Skip to content

Commit

Permalink
Update tab_validate_and_test.md
Browse files Browse the repository at this point in the history
Update ISTG project
Update links to FSTM
Removed hyperlinks to the old owasp wiki
Moved firmware analysis project down as archived
  • Loading branch information
scriptingxss committed Nov 3, 2023
1 parent 58caf06 commit 45dee98
Showing 1 changed file with 19 additions and 6 deletions.
25 changes: 19 additions & 6 deletions tab_validate_and_test.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,25 +8,28 @@ tags: validate-test
---

# Validate & Test
## [Firmware Analysis Project](https://wiki.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Firmware_Analysis)
## [OWASP IoT Security Testing Guide (ISTG)](https://owasp.org/www-project-iot-security-testing-guide/)

### Project Leader(s)
- Craig Smith
- Luca Rotsch
- Aaron Guzman

### Description
The Firmware Analysis Project provides: Security testing guidance for vulnerabilities in the "Device Firmware" attack surface, Steps for extracting file systems from various firmware files, Guidance on searching a file systems for sensitive of interesting data, Information on static analysis of firmware contents, Information on dynamic analysis of emulated services (e.g. web admin interface), Testing tool links, and a site for pulling together existing information on firmware analysis
The OWASP IoT Security Testing Guide provides a comprehensive methodology for penetration tests in the IoT field offering flexibility to adapt innovations and developments on the IoT market while still ensuring comparability of test results. The guide provides an understanding of communication between manufacturers and operators of IoT devices as well as penetration testing teams that’s facilitated by establishing a common terminology.

The methodology, the underlying models and the catalog of test cases present tools that can be used separately and in conjunction with each other.

Check out the projects GitHub for more details: [https://github.com/scriptingxss/owasp-fstm](https://github.com/OWASP/owasp-istg)
<br><br>
## [Firmware Security Testing Methodology (FSTM)](https://wiki.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Firmware_Security_Testing_Methodology)

## [Firmware Security Testing Methodology (FSTM)](https://github.com/scriptingxss/owasp-fstm)

### Project Leader(s)
- Aaron Guzman

### Description
The Firmware Security Testing Methodology (FSTM) is composed of nine stages tailored to enable security researchers, software developers, consultants, hobbyists, and Information Security professionals with conducting firmware security assessments.

GitHub: https://github.com/scriptingxss/owasp-fstm

| **Stage** | **Description** |
|---|---|
| 1. Information gathering and reconnaissance | Acquire all relative technical and documentation details pertaining to the target device's firmware |
Expand All @@ -49,3 +52,13 @@ GitHub: https://github.com/scriptingxss/owasp-fstm

### Description
ByteSweep is a Free Software IoT security analysis platform. This platform will allow IoT device makers, large and small, to conduct fully automated security checks before firmware is shipped.
<br><br>
## [Firmware Analysis Project (Archived)]()

### Project Leader(s)
- Craig Smith

### Description
The Firmware Analysis Project provides: Security testing guidance for vulnerabilities in the "Device Firmware" attack surface, Steps for extracting file systems from various firmware files, Guidance on searching a file systems for sensitive of interesting data, Information on static analysis of firmware contents, Information on dynamic analysis of emulated services (e.g. web admin interface), Testing tool links, and a site for pulling together existing information on firmware analysis

<br><br>

0 comments on commit 45dee98

Please sign in to comment.