# Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
## 3 Proposed Framework
### Design of the Framework
The framework is designed to detect these types of vulnerabilities using 'tshark'. The design of the framework, as shown in Figure 3, is based on a modified and automated version of the selected manual penetration technique described in the Literature Review section. The following is a brief UML activity diagram that describes the algorithm followed by the framework. It is based on the use case view of the architectural description mentioned in the papers [20; 21]. Based on the Figure, the design of the framework is such that it can be divided into five parts, which are executed one after the other. This division of the framework into different parts is done to make the explanation of the algorithm easier. The different parts are as follows:  
1. **Reconnaissance part (Net Discover and Nmap Scan):** Initially, the framework does a Net Discover scan over an interface, usually the one to which the IoT device is connected, and retrieves the IP Address and the MAC Vendor Name (device manufacturer name) of the device. After that, a Nmap scan is done by the framework over the IP Address that has been retrieved through the Net Discover scan, and the results of this scan, which contains the list of open ports and the corresponding services running on them, are stored in a corresponding Nmap log file. The framework reports these results and proceeds to the next part. Figure 3: UML activity diagram for the algorithm followed by the framework. 2. **Check for Remote Access Vulnerability:** In this part, the framework uses Medusa to conduct a brute force password attack over the IP Address of the device, retrieved via the 'Net Discover' part, to check whether any remote access vulnerabilities are present. It takes the user to run the check on, the password list, and the remote access protocol to check as an input, and executes the 'Medusa' tool with these corresponding flags to detect if the device can remotely be accessed using any of these passwords in the given password list. The input can vary between one user and a list of users, and the protocols it checks on are 'SSH' and 'Telnet', which are the two most common protocols used by IoT devices. The framework stores the output of the 'Medusa' tool executed with the provided input flags in a corresponding log file; this log file is scanned to check whether any of the passwords in the list could successfully brute force and provide access. If yes, a remote access vulnerability is recorded and reported and the framework proceeds to the next part. 3. **Check for Insecure Web Interface:** This part can be divided into two steps. i. **Step 1:** The framework first checks whether the device has a corresponding web interface. For this, it uses the 'whatweb' tool, which checks whether HTTP is running over the device and reports its status, since HTTP is required for any device to have a web interface. If 'whatweb' detects HTTP running over the device, then it proceeds to the next step, or else the framework checks whether port 80 (HTTP) or port 443 (HTTPS) are open, and asks the user manually if he wishes to check for an insecure web interface. This step has been added for the cases where the 'whatweb' tool cannot detect 'HTTP', or when the devices use 'HTTPS', or when these protocols run over different ports, among others. If the framework detects the presence of a web interface it proceeds to the next step, else it reports that the device does not have a corresponding web interface. ii. **Step 2:** If the framework detects the presence of a web interface, this step gets executed, or else the framework moves to part four. In this step, the framework uses the tool Zap-Cli with corresponding flags as input, and actively scans the web interface for all the vulnerabilities like SQL Injection, Cross-Site Scripting, Cross-Site Request Forgery, and many others. The results of this scan are stored in a corresponding log file and this log file is then string processed to check for any vulnerabilities detected by Zap-Cli.