## <span id="head1"> Penetration_Testing_POC</span>

搜集有关渗透测试中用到的POC、脚本、工具、文章等姿势分享，作为笔记吧，欢迎补充。

**请注意所有工具是否有后门或者其他异常行为，建议均在虚拟环境操作。**

- [Penetration_Testing_POC](#head1)
- [请善用搜索[`Ctrl+F`]查找](#head2)
- [IOT Device&Mobile Phone](#head3)
- [Web APP](#head4)
- [提权辅助相关](#head5)
- [PC](#head6)
- [tools-小工具集合](#head7)
- [文章/书籍/教程相关](#head8)
- [说明](#head9)

## <span id="head2"> 请善用搜索[`Ctrl+F`]查找</span>

## <span id="head3">IOT Device&Mobile Phone</span>

- [天翼创维awifi路由器存在多处未授权访问漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%A9%E7%BF%BC%E5%88%9B%E7%BB%B4awifi%E8%B7%AF%E7%94%B1%E5%99%A8%E5%AD%98%E5%9C%A8%E5%A4%9A%E5%A4%84%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E.md)
- [华为WS331a产品管理页面存在CSRF漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAWS331a%E4%BA%A7%E5%93%81%E7%AE%A1%E7%90%86%E9%A1%B5%E9%9D%A2%E5%AD%98%E5%9C%A8CSRF%E6%BC%8F%E6%B4%9E.md)
- [CVE-2019-16313 蜂网互联企业级路由器v4.31密码泄露漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16313%20%E8%9C%82%E7%BD%91%E4%BA%92%E8%81%94%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A8v4.31%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md)
- [D-Link路由器RCE漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2019-16920-D-Link-rce.md)
- [CVE-2019-13051-Pi-Hole路由端去广告软件的命令注入&权限提升](https://github.com/mr-xn/penetration_testing_poc/blob/master/vuln_pocs/cve/CVE-2019-13051)
- [D-Link DIR-859 - RCE UnAutenticated (CVE-2019–17621)](https://github.com/s1kr10s/D-Link-DIR-859-RCE)
- [Huawei HG255 Directory Traversal[目录穿越]](https://packetstormsecurity.com/files/155954/huaweihg255-traversal.rb.txt)|[本地备份文件](https://github.com/mr-xn/penetration_testing_poc/blob/master/tools/huaweihg255-traversal.rb)
- [D-Link Devices - Unauthenticated Remote Command Execution in ssdpcgi (Metasploit)CVE-2019-20215(Metasploit)](https://github.com/mr-xn/penetration_testing_poc/blob/master/POC_Details/D-Link%20Devices%20-%20Unauthenticated%20Remote%20Command%20Execution%20in%20ssdpcgi%20%28Metasploit)%20CVE-2019-20215.rb)
- [从 Interfaces.d 到 RCE：Mozilla WebThings IoT 网关漏洞挖掘](https://research.nccgroup.com/2020/02/10/interfaces-d-to-rce/)
- [小米系列路由器远程命令执行漏洞（CVE-2019-18370，CVE-2019-18371）](https://github.com/UltramanGaia/Xiaomi_Mi_WiFi_R3G_Vulnerability_POC/blob/master/report/report.md)
- [Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload-未经验证即可替换固件)](https://www.exploit-db.com/exploits/48158)
- [cve-2020-8634&cve-2020-8635](https://www.exploit-db.com/exploits/48160)|[Wing FTP Server 6.2.3权限提升漏洞发现分析复现过程](https://www.hooperlabs.xyz/disclosures/cve-2020-8635.php)|[Wing FTP Server 6.2.5权限提升](https://www.exploit-db.com/exploits/48154)
- [CVE-2020-9374-TP LINK TL-WR849N - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CVE-2020-9374.md)
- [CVE-2020-12753-LG 智能手机任意代码执行漏洞](https://github.com/shinyquagsire23/CVE-2020-12753-PoC)
- [CVE-2020-12695-UPnP 安全漏洞](https://github.com/yunuscadirci/CallStranger)
- [79款 Netgear 路由器遭远程接管0day](https://github.com/grimm-co/NotQuite0DayFriday/blob/master/2020.06.15-netgear/exploit.py)
- [dlink-dir610-exploits-Exploits for CVE-2020-9376 and CVE-2020-9377](https://github.com/renatoalencar/dlink-dir610-exploits)
- [wacker：一组脚本，可辅助对WPA3接入点执行在线词典攻击](https://github.com/blunderbuss-wctf/wacker)
- [CVE-2020-24581 D-Link DSL-2888A 远程命令执行漏洞分析](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/CVE-2020-24581%20D-Link%20DSL-2888A%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.pdf)-[原地址](https://www.anquanke.com/post/id/229323)
- [CNVD-2021-14536_锐捷RG-UAC统一上网行为管理审计系统账号密码信息泄露漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/CNVD-2021-14536_%E9%94%90%E6%8D%B7RG-UAC%E7%BB%9F%E4%B8%80%E4%B8%8A%E7%BD%91%E8%A1%8C%E4%B8%BA%E7%AE%A1%E7%90%86%E5%AE%A1%E8%AE%A1%E7%B3%BB%E7%BB%9F%E8%B4%A6%E5%8F%B7%E5%AF%86%E7%A0%81%E4%BF%A1%E6%81%AF%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md)
- [CNVD-2021-14544:Hikvision 海康威视流媒体管理服务器任意文件读取](https://github.com/Henry4E36/Hikvision)
- [CNVD-2020-25078:D-link 敏感信息泄漏，可以直接获取账户密码查看监控](https://github.com/Henry4E36/D-link-information)
- [ios-gamed-0day](https://github.com/illusionofchaos/ios-gamed-0day)
- [ios-nehelper-wifi-info-0day](https://github.com/illusionofchaos/ios-nehelper-wifi-info-0day)
- [ios-nehelper-enum-apps-0day](https://github.com/illusionofchaos/ios-nehelper-enum-apps-0day)
- [iOS 15.0.1 RCE PoC](https://github.com/jonathandata1/ios_15_rce)
- [DarkSword-RCE：Apple iOS 远程代码执行漏洞利用](https://github.com/htimesnine/DarkSword-RCE)|[darksword-kexploit：Apple iOS 内核漏洞利用](https://github.com/opa334/darksword-kexploit)|[DarkSword：Apple iOS 漏洞利用](https://github.com/ghh-jb/DarkSword)
- [CVE-2021-36260：海康威视产品命令注入漏洞](https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html)
- [CVE-2021-33044、CVE-2021-33045 大华摄像头POC](https://github.com/mcw0/DahuaConsole)|[相关分析](https://github.com/mcw0/PoC/blob/master/Dahua%20authentication%20bypass.txt)|[登录绕过chrome 插件](https://github.com/bp2008/DahuaLoginBypass)
- [CVE-2021-36260：海康威视命令注入漏洞](https://github.com/rabbitsafe/CVE-2021-36260)|[又一个CVE-2021-36260利用脚本](https://github.com/Cuerz/CVE-2021-36260)
- [CVE-2021-41653：TP-Link TL-WR840N V5(EU) - RCE](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/TP-Link%20TL-WR840N%20V5%28EU)%20-%20RCE%20-%20CVE-2021-41653.pdf)
- [DirtyPipe-Android：Dirty Pipe root exploit for Android](https://github.com/polygraphene/DirtyPipe-Android)
- [CVE-2022-30075：Tp-Link Archer AX50 Authenticated RCE](https://github.com/aaronsvk/CVE-2022-30075)
- [NotQuite0day：D-Link 1960相关漏洞](https://github.com/star-sg/NotQuite0day)
- [HuaYuReportRCE：华域数广Report组件GetShell](https://github.com/h0r1g/HuaYuReportRCE)
- [IOT_Vul：IOT相关漏洞收集](https://github.com/zhefox/IOT_Vul)
- [CameraHack：批量扫描破解海康威视、大华等摄像头的常见漏洞](https://github.com/WhaleFell/CameraHack)
- [CVE-2022-32832：apple macos 的 apfs 导致内核任意代码执行漏洞](https://github.com/Muirey03/CVE-2022-32832)
- [HookWechatRecall：通过frida工具 拦截 微信撤回Demo](https://github.com/GaoGuohao/HookWechatRecall)
- [IOT_vuln：IOT相关漏洞仓库](https://github.com/EPhaha/IOT_vuln)
- [hikvision_CVE-2017-7921_auth_bypass_config_decryptor：解密受CVE-2017-7921影响的海康威视的配置文件](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor)
- [CVE-2022-20866：思科自适应安全设备软件和 Firepower 威胁防御软件 RSA 私钥泄漏检查](https://github.com/CiscoPSIRT/CVE-2022-20866)
- [WLAN-AP-WEA453e RCE:三星路由器远程命令执行漏洞](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/WLAN-AP-WEA453e%20RCE%E4%B8%89%E6%98%9F%E8%B7%AF%E7%94%B1%E5%99%A8%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md)
- [Buffer overflow in Xiongmai DVRs](https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/)|[备份](https://web.archive.org/web/20221129205148/https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/)
- [CVE-2023-27350: PaperCut NG身份验证绕过导致的RCE](https://github.com/horizon3ai/CVE-2023-27350)
- [ivms-8700-0day-poc: 海康威视iVMS-8700综合安防管理平台任意文件上传漏洞](https://github.com/spmonkey/ivms-8700-0day-poc)
- [badspin: Android Kernel内存错误引用漏洞](https://github.com/0xkol/badspin)
- [HikvisionIVMSGetShell: 海康威视IVMS综合安防管理平台软件GetShell](https://github.com/Tas9er/HikvisionIVMSGetShell)
- [iot: DIR-816 823g系列路由器的漏洞利用](https://github.com/sek1th/iot)
- [VulIoT: DIR-816 823g系列路由器漏洞利用](https://github.com/726232111/VulIoT)
- [NsePocsuite-lua: 网络摄像头漏洞检测脚本.Nmap (Nse Nmap script engine)](https://github.com/foggyspace/NsePocsuite-lua)
- [设备漏洞挖掘思路](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E6%80%9D%E8%B7%AF.html)
- [Vivotek CC8160 固件栈溢出漏洞复现分析](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/Vivotek%20CC8160%20%E5%9B%BA%E4%BB%B6%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%86%E6%9E%90.html)
- [小米AX9000路由器CVE-2023-26315漏洞挖掘](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.html)
- [IOT-CVE-2018-17066(D-Link命令注入漏洞)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/IOT-CVE-2018-17066%28D-Link%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html)
- [针对IoT固件的openssl加密的提取&暴力破解工具](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E9%92%88%E5%AF%B9IoT%E5%9B%BA%E4%BB%B6%E7%9A%84openssl%E5%8A%A0%E5%AF%86%E7%9A%84%E6%8F%90%E5%8F%96%26%E6%9A%B4%E5%8A%9B%E7%A0%B4%E8%A7%A3%E5%B7%A5%E5%85%B7.html)
- [小米路由器固件仿真模拟方案](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%5B%E5%8E%9F%E5%88%9B%5D%20%E5%B0%8F%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%9B%BA%E4%BB%B6%E4%BB%BF%E7%9C%9F%E6%A8%A1%E6%8B%9F%E6%96%B9%E6%A1%88-%E6%99%BA%E8%83%BD%E8%AE%BE%E5%A4%87-%E7%9C%8B%E9%9B%AA-%E5%AE%89%E5%85%A8%E7%A4%BE%E5%8C%BA_%E5%AE%89%E5%85%A8%E6%8B%9B%E8%81%98_kanxue.com.html)
- [QEMU搭建ARM64环境 _ ZIKH26's Blog](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/QEMU%E6%90%AD%E5%BB%BAARM64%E7%8E%AF%E5%A2%83%20_%20ZIKH26%27s%20Blog.html)
- [DIR-820 CVE-2022-26258漏洞复现](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/DIR-820%20CVE-2022-26258%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.html)
- [从jhttpd分析到系统命令注入(CVE-2021-46227-D-Link Di-7200G 命令注入漏洞)](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E4%BB%8Ejhttpd%E5%88%86%E6%9E%90%E5%88%B0%E7%B3%BB%E7%BB%9F%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%28CVE-2021-46227-D-Link%20Di-7200G%20%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E).html)
- [2024 RWCTF群晖 BC500摄像头RCE--未授权_栈溢出](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/2024%20RWCTF%E7%BE%A4%E6%99%96%20BC500%E6%91%84%E5%83%8F%E5%A4%B4RCE--%E6%9C%AA%E6%8E%88%E6%9D%83_%E6%A0%88%E6%BA%A2%E5%87%BA.html)
- [路由器dd手动提取固件---迅捷PoEAC路由一体机FR100P-AC固件提取](https://github.com/mr-xn/penetration_testing_poc/blob/master/books/%E8%B7%AF%E7%94%B1%E5%99%A8dd%E6%89%8B%E5%8A%A8%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6---%E8%BF%85%E6%8D%B7PoEAC%E8%B7%AF%E7%94%B1%E4%B8%80%E4%BD%93%E6%9C%BAFR100P-AC%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.html)
- [NX_Firmware：任天堂Switch各版本固件数据库](https://github.com/THZoria/NX_Firmware)
- [vphone-aio：一键运行已越狱并安装完整bootstrap的iOS虚拟手机(vphone)脚本](https://github.com/34306/vphone-aio)
- [AssppJailbroken：一款用于解密从 App Store 下载的最新 IPA 文件的工具，并支持在已越狱的 iOS 设备及 iPhone 模拟器上运行](https://github.com/lbr77/AssppJailbroken)
- [FirmWire：支持三星 Shannon 和 MediaTek 基带固件的全系统动态分析平台，可用于模糊测试、漏洞根因分析与调试](https://github.com/FirmWire/FirmWire)
- [Podroid：无需 root 即可在 Android 手机上运行 Linux 容器，基于 QEMU 启动 Alpine Linux 虚拟机并提供完整的 Podman 容器运行时](https://github.com/ExTV/Podroid)
- [PrismSpace：基于 Android 工作资料（managed profile）的应用双开管理器](https://github.com/yzddmr6/PrismSpace)
- [Tsec-Salon：腾讯安全沙龙历届活动材料](https://github.com/Yeti-791/Tsec-Salon)|[BLACKHAT_Asia2026: Black Hat Asia 2026 议题资料汇总](https://github.com/Mr-xn/BLACKHAT_Asia2026)|[Java Ghost Bits - Black Hat Asia 2026 演讲PDF(幽灵比特位:高位截断)](https://i.blackhat.com/Asia-26/Presentations/Asia-26-Bai-Cast-Attack-Ghost-Bits-4.23.pdf)|[GBitsTools: Ghost Bits攻击工具(Python GUI/CLI)](https://github.com/shiyeshu/GBitsTools)|[GbitsGen: Ghost Bits字符生成工具](https://github.com/qi4L/GbitsGen)|[ghost-bits-lab: Ghost Bits交互式安全实验靶机(Java)](https://github.com/Xc1Ym/ghost-bits-lab)
- [CVE-2026-34908-check：UniFi OS Server 身份验证绕过与未授权远程代码执行(RCE)检测工具](https://github.com/BishopFox/CVE-2026-34908-check) | [相关技术分析：Popping Root on UniFi OS Server](https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis)

- [0成本搭建摄像头漏洞挖掘环境.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/0%E6%88%90%E6%9C%AC%E6%90%AD%E5%BB%BA%E6%91%84%E5%83%8F%E5%A4%B4%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%E7%8E%AF%E5%A2%83.md)
- [2021年物联网设备CVE天梯榜.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%B9%B4%E7%89%A9%E8%81%94%E7%BD%91%E8%AE%BE%E5%A4%87CVE%E5%A4%A9%E6%A2%AF%E6%A6%9C.md)
- [2021强网杯赛题Mi Route复现.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2021%E5%BC%BA%E7%BD%91%E6%9D%AF%E8%B5%9B%E9%A2%98Mi%20Route%E5%A4%8D%E7%8E%B0.md)
- [2022 祥云杯 Misc super_electric WriteUp.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%20%E7%A5%A5%E4%BA%91%E6%9D%AF%20Misc%20super_electric%20WriteUp.md)
- [2022河南工业互联网安全大赛复赛-工控Writeup.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2022%E6%B2%B3%E5%8D%97%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E5%A4%8D%E8%B5%9B-%E5%B7%A5%E6%8E%A7Writeup.md)
- [2024中国工业互联网安全大赛智能家电行业赛道 writeup by Mini-Venom.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/2024%E4%B8%AD%E5%9B%BD%E5%B7%A5%E4%B8%9A%E4%BA%92%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E5%A4%A7%E8%B5%9B%E6%99%BA%E8%83%BD%E5%AE%B6%E7%94%B5%E8%A1%8C%E4%B8%9A%E8%B5%9B%E9%81%93%20writeup%20by%20Mini-Venom.md)
- [AFL源码分析系列——afl-fuzz(3).md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%E2%80%94%E2%80%94afl-fuzz%283).md)
- [AFL源码分析系列（三）-- afl-llvm-mode.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/AFL%E6%BA%90%E7%A0%81%E5%88%86%E6%9E%90%E7%B3%BB%E5%88%97%EF%BC%88%E4%B8%89%EF%BC%89--%20afl-llvm-mode.md)
- [Asus 路由器栈溢出漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Asus%20%E8%B7%AF%E7%94%B1%E5%99%A8%E6%A0%88%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [Atmel SAM Cortex-M7 MCU rom 分析，逆向工程，仿真和模糊化.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Atmel%20SAM%20Cortex-M7%20MCU%20rom%20%E5%88%86%E6%9E%90%EF%BC%8C%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%EF%BC%8C%E4%BB%BF%E7%9C%9F%E5%92%8C%E6%A8%A1%E7%B3%8A%E5%8C%96.md)
- [BooFuzz的简单使用，以CVE-2018-5767为例.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/BooFuzz%E7%9A%84%E7%AE%80%E5%8D%95%E4%BD%BF%E7%94%A8%EF%BC%8C%E4%BB%A5CVE-2018-5767%E4%B8%BA%E4%BE%8B.md)
- [Brother VC-500W 打印机.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/Brother%20VC-500W%20%E6%89%93%E5%8D%B0%E6%9C%BA.md)
- [boofuzz 源码笔记（一）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%80%EF%BC%89.md)
- [boofuzz 源码笔记（三）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%B8%89%EF%BC%89.md)
- [boofuzz 源码笔记（二）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/boofuzz%20%E6%BA%90%E7%A0%81%E7%AC%94%E8%AE%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [“入侵5G手机”（一）Black Hat USA 2021：通过无线基带-针对5G智能手机的RCE远程代码执行攻击白皮书.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E2%80%9C%E5%85%A5%E4%BE%B55G%E6%89%8B%E6%9C%BA%E2%80%9D%EF%BC%88%E4%B8%80%EF%BC%89Black%20Hat%20USA%202021%EF%BC%9A%E9%80%9A%E8%BF%87%E6%97%A0%E7%BA%BF%E5%9F%BA%E5%B8%A6-%E9%92%88%E5%AF%B95G%E6%99%BA%E8%83%BD%E6%89%8B%E6%9C%BA%E7%9A%84RCE%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%94%BB%E5%87%BB%E7%99%BD%E7%9A%AE%E4%B9%A6.md)
- [一文读懂ARM架构下的漏洞利用.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E6%96%87%E8%AF%BB%E6%87%82ARM%E6%9E%B6%E6%9E%84%E4%B8%8B%E7%9A%84%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8.md)
- [一种加密固件的解密思路.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%B8%80%E7%A7%8D%E5%8A%A0%E5%AF%86%E5%9B%BA%E4%BB%B6%E7%9A%84%E8%A7%A3%E5%AF%86%E6%80%9D%E8%B7%AF.md)
- [从1day分析到0day挖掘.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E1day%E5%88%86%E6%9E%90%E5%88%B00day%E6%8C%96%E6%8E%98.md)
- [从一道CTF题目看DNS服务漏洞.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%80%E9%81%93CTF%E9%A2%98%E7%9B%AE%E7%9C%8BDNS%E6%9C%8D%E5%8A%A1%E6%BC%8F%E6%B4%9E.md)
- [从三道CTF赛题看arm栈溢出.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E4%B8%89%E9%81%93CTF%E8%B5%9B%E9%A2%98%E7%9C%8Barm%E6%A0%88%E6%BA%A2%E5%87%BA.md)
- [从看<漏洞复现到简单0day漏洞挖>后的简单0day挖掘.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E7%9C%8B%3C%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%B0%E7%AE%80%E5%8D%950day%E6%BC%8F%E6%B4%9E%E6%8C%96%3E%E5%90%8E%E7%9A%84%E7%AE%80%E5%8D%950day%E6%8C%96%E6%8E%98.md)
- [从零开始的NetGear RAX50 模拟环境搭建.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BB%8E%E9%9B%B6%E5%BC%80%E5%A7%8B%E7%9A%84NetGear%20RAX50%20%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA.md)
- [使用故障注入绕过瑞萨 RH850的读保护.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BD%BF%E7%94%A8%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E7%BB%95%E8%BF%87%E7%91%9E%E8%90%A8%20RH850%E7%9A%84%E8%AF%BB%E4%BF%9D%E6%8A%A4.md)
- [侧信道电压故障注入提取nrf52840固件.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E4%BE%A7%E4%BF%A1%E9%81%93%E7%94%B5%E5%8E%8B%E6%95%85%E9%9A%9C%E6%B3%A8%E5%85%A5%E6%8F%90%E5%8F%96nrf52840%E5%9B%BA%E4%BB%B6.md)
- [关于thumb2指令下函数运行地址对齐问题及验证固件分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%85%B3%E4%BA%8Ethumb2%E6%8C%87%E4%BB%A4%E4%B8%8B%E5%87%BD%E6%95%B0%E8%BF%90%E8%A1%8C%E5%9C%B0%E5%9D%80%E5%AF%B9%E9%BD%90%E9%97%AE%E9%A2%98%E5%8F%8A%E9%AA%8C%E8%AF%81%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90.md)
- [利用目录穿越漏洞对某光猫进行固件提取.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%88%A9%E7%94%A8%E7%9B%AE%E5%BD%95%E7%A9%BF%E8%B6%8A%E6%BC%8F%E6%B4%9E%E5%AF%B9%E6%9F%90%E5%85%89%E7%8C%AB%E8%BF%9B%E8%A1%8C%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96.md)
- [华为HG532 - CVE-2017-17215漏洞简析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E4%B8%BAHG532%20-%20CVE-2017-17215%E6%BC%8F%E6%B4%9E%E7%AE%80%E6%9E%90.md)
- [华硕AC系列固件重打包与后门植入.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95AC%E7%B3%BB%E5%88%97%E5%9B%BA%E4%BB%B6%E9%87%8D%E6%89%93%E5%8C%85%E4%B8%8E%E5%90%8E%E9%97%A8%E6%A4%8D%E5%85%A5.md)
- [华硕RT-AC68U系列漏洞复现（一）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%B8%80%EF%BC%89.md)
- [华硕RT-AC68U系列漏洞复现（二）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%8E%E7%A1%95RT-AC68U%E7%B3%BB%E5%88%97%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [卫星通信GSE封装解析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%80%9A%E4%BF%A1GSE%E5%B0%81%E8%A3%85%E8%A7%A3%E6%9E%90.md)
- [卫星黑客挑战赛 | IIC协议破解.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%8D%AB%E6%98%9F%E9%BB%91%E5%AE%A2%E6%8C%91%E6%88%98%E8%B5%9B%20%7C%20IIC%E5%8D%8F%E8%AE%AE%E7%A0%B4%E8%A7%A3.md)
- [固件CGI分析手法（三）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%B8%89%EF%BC%89.md)
- [固件CGI分析手法（二）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6CGI%E5%88%86%E6%9E%90%E6%89%8B%E6%B3%95%EF%BC%88%E4%BA%8C%EF%BC%89.md)
- [固件安全-函数劫持以及patch.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9B%BA%E4%BB%B6%E5%AE%89%E5%85%A8-%E5%87%BD%E6%95%B0%E5%8A%AB%E6%8C%81%E4%BB%A5%E5%8F%8Apatch.md)
- [基于CVE-2022-1388的F5 BIG-IP后渗透.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8ECVE-2022-1388%E7%9A%84F5%20BIG-IP%E5%90%8E%E6%B8%97%E9%80%8F.md)
- [基于PCILeech和MemProcFS的DMA攻击浅谈.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%9F%BA%E4%BA%8EPCILeech%E5%92%8CMemProcFS%E7%9A%84DMA%E6%94%BB%E5%87%BB%E6%B5%85%E8%B0%88.md)
- [多种架构模拟环境构建方法及自动脚本.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A4%9A%E7%A7%8D%E6%9E%B6%E6%9E%84%E6%A8%A1%E6%8B%9F%E7%8E%AF%E5%A2%83%E6%9E%84%E5%BB%BA%E6%96%B9%E6%B3%95%E5%8F%8A%E8%87%AA%E5%8A%A8%E8%84%9A%E6%9C%AC.md)
- [如何hack掉一台空气净化器^^.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95hack%E6%8E%89%E4%B8%80%E5%8F%B0%E7%A9%BA%E6%B0%94%E5%87%80%E5%8C%96%E5%99%A8%5E%5E.md)
- [如何手搓一个Wi-Fi协议栈（1）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%881%EF%BC%89.md)
- [如何手搓一个Wi-Fi协议栈（2）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E6%89%8B%E6%90%93%E4%B8%80%E4%B8%AAWi-Fi%E5%8D%8F%E8%AE%AE%E6%A0%88%EF%BC%882%EF%BC%89.md)
- [如何通过测试模式获得EL3提取固件密钥.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%A6%82%E4%BD%95%E9%80%9A%E8%BF%87%E6%B5%8B%E8%AF%95%E6%A8%A1%E5%BC%8F%E8%8E%B7%E5%BE%97EL3%E6%8F%90%E5%8F%96%E5%9B%BA%E4%BB%B6%E5%AF%86%E9%92%A5.md)
- [对施耐德NOE77101固件浅析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%AF%B9%E6%96%BD%E8%80%90%E5%BE%B7NOE77101%E5%9B%BA%E4%BB%B6%E6%B5%85%E6%9E%90.md)
- [小米AX9000路由器CVE-2023-26315漏洞复现.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E5%B0%8F%E7%B1%B3AX9000%E8%B7%AF%E7%94%B1%E5%99%A8CVE-2023-26315%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0.md)
- [思科企业级路由器0day漏洞挖掘（水漏洞版）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%80%9D%E7%A7%91%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A80day%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98%EF%BC%88%E6%B0%B4%E6%BC%8F%E6%B4%9E%E7%89%88%EF%BC%89.md)
- [手把手带你分析mips架构下固件分析与漏洞挖掘.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%8B%E6%8A%8A%E6%89%8B%E5%B8%A6%E4%BD%A0%E5%88%86%E6%9E%90mips%E6%9E%B6%E6%9E%84%E4%B8%8B%E5%9B%BA%E4%BB%B6%E5%88%86%E6%9E%90%E4%B8%8E%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md)
- [打印机之Internet Printing Protocol(IPP)协议分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E4%B9%8BInternet%20Printing%20Protocol%28IPP)协议分析.md)
- [打印机漏洞研究入门.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%89%93%E5%8D%B0%E6%9C%BA%E6%BC%8F%E6%B4%9E%E7%A0%94%E7%A9%B6%E5%85%A5%E9%97%A8.md)
- [探究vxworks文件名恢复.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8E%A2%E7%A9%B6vxworks%E6%96%87%E4%BB%B6%E5%90%8D%E6%81%A2%E5%A4%8D.md)
- [提取共享单车固件.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%8F%90%E5%8F%96%E5%85%B1%E4%BA%AB%E5%8D%95%E8%BD%A6%E5%9B%BA%E4%BB%B6.md)
- [新华三magicR100存在DOS攻击漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%96%B0%E5%8D%8E%E4%B8%89magicR100%E5%AD%98%E5%9C%A8DOS%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [无人机安全简介.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E5%AE%89%E5%85%A8%E7%AE%80%E4%BB%8B.md)
- [无人机通信协议MAVLink简介.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E4%BA%BA%E6%9C%BA%E9%80%9A%E4%BF%A1%E5%8D%8F%E8%AE%AEMAVLink%E7%AE%80%E4%BB%8B.md)
- [无线遥控信号逆向分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%97%A0%E7%BA%BF%E9%81%A5%E6%8E%A7%E4%BF%A1%E5%8F%B7%E9%80%86%E5%90%91%E5%88%86%E6%9E%90.md)
- [智能电视漏洞汇总.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E7%94%B5%E8%A7%86%E6%BC%8F%E6%B4%9E%E6%B1%87%E6%80%BB.md)
- [智能门锁安全分析：多方位探索硬件、固件、app和云端.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%99%BA%E8%83%BD%E9%97%A8%E9%94%81%E5%AE%89%E5%85%A8%E5%88%86%E6%9E%90%EF%BC%9A%E5%A4%9A%E6%96%B9%E4%BD%8D%E6%8E%A2%E7%B4%A2%E7%A1%AC%E4%BB%B6%E3%80%81%E5%9B%BA%E4%BB%B6%E3%80%81app%E5%92%8C%E4%BA%91%E7%AB%AF.md)
- [某T摄像头固件提取分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90T%E6%91%84%E5%83%8F%E5%A4%B4%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96%E5%88%86%E6%9E%90.md)
- [某品牌智能墙壁插座协议分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E5%93%81%E7%89%8C%E6%99%BA%E8%83%BD%E5%A2%99%E5%A3%81%E6%8F%92%E5%BA%A7%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90.md)
- [某摄像头存在通用未授权命令执行漏洞.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E6%91%84%E5%83%8F%E5%A4%B4%E5%AD%98%E5%9C%A8%E9%80%9A%E7%94%A8%E6%9C%AA%E6%8E%88%E6%9D%83%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md)
- [某米路由器命令执行漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%B1%B3%E8%B7%AF%E7%94%B1%E5%99%A8%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [某网络设备解密的两种思路.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E8%A7%A3%E5%AF%86%E7%9A%84%E4%B8%A4%E7%A7%8D%E6%80%9D%E8%B7%AF.md)
- [某路由器漏洞分析与多种栈溢出利用方法探究.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%9F%90%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90%E4%B8%8E%E5%A4%9A%E7%A7%8D%E6%A0%88%E6%BA%A2%E5%87%BA%E5%88%A9%E7%94%A8%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6.md)
- [模拟固件下的patch与hook.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%A8%A1%E6%8B%9F%E5%9B%BA%E4%BB%B6%E4%B8%8B%E7%9A%84patch%E4%B8%8Ehook.md)
- [浅析cgi与lighttpd之间的调用过程.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E6%9E%90cgi%E4%B8%8Elighttpd%E4%B9%8B%E9%97%B4%E7%9A%84%E8%B0%83%E7%94%A8%E8%BF%87%E7%A8%8B.md)
- [浅谈路由器漏洞挖掘.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%B5%85%E8%B0%88%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md)
- [漏洞复现到简单0day漏洞挖掘.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0%E5%88%B0%E7%AE%80%E5%8D%950day%E6%BC%8F%E6%B4%9E%E6%8C%96%E6%8E%98.md)
- [物联网MQTT协议分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91MQTT%E5%8D%8F%E8%AE%AE%E5%88%86%E6%9E%90.md)
- [物联网安全之Unicorn框架初探.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E4%B9%8BUnicorn%E6%A1%86%E6%9E%B6%E5%88%9D%E6%8E%A2.md)
- [物联网安全之qiling框架初探.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E4%B9%8Bqiling%E6%A1%86%E6%9E%B6%E5%88%9D%E6%8E%A2.md)
- [物联网安全从零开始-BIG-IP CVE漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E4%BB%8E%E9%9B%B6%E5%BC%80%E5%A7%8B-BIG-IP%20CVE%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [物联网安全从零开始-BIG-IP(CVE-2023-22374)漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%89%A9%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%E4%BB%8E%E9%9B%B6%E5%BC%80%E5%A7%8B-BIG-IP%28CVE-2023-22374)漏洞分析.md)
- [电信天翼网关3.0分析（上）.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%94%B5%E4%BF%A1%E5%A4%A9%E7%BF%BC%E7%BD%91%E5%85%B33.0%E5%88%86%E6%9E%90%EF%BC%88%E4%B8%8A%EF%BC%89.md)
- [组播路由介绍以及攻击实战.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%BB%84%E6%92%AD%E8%B7%AF%E7%94%B1%E4%BB%8B%E7%BB%8D%E4%BB%A5%E5%8F%8A%E6%94%BB%E5%87%BB%E5%AE%9E%E6%88%98.md)
- [维盟wayos多款路由网关设备存在多个漏洞.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%BB%B4%E7%9B%9Fwayos%E5%A4%9A%E6%AC%BE%E8%B7%AF%E7%94%B1%E7%BD%91%E5%85%B3%E8%AE%BE%E5%A4%87%E5%AD%98%E5%9C%A8%E5%A4%9A%E4%B8%AA%E6%BC%8F%E6%B4%9E.md)
- [网络设备分析实战之Sophos UTM 固件反编译 Perl  源码.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E5%88%86%E6%9E%90%E5%AE%9E%E6%88%98%E4%B9%8BSophos%20UTM%20%E5%9B%BA%E4%BB%B6%E5%8F%8D%E7%BC%96%E8%AF%91%20Perl%20%20%E6%BA%90%E7%A0%81.md)
- [腾达AC1200路由器漏洞分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%85%BE%E8%BE%BEAC1200%E8%B7%AF%E7%94%B1%E5%99%A8%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.md)
- [花式固件提取之韩国KT固件.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%8A%B1%E5%BC%8F%E5%9B%BA%E4%BB%B6%E6%8F%90%E5%8F%96%E4%B9%8B%E9%9F%A9%E5%9B%BDKT%E5%9B%BA%E4%BB%B6.md)
- [花式解密Zyxel加密固件包.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%8A%B1%E5%BC%8F%E8%A7%A3%E5%AF%86Zyxel%E5%8A%A0%E5%AF%86%E5%9B%BA%E4%BB%B6%E5%8C%85.md)
- [记一次全设备通杀未授权RCE的挖掘经历.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%AE%B0%E4%B8%80%E6%AC%A1%E5%85%A8%E8%AE%BE%E5%A4%87%E9%80%9A%E6%9D%80%E6%9C%AA%E6%8E%88%E6%9D%83RCE%E7%9A%84%E6%8C%96%E6%8E%98%E7%BB%8F%E5%8E%86.md)
- [记一次固件解密学习--X软路由.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%AE%B0%E4%B8%80%E6%AC%A1%E5%9B%BA%E4%BB%B6%E8%A7%A3%E5%AF%86%E5%AD%A6%E4%B9%A0--X%E8%BD%AF%E8%B7%AF%E7%94%B1.md)
- [记一次酒店wifi设备分析.md](https://github.com/mr-xn/penetration_testing_poc/blob/master/iot/%E8%AE%B0%E4%B8%80%E6%AC%A1%E9%85%92%E5%BA%97wifi%E8%AE%BE%E5%A4%87%E5%88%86%E6%9E%90.md)

---

[Read more](https://github.com/mr-xn/penetration_testing_poc)
下载工具
Penetration_Testing_POC

最受欢迎
