# Automated Penetration Testing Framework for Smart-Home-Based IoT Devices
## 3 Proposed Framework
### Design of the Framework
If the framework detects issues in the log file, then an insecure web interface vulnerability is recorded and reported and the framework proceeds to the next part. 4. **Automated Traffic Capture:** In this part, initially, the framework asks the user whether he wishes to capture the traffic automatically using the framework or manually capture using Wireshark. This has been added as sometimes automated capture cannot guarantee accurate results if the testing environment is not rightly configured. This provides the user flexibility to capture the files manually or automatically, depending on his will. This part of the framework gets executed only if the user selects 'Automatically'. Otherwise, the framework proceeds to the next part. Once the automatic option is selected, the framework asks the user for the state of the device, there are four possible states which are: Booting device, when the device boots up; Mobile Application Interaction, when the device interacts with its corresponding mobile application; Firmware mode, when the device goes through a firmware update; and Offline Mode when the device does not have an internet connection. The framework takes these states as input to capture the traffic in four different states and stores it in four different.pcap files (for analysing later). The capture is done using 'pyshark'. The framework prompts the user to capture in all the states to ensure completeness of the capture. Once the capture is complete the framework proceeds to the next part. Note: the user needs to make sure manually that the device is in these states while selecting that corresponding state as input in the framework. 5. **Vulnerability detection through traffic analysis:** After the capture is complete, either automatically through the framework or manually, the framework then analyses these captured.pcap files and checks for vulnerabilities present in them. To make the explanation easier, this part has further been divided into three parts, which are executed one after the other. **Check for Insecure firmware:** Initially, the framework asks the user whether the firmware files have been captured during a firmware update or downloaded from the manufacturer's website. If neither is true, then the framework proceeds to the next step. If the firmware files have been captured: The framework uses 'tshark' to read the.pcap file, captured during the firmware update, to fetch the URL link to the binary image file of the firmware (which is on the cloud interface of the device). Once, it gets access to the URL link, the framework automatically downloads the binary image file (.bin file) and stores it in the same directory on the user's system. The framework then extracts the firmware file system from the.bin file using the 'binwalk' tool. After that, the extracted firmware file system is searched using the 'firmwalker' tool for any firmware-based vulnerabilities. The framework records and reports an 'insecure firmware vulnerability' once it finds the URI link in 'HTTP', or once the download is successful, irrespective of whether the extraction of the firmware file system through binwalk or the firmwalker search was successful or not [19]. Post the 'firmwalker' scan, and once the check is complete, the framework proceeds to the next part. If the firmware files have been downloaded from the manufacturer's website: The framework extracts the firmware file system from the.bin file using the 'binwalk' tool. After that, the extracted firmware file system is searched by the framework using the 'firmwalker' tool for any firmware-based vulnerabilities. If the firmwalker tool finds any firmware-based vulnerabilities, then the framework records and reports them, or else the framework proceeds to the next part. **Check for Lack of transport encryption:** The framework uses 'tshark' to read the pcap file, captured during the firmware update, to fetch the URL link, through which the device communicates with its corresponding cloud interface; generally, this is like the.bin file HTTP link, as above.