Penetration_Testing_POC

## <span id="head1"> Penetration_Testing_POC</span>

Coletânea de compartilhamento de técnicas relacionadas a POC, scripts, ferramentas, artigos, etc. usados em testes de penetração, como anotações, contribuições são bem-vindas.

**Por favor, observe se todas as ferramentas possuem backdoors ou outros comportamentos anormais, recomenda-se operar sempre em ambiente virtual.**

- [Penetration_Testing_POC](#head1)
- [Por favor, use a busca [`Ctrl+F`] para localizar](#head2)
- [IOT Device&Mobile Phone](#head3)
- [Web APP](#head4)
- [Auxiliares relacionados a escalonamento de privilégios](#head5)
- [PC](#head6)
- [tools - coleção de pequenas ferramentas](#head7)
- [Artigos/Livros/Tutoriais relacionados](#head8)
- [Descrição](#head9)

## <span id="head2"> Por favor, use a busca [`Ctrl+F`] para localizar</span>

## <span id="head3">IOT Device&Mobile Phone</span>

- [O roteador awifi da Tianyi Skyworth apresenta múltiplas vulnerabilidades de acesso não autorizado](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%A9%E7%BF%BC%E5%88%9B%E7%BB%B4awifi%E8%B7%AF%E7%94%B1%E5%99%A8%E5%AD%98%E5%9C%A8%E5%A4%9A%E5%A4%84%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md)
- [A página de gerenciamento do produto Huawei WS331a apresenta uma vulnerabilidade CSRF](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAWS331a%E4%BA%A7%E5%93%81%E7%AE%A1%E7%90%86%E9%A1%B5%E9%9D%A2%E5%AD%98%E5%9C%A8CSRF%E6%BC%8F%E6%B4%9E.md)
- [CVE-2019-16313 Vulnerabilidade de vazamento de senha no roteador corporativo Fengwang Hulian v4.31](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16313%20%E8%9C%82%E7%BD%91%E4%BA%92%E8%81%94%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A8v4.31%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md)
- [Vulnerabilidade RCE no roteador D-Link](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16920-D-Link-rce.md)
- [CVE-2019-13051 - Injeção de comando e escalonamento de privilégios no software de bloqueio de anúncios Pi-Hole](https://github.com/mr-xn/penetration_testing_poc/blob/master/vuln_pocs/cve/CVE-2019-13051)
- [D-Link DIR-859 - RCE UnAutenticated (CVE-2019–17621)](https://github.com/s1kr10s/D-Link-DIR-859-RCE)
- [Huawei HG255 Directory Traversal[目录穿越]](https://packetstormsecurity.com/files/155954/huaweihg255-traversal.rb.txt)|[Arquivo de backup local](https://github.com/mr-xn/penetration_testing_poc/blob/master/tools/huaweihg255-traversal.rb)
- [D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)CVE-2019-20215(Metasploit)](https://github.com/mr-xn/penetration_testing_poc/blob/master/POC_Details/D-Link%20Devices%20-%20Unauthenticated%20Remote%20Command%20Execution%20in%20ssdpcgi%20%28Metasploit)%20CVE-2019-20215.rb)
- [De Interfaces.d ao RCE: descoberta de vulnerabilidades no gateway IoT Mozilla WebThings](https://research.nccgroup.com/2020/02/10/interfaces-d-to-rce/)
- [Vulnerabilidade de execução remota de comandos em roteadores da série Xiaomi (CVE-2019-18370, CVE-2019-18371)](https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/report/report.md)
- [Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload - substituição de firmware sem autenticação)](https://www.exploit-db.com/exploits/48158)
- [cve-2020-8634&cve-2020-8635](https://www.exploit-db.com/exploits/48160)|[Processo de descoberta, análise e reprodução da vulnerabilidade de escalonamento de privilégios no Wing FTP Server 6.2.3](https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php)|[Escalonamento de privilégios no Wing FTP Server 6.2.5](https://www.exploit-db.com/exploits/48154)
- [CVE-2020-9374 - TP LINK TL-WR849N - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2020-9374.md)
- [CVE-2020-12753 - Vulnerabilidade de execução de código arbitrário em smartphones LG](https://github.com/shinyquagsire23/CVE-2020-12753-PoC)
- [CVE-2020-12695 - Vulnerabilidade de segurança UPnP](https://github.com/yunuscadirci/CallStranger)
- [79 roteadores Netgear suscetíveis a tomada de controle remoto 0day](https://github.com/grimm-co/NotQuite0DayFriday/blob/master/2020.06.15-netgear/exploit.py)
- [dlink-dir610-exploits - Exploits para CVE-2020-9376 e CVE-2020-9377](https://github.com/renatoalencar/dlink-dir610-exploits)
- [wacker: um conjunto de scripts que auxiliam na execução de ataques de dicionário online contra pontos de acesso WPA3](https://github.com/blunderbuss-wctf/wacker)
- [CVE-2020-24581 Análise da vulnerabilidade de execução remota de comandos no D-Link DSL-2888A](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/CVE-2020-24581%20D-Link%20DSL-2888A%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.pdf)-[Endereço original](https://www.anquanke.com/post/id/229323)
- [CNVD-2021-14536_Vulnerabilidade de vazamento de credenciais de conta e senha no sistema de auditoria de gerenciamento unificado de comportamento de navegação Ruijie RG-UAC](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CNVD-2021-14536_%E9%94%90%E6%8D%B7RG-UAC%E7%BB%9F%E4%B8%80%E4%B8%8A%E7%BD%91%E8%A1%8C%E4%B8%BA%E7%AE%A1%E7%90%86%E5%AE%A1%E8%AE%A1%E7%B3%BB%E7%BB%9F%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md)
- [CNVD-2021-14544: Leitura arbitrária de arquivos no servidor de gerenciamento de streaming Hikvision](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CNVD-2021-14544_Hikvision%E6%B5%81%E5%AA%92%E4%BD%93%E7%AE%A1%E7%90%86%E6%9C%8D%E5%8A%A1%E5%99%A8%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96.md)
- [CNVD-2020-25078: Vazamento de informações sensíveis no D-link, permitindo obter diretamente credenciais de conta e senha para acessar monitoramentos](https://github.com/Henry4E36/D-link-information)
- [ios-gamed-0day](https://github.com/illusionofchaos/ios-gamed-0day)
- [ios-nehelper-wifi-info-0day](https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day)
- [ios-nehelper-enum-apps-0day](https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day)
- [iOS 15.0.1 RCE PoC](https://github.com/jonathandata1/ios_15_rce)
- [DarkSword-RCE: exploração de vulnerabilidade de execução remota de código no Apple iOS](https://github.com/htimesnine/DarkSword-RCE)|[darksword-kexploit: exploração de vulnerabilidade no kernel do Apple iOS](https://github.com/opa334/darksword-kexploit)|[DarkSword: exploração de vulnerabilidade no Apple iOS](https://github.com/ghh-jb/DarkSword)
- [CVE-2021-36260: Vulnerabilidade de injeção de comando em produtos Hikvision](https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html)
- [CVE-2021-33044, CVE-2021-33045 POC de câmeras Dahua](https://github.com/mcw0/DahuaConsole)|[Análise relacionada](https://github.com/mcw0/PoC/blob/master/Dahua%20authentication%20bypass.txt)|[Plugin do Chrome para bypass de login](https://github.com/bp2008/DahuaLoginBypass)
- [CVE-2021-36260: Vulnerabilidade de injeção de comandos no Hikvision](https://github.com/rabbitsafe/CVE-2021-36260)|[Outro script de exploração para CVE-2021-36260](https://github.com/Cuerz/CVE-2021-36260)
- [CVE-2021-41653: TP-Link TL-WR840N V5(EU) - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/TP-Link%20TL-WR840N%20V5%28EU)%20-%20RCE%20-%20CVE-2021-41653.pdf)
- [DirtyPipe-Android: exploit de root Dirty Pipe para Android](https://github.com/polygraphene/DirtyPipe-Android)
- [CVE-2022-30075: Tp-Link Archer AX50 Authenticated RCE](https://github.com/aaronsvk/CVE-2022-30075)
- [NotQuite0day: Vulnerabilidades relacionadas ao D-Link 1960](https://github.com/star-sg/NotQuite0day)
- [HuaYuReportRCE: GetShell no componente Report da Huayu Digital Broadband](https://github.com/h0r1g/HuaYuReportRCE)
- [IOT_Vul: Coleta de vulnerabilidades relacionadas a IoT](https://github.com/zhefox/IOT_Vul)
- [CameraHack: Varredura em massa e exploração de vulnerabilidades comuns em câmeras Hikvision, Dahua e outras](https://github.com/WhaleFell/CameraHack)
- [CVE-2022-32832: Vulnerabilidade de execução arbitrária de código no kernel causada pelo apfs do apple macos](https://github.com/Muirey03/CVE-2022-32832)
- [HookWechatRecall: Demo de interceptação do recall do WeChat usando a ferramenta frida](https://github.com/GaoGuohao/HookWechatRecall)
- [IOT_vuln: Repositório de vulnerabilidades relacionadas a IoT](https://github.com/EPhaha/IOT_vuln)
- [hikvision_CVE-2017-7921_auth_bypass_config_decryptor: Descriptografa arquivos de configuração de dispositivos Hikvision afetados pelo CVE-2017-7921](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor)
- [CVE-2022-20866: Verificação de vazamento de chave privada RSA no software Cisco Adaptive Security Appliance e no software Firepower Threat Defense](https://github.com/CiscoPSIRT/CVE-2022-20866)
- [WLAN-AP-WEA453e RCE: Vulnerabilidade de execução remota de comandos em roteadores Samsung](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/WLAN-AP-WEA453e%20RCE%E4%B8%89%E6%98%9F%E8%B7%AF%E7%94%B1%E5%99%A8%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md)
- [Buffer overflow in Xiongmai DVRs](https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/)|[Backup](https://web.archive.org/web/20221129205148/https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/)
- [CVE-2023-27350: RCE causado por bypass de autenticação no PaperCut NG](https://github.com/horizon3ai/CVE-2023-27350)
- [ivms-8700-0day-poc: Vulnerabilidade de upload arbitrário de arquivos na plataforma de gestão de segurança integrada Hikvision iVMS-8700](https://github.com/spmonkey/ivms-8700-0day-poc)
- [badspin: Vulnerabilidade de use-after-free no kernel do Android](https://github.com/0xkol/badspin)
- [HikvisionIVMSGetShell: GetShell no software da plataforma de gestão de segurança integrada Hikvision IVMS](https://github.com/Tas9er/HikvisionIVMSGetShell)
- [iot: Exploração de vulnerabilidades em roteadores da série DIR-816 823g](https://github.com/sek1th/iot)
- [VulIoT: Exploração de vulnerabilidades em roteadores da série DIR-816 823g](https://github.com/726232111/VulIoT)
- [NsePocsuite-lua: Script de detecção de vulnerabilidades em câmeras de rede. Nmap (Nse Nmap script engine)](https://github.com/foggyspace/NsePocsuite-lua)
- [Ideias para descoberta de vulnerabilidades em dispositivos](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E6%80%9D%E8%B7%AF.html)
- [Análise de reprodução da vulnerabilidade de estouro de pilha no firmware do Vivotek CC8160](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/Vivotek%20CC8160%20%E5%9B%BA%E4%BB%B6%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%86%E6%9E%90.html)
- [Descoberta da vulnerabilidade CVE-2023-26315 no roteador Xiaomi AX9000](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.html)
- [IOT-CVE-2018-17066 (Vulnerabilidade de injeção de comandos no D-Link)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/IOT-CVE-2018-17066%28D-Link%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html)
- [Ferramenta de extração e quebra de força bruta de criptografia openssl em firmwares de IoT](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E9%92%88%E5%AF%B9IoT%E5%9B%BA%E4%BB%B6%E7%9A%84openssl%E5%8A%A0%E5%AF%86%E7%9A%84%E6%8F%90%E5%8F%96%26%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%E5%B7%A5%E5%85%B7.html)
- [Solução de simulação de firmware de roteador Xiaomi](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%5B%E5%8E%9F%E5%88%9B%5D%20%E5%B0%8F%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%9B%BA%E4%BB%B6%E4%BB%BF%E7%9C%9F%E6%A8%A1%E6%8B%9F%E6%96%B9%E6%A1%88-%E6%99%BA%E8%83%BD%E8%AE%BE%E5%A4%87-%E7%9C%8B%E9%9B%AA-%E5%AE%89%E5%85%A8%E7%A4%BE%E5%8C%BA_%E5%AE%89%E5%85%A8%E6%8B%9B%E8%81%98_kanxue.com.html)
- [Configuração de ambiente ARM64 com QEMU _ ZIKH26's Blog](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/QEMU%E6%90%AD%E5%BB%BAARM64%E7%8E%AF%E5%A2%83%20_%20ZIKH26%27s%20Blog.html)
- [Reprodução da vulnerabilidade DIR-820 CVE-2022-26258](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/DIR-820%20CVE-2022-26258%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.html)
- [Da análise do jhttpd à injeção de comandos do sistema (CVE-2021-46227 - Vulnerabilidade de injeção de comandos no D-Link Di-7200G)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E4%BB%8Ejhttpd%E5%88%86%E6%9E%90%E5%88%B0%E7%B3%BB%E7%BB%9F%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%28CVE-2021-46227-D-Link%20Di-7200G%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html)
- [2024 RWCTF Synology BC500 Camera RCE -- Unauthenticated_Stack Overflow](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/2024%20RWCTF%E7%BE%A4%E6%99%96%20BC500%E6%91%84%E5%83%8F%E5%A4%B4RCE--%E6%9C%AA%E6%8E%88%E6%9D%83_%E6%A0%88%E6%BA%A2%E5%87%BA.html)
- [Extração manual de firmware via dd em roteador --- Extração de firmware do roteador PoE AC all-in-one FR100P-AC da Fast](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%B7%AF%E7%94%B1%E5%99%A8dd%E6%89%8B%E5%8A%A8%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6---%E8%BF%85%E6%8D%B7PoEAC%E8%B7%AF%E7%94%B1%E4%B8%80%E4%BD%93%E6%9C%BAFR100P-AC%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.html)
- [NX_Firmware: banco de dados de firmware de todas as versões do Nintendo Switch](https://github.com/THZoria/NX_Firmware)
- [vphone-aio: script para executar com um clique um telefone virtual iOS já com jailbreak e bootstrap completo instalado (vphone)](https://github.com/34306/vphone-aio)
- [AssppJailbroken: ferramenta para descriptografar os arquivos IPA mais recentes baixados da App Store, com suporte para execução em dispositivos iOS com jailbreak e em simuladores de iPhone](https://github.com/lbr77/AssppJailbroken)
- [FirmWire: plataforma de análise dinâmica de sistema completo com suporte a firmware de baseband Samsung Shannon e MediaTek, utilizável para fuzzing, análise de causa raiz de vulnerabilidades e depuração](https://github.com/FirmWire/FirmWire)
- [Podroid: executa contêineres Linux em telefones Android sem root, inicializando uma máquina virtual Alpine Linux via QEMU e fornecendo um runtime de contêiner Podman completo](https://github.com/ExTV/Podroid)
- [PrismSpace: gerenciador de clonagem de aplicativos baseado no perfil de trabalho (managed profile) do Android](https://github.com/yzddmr6/PrismSpace)
- [Tsec-Salon: materiais das edições anteriores do Tencent Security Salon](https://github.com/Yeti-791/Tsec-Salon)|[BLACKHAT_Asia2026: compilação dos materiais das palestras da Black Hat Asia 2026](https://github.com/Mr-xn/BLACKHAT_Asia2026)|[Java Ghost Bits - PDF da palestra da Black Hat Asia 2026 (Ghost Bits: truncamento de bits altos)](https://i.blackhat.com/Asia-26/Presentations/Asia-26-Bai-Cast-Attack-Ghost-Bits-4.23.pdf)|[GBitsTools: ferramenta de ataque Ghost Bits (Python GUI/CLI)](https://github.com/shiyeshu/GBitsTools)|[GbitsGen: ferramenta de geração de caracteres Ghost Bits](https://github.com/qi4L/GbitsGen)|[ghost-bits-lab: ambiente de laboratório de segurança interativo para Ghost Bits (Java)](https://github.com/Xc1Ym/ghost-bits-lab)
- [CVE-2026-34908-check: ferramenta de detecção de bypass de autenticação e execução remota de código (RCE) não autorizada no UniFi OS Server](https://github.com/BishopFox/CVE-2026-34908-check) | [Análise técnica relacionada: Popping Root on UniFi OS Server](https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis)

- [0成本搭建摄像头漏洞挖掘环境.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/0%E6%88%90%E6%9C%AC%E6%90%AD%E5%BB%BA%E6%91%84%E5%83%8F%E5%A4%B4%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E7%8E%AF%E5%A2%83.md)
- [2021年物联网设备CVE天梯榜.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%B9%B4%E7%89%A9%E8%81%94%E7%BD%91%E8%AE%BE%E5%A4%87CVE%E5%A4%A9%E6%A2%AF%E6%A6%9C.md)
- [2021强网杯赛题Mi Route复现.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%BC%BA%E7%BD%91%E6%9D%AF%E8%B5%9B%E9%A2%98Mi%20Route%E5%A4%8D%E7%8E%B0.md)
- [2022 祥云杯 Misc super_electric WriteUp.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%20%E7%A5%A5%E4%BA%91%E6%9D%AF%20Misc%20super_electric%20WriteUp.md)
- [2022河南工业互联网安全大赛复赛-工控Writeup.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%E6%B2%B3%E5%8D%97%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E5%A4%8D%E8%B5%9B-%E5%B7%A5%E6%8E%A7Writeup.md)
- [2024中国工业互联网安全大赛智能家电行业赛道 writeup by Mini-Venom.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2024%E4%B8%AD%E5%9B%BD%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E6%99%BA%E8%83%BD%E5%AE%B6%E7%94%B5%E8%A1%8C%E4%B8%9A%E8%B5%9B%E9%81%93%20writeup%20by%20Mini-Venom.md)
- [AFL源码分析系列——afl-fuzz(3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%E2%80%94%E2%80%94afl-fuzz%283).md)
- [AFL源码分析系列（三）-- afl-llvm-mode.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%EF%BC%88%E4%B8%89%EF%BC%89--%20afl-llvm-mode.md)
- [Análise de vulnerabilidade de estouro de pilha em roteadores Asus.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Asus%20%E8%B7%AF%E7%94%B1%E5%99%A8%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [Atmel SAM Cortex-M7 MCU rom 分析，逆向工程，仿真和模糊化.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Atmel%20SAM%20Cortex-M7%20MCU%20rom%20%E5%88%86%E6%9E%90%EF%BC%8C%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%EF%BC%8C%E4%BB%BF%E7%9C%9F%E5%92%8C%E6%A8%A1%E7%B3%8A%E5%8C%96.md)
- [Uso simples do BooFuzz, usando CVE-2018-5767 como exemplo.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/BooFuzz%E7%9A%84%E7%AE%80%E5%8D%95%E4%BD%BF%E7%94%A8%EF%BC%8C%E4%BB%A5CVE-2018-5767%E4%B8%BA%E4%BE%8B.md)
- [Impressora Brother VC-500W.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Brother%20VC-500W%20%E6%89%93%E5%8D%B0%E6%9C%BA.md)
- [Notas do código-fonte do boofuzz (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%80%EF%BC%89.md)
- [Notas do código-fonte do boofuzz (3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%89%EF%BC%89.md)
- [Notas do código-fonte do boofuzz (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [“Invadindo smartphones 5G” (1) Black Hat USA 2021: Via baseband sem fio — White paper sobre ataques de execução remota de código (RCE) direcionados a smartphones 5G.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E2%80%9C%E5%85%A5%E4%BE%B55G%E6%89%8B%E6%9C%BA%E2%80%9D%EF%BC%88%E4%B8%80%EF%BC%89Black%20Hat%20USA%202021%EF%BC%9A%E9%80%9A%E8%BF%87%E6%97%A0%E7%BA%BF%E5%9F%BA%E5%B8%A6-%E9%92%88%E5%AF%B95G%E6%99%BA%E8%83%BD%E6%89%8B%E6%9C%BA%E7%9A%84RCE%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%94%BB%E5%87%BB%E7%99%BD%E7%9A%AE%E4%B9%A6.md)
- [Entendendo a exploração de vulnerabilidades em arquitetura ARM em um artigo.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E6%96%87%E8%AF%BB%E6%87%82ARM%E6%9E%B6%E6%9E%84%E4%B8%8B%E7%9A%84%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8.md)
- [Uma abordagem para descriptografar firmware criptografado.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E7%A7%8D%E5%8A%A0%E5%AF%86%E5%9B%BA%E4%BB%B6%E7%9A%84%E8%A7%A3%E5%AF%86%E6%80%9D%E8%B7%AF.md)
- [Da análise de 1day à descoberta de 0day.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E1day%E5%88%86%E6%9E%90%E5%88%B00day%E6%8C%96%E6%8E%98.md)
- [Entendendo vulnerabilidades em serviços DNS a partir de um desafio CTF.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%80%E9%81%93CTF%E9%A2%98%E7%9B%AE%E7%9C%8BDNS%E6%9C%8D%E5%8A%A1%E6%BC%8F%E6%B4%9E.md)
- [Entendendo estouro de pilha em ARM a partir de três desafios CTF.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%89%E9%81%93CTF%E8%B5%9B%E9%A2%98%E7%9C%8Barm%E6%A0%88%E6%BA%A2%E5%87%BA.md)
- [Descoberta simples de 0day após ler <Da reprodução de vulnerabilidades à descoberta simples de 0day>.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E7%9C%8B%3C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%B0%E7%AE%80%E5%8D%950day%E6%BC%8F%E6%B4%9E%E6%8C%96%3E%E5%90%8E%E7%9A%84%E7%AE%80%E5%8D%950day%E6%8C%96%E6%8E%98.md)
- [Montagem de ambiente simulado do NetGear RAX50 do zero.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E9%9B%B6%E5%BC%80%E5%A7%8B%E7%9A%84NetGear%20RAX50%20%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA.md)
- [Contornando a proteção de leitura do Renesas RH850 usando injeção de falhas.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BD%BF%E7%94%A8%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E7%BB%95%E8%BF%87%E7%91%9E%E8%90%A8%20RH850%E7%9A%84%E8%AF%BB%E4%BF%9D%E6%8A%A4.md)
- [Extração de firmware do nrf52840 por injeção de falha de tensão em canal lateral.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BE%A7%E4%BF%A1%E9%81%93%E7%94%B5%E5%8E%8B%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E6%8F%90%E5%8F%96nrf52840%E5%9B%BA%E4%BB%B6.md)
- [Sobre o problema de alinhamento do endereço de execução de funções em instruções thumb2 e análise de firmware de verificação.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%85%B3%E4%BA%8Ethumb2%E6%8C%87%E4%BB%A4%E4%B8%8B%E5%87%BD%E6%95%B0%E8%BF%90%E8%A1%8C%E5%9C%B0%E5%9D%80%E5%AF%B9%E9%BD%90%E9%97%AE%E9%A2%98%E5%8F%8A%E9%AA%8C%E8%AF%81%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90.md)
- [Extração de firmware de um modem óptico usando vulnerabilidade de path traversal.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%88%A9%E7%94%A8%E7%9B%AE%E5%BD%95%E7%A9%BF%E8%B6%8A%E6%BC%8F%E6%B4%9E%E5%AF%B9%E6%9F%90%E5%85%89%E7%8C%AB%E8%BF%9B%E8%A1%8C%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.md)
- [Huawei HG532 - Análise breve da vulnerabilidade CVE-2017-17215.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAHG532%20-%20CVE-2017-17215%E6%BC%8F%E6%B4%9E%E7%AE%80%E6%9E%90.md)
- [Repacotamento de firmware e implantação de backdoor na série ASUS AC.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95AC%E7%B3%BB%E5%88%97%E5%9B%BA%E4%BB%B6%E9%87%8D%E6%89%93%E5%8C%85%E4%B8%8E%E5%90%8E%E9%97%A8%E6%A4%8D%E5%85%A5.md)
- [Reprodução de vulnerabilidades da série ASUS RT-AC68U (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%B8%80%EF%BC%89.md)
- [Reprodução de vulnerabilidades da série ASUS RT-AC68U (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [Análise do encapsulamento GSE em comunicações via satélite.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%80%9A%E4%BF%A1GSE%E5%B0%81%E8%A3%85%E8%A7%A3%E6%9E%90.md)
- [Desafio de hackers de satélite | Quebra do protocolo IIC.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%BB%91%E5%AE%A2%E6%8C%91%E6%88%98%E8%B5%9B%20%7C%20IIC%E5%8D%8F%E8%AE%AE%E7%A0%B4%E8%A7%A3.md)
- [Métodos de análise de CGI em firmware (3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%B8%89%EF%BC%89.md)
- [Métodos de análise de CGI em firmware (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [Segurança de firmware - Sequestro de funções e patch.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6%E5%AE%89%E5%85%A8-%E5%87%BD%E6%95%B0%E5%8A%AB%E6%8C%81%E4%BB%A5%E5%8F%8Apatch.md)
- [Pós-exploração no F5 BIG-IP baseada em CVE-2022-1388.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8ECVE-2022-1388%E7%9A%84F5%20BIG-IP%E5%90%8E%E6%B8%97%E9%80%8F.md)
- [Breve discussão sobre ataques DMA baseados em PCILeech e MemProcFS.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8EPCILeech%E5%92%8CMemProcFS%E7%9A%84DMA%E6%94%BB%E5%87%BB%E6%B5%85%E8%B0%88.md)
- [Métodos de construção de ambientes de simulação para diversas arquiteturas e scripts automatizados.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%9A%E7%A7%8D%E6%9E%B6%E6%9E%84%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%9E%84%E5%BB%BA%E6%96%B9%E6%B3%95%E5%8F%8A%E8%87%AA%E5%8A%A8%E8%84%9A%E6%9C%AC.md)
- [Como hackear um purificador de ar^^.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95hack%E6%8E%89%E4%B8%80%E5%8F%B0%E7%A9%BA%E6%B0%94%E5%87%80%E5%8C%96%E5%99%A8%5E%5E.md)
- [Como construir uma pilha de protocolos Wi-Fi do zero (1).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%881%EF%BC%89.md)
- [Como construir uma pilha de protocolos Wi-Fi do zero (2).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%882%EF%BC%89.md)
- [Como obter a chave de firmware do EL3 através do modo de teste.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E6%B5%8B%E8%AF%95%E6%A8%A1%E5%BC%8F%E8%8E%B7%E5%BE%97EL3%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6%E5%AF%86%E9%92%A5.md)
- [Breve análise do firmware do Schneider NOE77101.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%AF%B9%E6%96%BD%E8%80%90%E5%BE%B7NOE77101%E5%9B%BA%E4%BB%B6%E6%B5%85%E6%9E%90.md)
- [Reprodução da vulnerabilidade CVE-2023-26315 do roteador Xiaomi AX9000.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.md)
- [Descoberta de vulnerabilidade 0day em roteadores corporativos Cisco (versão despretensiosa).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%80%9D%E7%A7%91%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A80day%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%EF%BC%88%E6%B0%B4%E6%BC%8F%E6%B4%9E%E7%89%88%EF%BC%89.md)
- [Passo a passo: análise de firmware e descoberta de vulnerabilidades na arquitetura MIPS.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%8B%E6%8A%8A%E6%89%8B%E5%B8%A6%E4%BD%A0%E5%88%86%E6%9E%90mips%E6%9E%B6%E6%9E%84%E4%B8%8B%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90%E4%B8%8E%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md)
- [Análise do protocolo Internet Printing Protocol (IPP) em impressoras.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E4%B9%8BInternet%20Printing%20Protocol%28IPP)协议分析.md)
- [Introdução à pesquisa de vulnerabilidades em impressoras.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E6%BC%8F%E6%B4%9E%E7%A0%94%E7%A9%B6%E5%85%A5%E9%97%A8.md)
- [Explorando a recuperação de nomes de arquivos do VxWorks.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8E%A2%E7%A9%B6vxworks%E6%96%87%E4%BB%B6%E5%90%8D%E6%81%A2%E5%A4%8D.md)
- [Extração de firmware de bicicletas compartilhadas.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8F%90%E5%8F%96%E5%85%B1%E4%BA%AB%E5%8D%95%E8%BD%A6%E5%9B%BA%E4%BB%B6.md)
- [Análise da vulnerabilidade de ataque DOS no H3C Magic R100.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%96%B0%E5%8D%8E%E4%B8%89magicR100%E5%AD%98%E5%9C%A8DOS%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [Introdução à segurança de drones.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E5%AE%89%E5%85%A8%E7%AE%80%E4%BB%8B.md)
- [Introdução ao protocolo de comunicação de drones MAVLink.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E9%80%9A%E4%BF%A1%E5%8D%8F%E8%AE%AEMAVLink%E7%AE%80%E4%BB%8B.md)
- [Análise reversa de sinais de controle remoto sem fio.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E7%BA%BF%E9%81%A5%E6%8E%A7%E4%BF%A1%E5%8F%B7%E9%80%86%E5%90%91%E5%88%86%E6%9E%90.md)
- [Compilação de vulnerabilidades em smart TVs.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E7%94%B5%E8%A7%86%E6%BC%8F%E6%B4%9E%E6%B1%87%E6%80%BB.md)
- [Análise de segurança de fechaduras inteligentes: exploração multifacetada de hardware, firmware, app e nuvem.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E9%97%A8%E9%94%81%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%EF%BC%9A%E5%A4%9A%E6%96%B9%E4%BD%8D%E6%8E%A2%E7%B4%A2%E7%A1%AC%E4%BB%B6%E3%80%81%E5%9B%BA%E4%BB%B6%E3%80%81app%E5%92%8C%E4%BA%91%E7%AB%AF.md)
- [Extração e análise do firmware de uma câmera T.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90T%E6%91%84%E5%83%8F%E5%A4%B4%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96%E5%88%86%E6%9E%90.md)
- [Análise do protocolo de uma marca de tomada inteligente de parede.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E5%93%81%E7%89%8C%E6%99%BA%E8%83%BD%E5%A2%99%E5%A3%81%E6%8F%92%E5%BA%A7%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90.md)
- [Uma câmera possui uma vulnerabilidade genérica de execução de comandos não autorizada.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E6%91%84%E5%83%8F%E5%A4%B4%E5%AD%98%E5%9C%A8%E9%80%9A%E7%94%A8%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md)
- [Análise da vulnerabilidade de execução de comandos em um roteador Mi.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [Duas abordagens para descriptografar um dispositivo de rede.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E8%A7%A3%E5%AF%86%E7%9A%84%E4%B8%A4%E7%A7%8D%E6%80%9D%E8%B7%AF.md)
- [Análise de vulnerabilidade de um roteador e exploração de diversos métodos de estouro de pilha.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%A4%9A%E7%A7%8D%E6%A0%88%E6%BA%A2%E5%87%BA%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6.md)
- [Patch e hook em firmware simulado.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%A8%A1%E6%8B%9F%E5%9B%BA%E4%BB%B6%E4%B8%8B%E7%9A%84patch%E4%B8%8Ehook.md)
- [Breve análise do processo de chamada entre CGI e lighttpd.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E6%9E%90cgi%E4%B8%8Elighttpd%E4%B9%8B%E9%97%B4%E7%9A%84%E8%B0%83%E7%94%A8%E8%BF%87%E7%A8%8B.md)
- [Breve discussão sobre descoberta de vulnerabilidades em roteadores.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E8%B0%88%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md)

---

[Read more](https://github.com/mr-xn/penetration_testing_poc)