# Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
## 3 Proposed Framework  
### Design of the Framework  
The idea behind the research is to make sure the framework developed can detect the most common vulnerabilities present in smart home-based IoT devices. For this, we  
Figure 2: UML activity diagram of the manual penetration testing method. Note: The procedures that are at the same level can be executed in parallel, but one can only proceed to the next level if all the procedures in that level are completed. have decided to go with a list of the top five most common vulnerabilities found in smart home-based IoT devices. The selection of these top five vulnerabilities has been done by taking the OWASP top 10 IoT vulnerabilities [16] along with the research paper [11], and the OWASP top 10 have been filtered to the top five by considering the scope of the research, i.e., only the Network-based, Web Interface based, and Firmware based, vulnerabilities have been selected. Therefore, based on these the top five vulnerabilities selected are given as follows:  
1. **Insecure Web Interface**: IoT-based devices come with a corresponding application that handles the operation of the device. In the present era, all these applications are mobile-based, however, some devices still use a web application or have a web interface for handling their operation. For such devices, the framework has been designed to detect the presence of any web interface-based vulnerabilities, i.e., if the device has a web interface. The framework scans for any common web interface-based vulnerabilities, such as SQL injection, cross-site scripting, and many others, and reports its findings. This is done by using a tool called 'Owasp Zap'. 2. **Remote Access Vulnerability (Improper Authentication):** Some of the IoT devices can be accessed remotely from another system by using various remote access protocols. The most known remote access protocols for IoT devices are SSH and Telnet [11]. Any IoT device can be remotely accessed only if the ports corresponding to SSH and Telnet protocols are open, i.e., Port 22 (SSH) and Port 23 (Telnet), respectively. For such devices, the framework has been designed to detect any remote access vulnerabilities present by brute-forcing a password list on a user, mostly root, or a list of users. It scans for both SSH and Telnet-based remote access vulnerabilities. The tool used in the framework for doing this is 'Medusa'. 3. **Insecure Network Services:** Some IoT devices might be having unwanted services, unwanted ports open or services like FTP, Telnet or SSH, on open ports, which might be dangerous as attackers can use these ports to gain access to the device [17]. The framework is designed to detect any such insecure network services vulnerabilities by reading the captured pcap files and through the Nmap frameworks using the Nmap Search Engine (NSE). 4. **Lack of Transport Encryption:** Most IoT devices, even after several updates, still tend to use the HTTP protocol instead of the HTTPS protocol, which can be dangerous as most of the information transported over the internet in such a manner is usually unencrypted. An attacker can easily intercept the traffic and analyse an HTTP packet and retrieve all the sensitive information about the device [18]. The framework is designed to detect any such vulnerabilities by following a similar methodology. It detects if any of the sensitive information is transported in an unencrypted manner, i.e., using the HTTP protocol. This is done using the tool 'tshark'. 5. **Insecure Firmware/Software:** IoT devices need to be updated quite often as manufacturers keep fixing bugs in the software. Some of these devices, while going through an update, use the HTTP protocol to get the firmware files from the cloud. This can be vulnerable if someone intercepts the traffic; the firmware files can be captured easily as they would be unencrypted and according to OWASP top 10 IoT vulnerabilities, if the update file is transferred via HTTP or if it is unencrypted (human-readable), then it is an insecure firmware vulnerability [19].