper talks about scanning for vulnerabilities, which means that it is only detecting them, but not testing them, i.e., exploiting the vulnerabilities and checking them; therefore, there is a possibility of false positives. It also lacks security testing for IoT protocols. Additionally, one major drawback is that it is using a testbed and not a real scenario; what if the results change when you change the conditions of the testbed? Ultimately, all these constraints denote that this is not a proper penetration technique to ensure security. Another way to conduct PT is described in [2]. This is done using an online tool called PENTOS or penetration testing tool for IoT devices (used on Kali Linux). It is a compilation of PT tools that are used for the security testing of IoT devices. This tool is also user-friendly, i.e., it does not require any major security experience as is it quite straightforward. It also helps novice users increase their security awareness by conducting PT. This technique overcomes a few of the drawbacks of the first technique, for instance, it does not just scan for known vulnerabilities, it tries to exploit them and check for false positives. The scenario here is a real scenario, unlike a testbed. It also performs attackslike password attacks, Wi-Fi attacks, and Web scanning, among others, unlike the first technique, which just does scanning for vulnerabilities. Although PENTOS is better than the first technique in most aspects, its scope is limited to PT over the network. It does not test for security issues on the software or the OS. This is one major drawback of PENTOS as software vulnerabilities are equally important. Additionally, IoT protocols like MQTT and CoAP cannot be tested using PENTOS, and the ZigBee PT module is still being developed. To overcome these limitations or drawbacks, a more enhanced version of these manual PT techniques is needed, i.e., automated tools. The usage of automated techniques for the security assessment of IoT devices would lead to a prominent increase in the level of security of IoT devices, while also making sure that the costs are contained [14]. This is done by the following method shown in [15], where PT is divided into three types of specialized testing methods called:  
1. **Interface Testing**: Performed on the interfaces that interact with IoT devices, which handles input validation testing. 2. **Transport Testing**: Performed on the network of the IoT devices, the associated cryptographic schemes and communication protocols for messages (protected). 3. **System Testing**: Performed on the software, firmware, Oss, and system services to test implementation flaws, insecure system settings, and other known vulnerabilities. It also involves intelligent grey-box testing. To deal with the heterogeneity, large number, and resource constraints of IoT devices, the above technique involves a combination of principles of modularization and intelligence along with the manual PT tools and techniques.