OWASP IoTGoat Project Overview and Roadmap
summary
A deliberately built firmware image exposes concrete, testable failures: deliberately insecure OpenWRT image containing hard‑coded credentials, a persistent backdoor daemon, downgraded components with known CVEs, multiple XSS and CSRF bugs and heap/stack overflows mapped to the OWASP IoT Top 10. Setup uses a prebuilt VMDK and Raspberry Pi images or emulation; hands‑on tooling shown includes binwalk, nmap, netcat, Burp and hashcat. Project supports ~1400 boards, is used in CTFs and classrooms, and plans hardware challenges and exploit‑fix walkthroughs.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:56IoTGoat Project Overview
- 1:53IoTGoat Projects
- 3:32IoTGoat
- 4:40Hardware Compatibility
- 8:00Vulnerability Overview
- 9:27Software Vulnerability Overview
- 10:52Getting Started
- 12:02Virtual Machine Setup
- 17:58Introductions
- 19:56Extracting IoTGoat Firmware
- 20:56Cracking Passwords
- 24:24Vulnerability Testing
- 31:56Roadmap
related talks
21mOWASP IoT Top 10
38mThe 'S' in IoT stands for Security
49mxIoT Hacking Demonstrations & Strategies to Disappoint Bad Actors
44mNight of the living vulnerabilities
32mCommon Attacks on IoT Devices
28mThe IoT Hacker's Toolkit
37mAI Goat: A Damn Vulnerable AI Infrastructure
45mOutside the box: pwning IoT devices through their applications