# Awesome Connected Things Security [![Awesome](https://awesome.re/badge-flat2.svg)](https://awesome.re)

面向 IoT、嵌入式、工业与汽车系统的安全研究与漏洞利用技术。

<p align="center">
  <a href="https://github.com/V33RU/awesome-connected-things-sec">
    <img src="https://assets.kitploit.com/production/public/readmes/48362/e2bdf22a796f2bdbfac266212c1887ee624b3bdffb853ca5b2484dd1357cde77.png" width="900"/>
  </a>
</p>

<p align="center">
  <img src="https://img.shields.io/github/stars/V33RU/awesome-connected-things-sec?style=flat-square&amp;logo=github&amp;label=Stars&amp;color=gold"/>
  <img src="https://img.shields.io/github/forks/V33RU/awesome-connected-things-sec?style=flat-square&amp;logo=git&amp;label=Forks&amp;color=blue"/>
  <img src="https://img.shields.io/github/last-commit/V33RU/awesome-connected-things-sec?style=flat-square&amp;label=Updated&amp;color=red"/>
  <img src="https://img.shields.io/badge/Resources-900+-blueviolet?style=flat-square"/>
</p>

<p align="center">
  <img src="https://readme-typing-svg.demolab.com?font=Fira+Code&amp;weight=600&amp;size=22&amp;pause=1000&amp;color=58A6FF%C2%A2er=true&amp;vCenter=true&amp;random=false&amp;width=600&amp;lines=Firmware+%E2%80%A2+Wireless+%E2%80%A2+Hardware+%E2%80%A2+Protocols;UART+%E2%86%92+JTAG+%E2%86%92+SWD+%E2%86%92+Firmware+%E2%86%92+Root;Hack+The+Planet,+One+Device+At+A+Time" alt="Typing SVG" />
</p>

<br/>

<p align="center">
  <a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/ICS/Industrial-Control-Systems.md"><img src="https://img.shields.io/badge/%F0%9F%8F%AD_ICS-SCADA_&amp;_OT-ff6b6b?style=for-the-badge"/></a>&nbsp;
  <a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/Automotive/automotive-security.md"><img src="https://img.shields.io/badge/%F0%9F%9A%97_AUTO-CAN_&amp;_ECU-4ecdc4?style=for-the-badge"/></a>&nbsp;
  <a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/Robotics/robotics-security.md"><img src="https://img.shields.io/badge/%F0%9F%A4%96_ROBOTICS-ROS_&amp;_DDS-8b5cf6?style=for-the-badge"/></a>&nbsp;
  <a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/docs/awesome-collection.md"><img src="https://img.shields.io/badge/%F0%9F%93%9A_AWESOME-COLLECTION-a855f7?style=for-the-badge"/></a>&nbsp;
  <a href="https://github.com/V33RU/awesome-connected-things-sec/blob/main/contributing.md"><img src="https://img.shields.io/badge/%F0%9F%A4%9D_CONTRIBUTE-JOIN_US-f59e0b?style=for-the-badge"/></a>
</p>

<br/>

<p align="center">
  <a href="#hardware-attacks"><img src="https://img.shields.io/badge/%E2%9A%A1_Hardware-Hacking-dc2626?style=flat-square"/></a>&nbsp;
  <a href="#bluetooth--ble"><img src="https://img.shields.io/badge/%F0%9F%93%B6_Bluetooth-BLE-2563eb?style=flat-square"/></a>&nbsp;
  <a href="#firmware-security"><img src="https://img.shields.io/badge/%F0%9F%92%BE_Firmware-Analysis-16a34a?style=flat-square"/></a>&nbsp;
  <a href="#wireless-protocols"><img src="https://img.shields.io/badge/%F0%9F%93%A1_Wireless-Protocols-9333ea?style=flat-square"/></a>&nbsp;
  <a href="#tools"><img src="https://img.shields.io/badge/%F0%9F%9B%A0%EF%B8%8F_Tools-Arsenal-ea580c?style=flat-square"/></a>&nbsp;
  <a href="#labs-and-ctfs"><img src="https://img.shields.io/badge/%F0%9F%8E%AE_Labs-CTFs-0891b2?style=flat-square"/></a>
</p>

<br/>

<p align="center">
  <a href="https://t.me/iotsrg"><img src="https://img.shields.io/badge/Telegram-26A5E4?style=for-the-badge&amp;logo=telegram&amp;logoColor=white"/></a>&nbsp;
  <a href="https://discord.gg/EH9dxT9"><img src="https://img.shields.io/badge/Discord-5865F2?style=for-the-badge&amp;logo=discord&amp;logoColor=white"/></a>&nbsp;
  <a href="https://twitter.com/v33riot"><img src="https://img.shields.io/badge/Twitter-1DA1F2?style=for-the-badge&amp;logo=twitter&amp;logoColor=white"/></a>&nbsp;
  <a href="https://www.linkedin.com/in/veeraiot"><img src="https://img.shields.io/badge/LinkedIn-0A66C2?style=for-the-badge&amp;logo=linkedin&amp;logoColor=white"/></a>
</p>

---

## 目录

- [硬件攻击](#hardware-attacks)
  - [基础知识](#fundamentals)
  - [接口攻击](#interface-attacks)
  - [内存提取](#memory-extraction)
  - [侧信道与故障注入](#side-channel-and-fault-injection)
  - [PCIe 与 DMA 攻击](#pcie-and-dma-attacks)
- [无线协议](#wireless-protocols)
  - [射频基础知识](#rf-fundamentals)
  - [蓝牙 / BLE](#bluetooth--ble)
  - [Zigbee / Z-Wave](#zigbee--z-wave)
  - [LoRa / LoRaWAN](#lora--lorawan)
  - [Matter / Thread](#matter--thread)
  - [蜂窝网络（GSM/LTE/5G）](#cellular-gsmlte5g)
  - [NFC/RFID](#nfcrfid)
  - [DECT（数字增强无线通信）](#dect-digital-enhanced-cordless-telecommunications)
  - [Wi-Fi](#wi-fi)
  - [USB](#usb)
  - [UWB（超宽带）](#uwb-ultra-wideband)
  - [TETRA](#tetra)
- [固件安全](#firmware-security)
  - [基础知识](#fundamentals-1)
  - [提取](#extraction)
  - [静态分析工具](#static-analysis-tools)
  - [动态分析与仿真](#dynamic-analysis-and-emulation)
  - [OTA 更新安全](#ota-update-security)
  - [RTOS 安全](#rtos-security)
  - [逆向工程工具](#reverse-engineering-tools)
  - [在线汇编器](#online-assemblers)
  - [ARM 漏洞利用](#arm-exploitation)
  - [二进制分析](#binary-analysis)
  - [安全启动](#secure-boot)
  - [UEFI 安全](#uefi-security)
  - [符号链接攻击](#symlink-attacks)
  - [路由器固件分析](#router-firmware-analysis)
  - [路由器漏洞利用](#router-exploitation)
  - [安全启动绕过](#secure-boot-bypasses)
- [网络与 Web 协议](#network-and-web-protocols)
  - [MQTT](#mqtt)
  - [CoAP](#coap)
  - [mTLS](#mtls)
  - [IoT 协议概述](#iot-protocols-overview)
- [云与后端安全](#cloud-and-backend-security)
  - [AWS IoT 安全](#aws-iot-security)
  - [Firebase / 云配置错误](#firebase--cloud-misconfigurations)
- [移动应用安全](#mobile-application-security)
  - [Android](#android)
  - [iOS](#ios)
- [工业与汽车](#industrial-and-automotive)
  - [ICS/SCADA](#icsscada)
  - [汽车安全](#automotive-security)
  - [电动汽车充电桩](#ev-chargers)
- [支付系统](#payment-systems)
  - [ATM 黑客攻击](#atm-hacking)
  - [支付村](#payment-village)
- [工具](#tools)
  - [硬件工具](#hardware-tools)
  - [软件工具](#software-tools)
  - [模糊测试工具](#fuzzing-tools)
  - [渗透测试操作系统](#pentesting-operating-systems)
  - [搜索引擎](#search-engines)
- [防御性安全](#defensive-security)
  - [威胁建模](#threat-modeling)
  - [安全开发](#secure-development)
  - [事件响应](#incident-response)
- [学习资源](#learning-resources)
  - [培训平台](#training-platforms)
  - [速查表](#cheatsheets)
  - [漏洞指南](#vulnerability-guides)
  - [渗透测试指南](#pentesting-guides)
  - [YouTube 频道](#youtube-channels)
  - [书籍](#books)
  - [IoT 系列](#iot-series)
- [实验环境与 CTF](#labs-and-ctfs)
  - [易受攻击的应用程序](#vulnerable-applications)
  - [CTF 竞赛](#ctf-competitions)
  - [持续学习平台](#continuous-learning-platforms)
  - [实验环境搭建](#lab-setup)
- [研究与社区](#research-and-community)
  - [技术研究](#technical-research)
  - [博客](#blogs)
  - [社区平台](#community-platforms)
  - [Village](#villages)
  - [值得关注的研究人员](#researchers-to-follow)
  - [特定设备研究](#device-specific-research)
  - [TrustZone 与 TEE 研究](#trustzone-and-tee-research)
  - [Pwn2Own 研究](#pwn2own-research)
- [MCP / AI 智能体](#mcp--ai-agent)
  - [蓝牙逆向工程](#bluetooth-reverse-engineering)

## 硬件攻击

### 基础知识

- [IoT 硬件指南](https://www.postscapes.com/internet-of-things-hardware/)
- [硬件黑客入门 - 提取你的第一个固件](https://web.archive.org/web/2021/https://blog.nvisium.com/intro-to-hardware-hacking-dumping-your-first-firmware)
- [硬件黑客入门简介](https://securityboulevard.com/2020/09/an-introduction-to-hardware-hacking/)
- [用于 IoT 安全分析的硬件工具包](https://web.archive.org/web/2020/https://defcon-nn.ru/0x0B/Hardware%20toolkits%20for%20IoT%20security%20analysis.pdf)
- [IoT 设备硬件黑客 - 攻击性 IoT 漏洞利用](https://www.infosecinstitute.com/resources/hacking/hardware-hacking-iot-devices-offensive-iot-exploitation/)

### 接口攻击

#### UART

- [识别 UART 接口](https://www.mikroe.com/blog/uart-serial-communication)
- [串口终端基础](https://learn.sparkfun.com/tutorials/terminal-basics/all)
- [逆向工程串口](https://www.devttys0.com/2012/11/reverse-engineering-serial-ports/)
- [嵌入式逆向工程入门：通过 UBoot 发现 UART 并提取固件](https://voidstarsec.com/blog/uart-uboot-and-usb)
- [使用 UART 连接中国 IP 摄像头](https://www.davidsopas.com/using-uart-to-connect-to-a-chinese-ip-cam/)
- [IoT 硬件黑客之旅：UART](https://techblog.mediaservice.net/2019/03/a-journey-into-iot-hardware-hacking-uart/)
- [通过 UART 访问和提取固件](https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-and-where-to-find-them-part-1)
- [Linksys e1000 上的 UART 连接与动态分析](https://www.youtube.com/watch?v=ix6rSV2Dj44)

#### JTAG

- [硬件黑客 101：JTAG 简介](https://www.riverloopsecurity.com/blog/2021/05/hw-101-jtag/)
- [如何找到 JTAG 接口](https://www.youtube.com/watch?v=_FSM_10JXsM)
- [分析 JTAG](https://nse.digital/pages/guides/hardware/jtag.html)
- [使用 OpenOCD 进行 Bus Pirate JTAG 连接](https://web.archive.org/web/2020/https://research.kudelskisecurity.com/2014/05/01/jtag-debugging-made-easy-with-bus-pirate-and-openocd/)
- [通过 JTAG 从外部存储器提取固件](https://www.youtube.com/watch?v=IadnBUJAvks)
- [iPhone Lightning 与 JTAG 黑客指南](https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/stacksmashing%20-%20The%20hitchhackers%20guide%20to%20iPhone%20Lightning%20%26%20JTAG%20hacking.pdf)
- [通过 JTAG 调试 AVR 微控制器](https://hev0x.github.io/posts/debugging-avr-with-atmelice-and-gdb/)

#### SWD（串行线调试）

- [SWD 协议概述 - HardBreak Wiki](https://www.hardbreak.wiki/hardware-hacking/interface-interaction/jtag-swd/swd)
- [揭示漏洞：探索硬件中的 SWD 攻击面](https://web.archive.org/web/2024/https://redfoxsec.com/blog/unveiling-vulnerabilities-exploring-swd-attack-surface-in-hardware/)
- [ARM 串行线调试协议简介](https://developer.arm.com/documentation/ihi0031/a/The-Serial-Wire-Debug-Port--SW-DP-/Introduction-to-the-ARM-Serial-Wire-Debug--SWD--protocol)
- [串行线调试与 CoreSight 架构](https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imxrt/4786/2/Serial_Wire_Debug.pdf)
- [LibSWD - 串行线调试开源库](https://github.com/cederom/LibSWD)
- [硬件黑客与漏洞利用训练营 - SWD](https://happeningnext.com/event/hardware-hacking-and-exploitation-bootcamp-eid4sntq7lbas1)

#### SPI

- [硬件黑客入门 101：识别并转储 eMMC 闪存](https://www.riverloopsecurity.com/blog/2020/03/hw-101-emmc/)
- [使用 Bus Pirate - SPI 从路由器转储固件](https://www.iotpentest.com/2019/06/dumping-firmware-from-device-using.html)
- [通过 SPI 提取闪存](https://web.archive.org/web/2023/https://akimbocore.com/article/extracting-flash-memory-over-spi/)
- [从嵌入式设备提取固件（SPI NOR 闪存）](https://www.youtube.com/watch?v=nruUuDalNR0)
- [如何使用编程器刷写路由器芯片](https://www.youtube.com/watch?v=fbt4OJXJdOc)
- [TPM 2.0：通过 SPI 提取 Bitlocker 密钥](https://lucasteske.dev/2024/01/tpm2-bitlocker-keys)

#### I2C

- [物联网安全第 16 部分：硬件攻击面 I2C](https://payatu.com/masterclass/iot-security-part-16-101-hardware-attack-surface-i2c/)
- [I2C 利用 - HackTricks](https://book.hacktricks.xyz/todo/hardware-hacking/i2c)
- [非侵入式 I2C 硬件木马攻击向量（PDF）](https://hal.science/hal-03703165/document)
- [硬件黑客：使用 Bus Pirate 进行 I2C 注入](https://www.rockfishsec.com/2014/09/hardware-hacking-i2c-injection-with-bus.html)
- [保护 SPI、I2C 和 I3C 协议](https://ez.analog.com/ez-blogs/b/engineering-mind/posts/do-your-embedded-systems-safeguard-against-threats-to-spi-i2c-and-i3c)

#### TPM

- [TPM（可信平台模块）简介](https://sergioprado.blog/introduction-to-tpm-trusted-platform-module/)
- [可信平台模块安全性在 30 分钟内被攻破](https://arstechnica.com/gadgets/2021/08/how-to-go-from-stolen-pc-to-network-intrusion-in-30-minutes/)

### 内存提取

#### eMMC

- [eMMC 协议](https://prodigytechno.com/emmc-protocol/)
- [RPMB：eMMC 内部的秘密区域](https://sergioprado.blog/rpmb-a-secret-place-inside-the-emmc/)
- [从损坏的智能手机中恢复 eMMC 数据](https://dangerouspayload.com/2018/10/24/emmc-data-recovery-from-damaged-smartphone/)
- [释放你的智能家居设备：吸尘机器人黑客攻击](https://media.ccc.de/v/34c3-9147-unleash_your_smart-home_devices_vacuum_cleaning_robot_hacking)
- [动手物联网黑客：Rapid7 在 DEF CON 30](https://www.rapid7.com/blog/post/2022/10/18/hands-on-iot-hacking-rapid7-at-def-con-30-iot-village-part-1/)

### 侧信道与故障注入

#### 基础

- [侧信道攻击 - Yifan Lu](https://yifan.lu/)
- [安全系统实现的攻击](https://github.com/Yossioren/AttacksonImplementationsCourseBook)
- [模糊测试、二进制分析、物联网安全合集](https://github.com/0xricksanchez/paper_collection)

#### 毛刺攻击

- [针对 Wink Hub 的 NAND 毛刺攻击](https://www.brettlischalk.com/posts/nand-glitching-wink-hub-for-root)
- [使用 Crowbars 进行电压毛刺教程](https://chipwhisperer.readthedocs.io/en/latest/tutorials.html)
- [使用 iCEstick Glitcher 进行电压毛刺攻击](https://www.youtube.com/watch?v=FVUhVewFmxw)
- [FPGA 毛刺与侧信道攻击 - Samy Kamkar](https://www.youtube.com/watch?v=oGndiX5tvEk)
- [硬件电源毛刺攻击 - rhme2](https://www.youtube.com/watch?v=6Pf3pY3GxBM)
- [闪存中的密钥 - 从 Arduino 毛刺提取 AES 密钥](https://srfilipek.medium.com/keys-in-a-flash-3e984d0de54b)
- [实施实用的电气毛刺攻击](https://blackhat.com/docs/eu-15/materials/eu-15-Giller-Implementing-Electrical-Glitching-Attacks.pdf)
- [如何进行电压故障注入](https://www.synacktiv.com/publications/how-to-voltage-fault-injection)
- [Glitcher 第 1 部分 - 在 STM32 微控制器上可复现的电压毛刺](https://sec-consult.com/blog/detail/secglitcher-part-1-reproducible-voltage-glitching-on-stm32-microcontrollers/)
- [STM32L05 电压毛刺](https://blog.syss.com/posts/voltage-glitching-the-stm32l05-microcontroller/)

#### 功耗分析

- [使用 ChipWhisperer 破解 AES](https://www.youtube.com/watch?v=FktI4qSjzaE)
- [ChipWhisperer Wiki](https://chipwhisperer.readthedocs.io/)
- [利用 Rowhammer 位翻转窃取加密密钥](https://arstechnica.com/information-technology/2019/06/researchers-use-rowhammer-bitflips-to-steal-2048-bit-crypto-key/)

#### 其他微控制器

- [转储 Amlogic A113X Bootrom](https://haxx.in/posts/dumping-the-amlogic-a113x-bootrom/)
- [重探 AMLogic A113X TrustZone 漏洞利用过程](https://boredpentester.com/retreading-the-amlogic-a113x-trustzone-exploit-process/)
- [逆向工程一个未知微控制器](https://dmitry.gr/?r=05.Projects&proj=30.%20Reverse%20Engineering%20an%20Unknown%20Microcontroller)
- [通过 USB 入侵微控制器固件](https://securelist.com/hacking-microcontroller-firmware-through-a-usb/89919/)
- [你的 SoC 中有一个漏洞：对 MediaTek BootROM 进行故障注入](https://research.nccgroup.com/2020/10/15/theres-a-hole-in-your-soc-glitching-the-mediatek-bootrom/)

### PCIe 与 DMA 攻击

- [面向 Windows 完全初学者的 PCIe 实用教程 - 第 1 部分](https://ctf.re/windows/kernel/pcie/tutorial/2023/02/14/pcie-part-1/)
- [面向 Windows 完全初学者的 PCIe 实用教程 - 第 2 部分](https://ctf.re/kernel/pcie/tutorial/dma/mmio/tlp/2024/03/26/pcie-part-2/)
- [针对受保护 Jetson Nano 的 PCIe DMA 攻击（CVE-2022-21819）](https://www.thegoodpenguin.co.uk/blog/pcie-dma-attack-against-a-secured-jetson-nano-cve-2022-21819/)


---

## 无线协议

### 射频基础

- [软件定义无线电完整课程 - Michael Ossmann](https://greatscottgadgets.com/sdr/)
- [理解无线电](https://www.taitradioacademy.com/lessons/introduction-to-radio-communications-principals/)
- [软件定义无线电简介](https://www.allaboutcircuits.com/technical-articles/introduction-to-software-defined-radio/)
- [GNU Radio Companion 简介](https://wiki.gnuradio.org/index.php/Guided_Tutorial_GRC)
- [在 GNU Radio Companion 中创建流图](https://blog.didierstevens.com/2017/09/19/quickpost-creating-a-simple-flow-graph-with-gnu-radio-companion/)
- [分析 433MHz 无线电信号](https://www.rtl-sdr.com/analyzing-433-mhz-transmitters-rtl-sdr/)
- [录制特定无线电信号](https://www.rtl-sdr.com/freqwatch-rtl-sdr-frequency-scanner-recorder/)
- [使用 Raspberry Pi 和 rpitx 进行重放攻击](https://www.rtl-sdr.com/tutorial-replay-attacks-with-an-rtl-sdr-raspberry-pi-and-rpitx/)
- [逆向工程汽车钥匙遥控信号](https://0x44.cc/radio/2024/03/13/reversing-a-car-key-fob-signal.html)
- [GRCON 2021 - 捕获信号](https://blog.tclaverie.eu/posts/grcon-2021---capture-the-signal/)

### 蓝牙 / BLE

#### 基础

- [Awesome Bluetooth Security](https://github.com/engn33r/awesome-bluetooth-security)
- [蓝牙微微网中的流量工程](https://www.diva-portal.org/smash/record.jsf?pid=diva2%3A833159)
- [BLE 特征：初学者教程](https://devzone.nordicsemi.com/nordic/short-range-guides/b/bluetooth-low-energy/posts/ble-characteristics-a-beginners-tutorial)
- [蓝牙低功耗简介（PDF）](https://daskalakispiros.com/files/Ebooks/Intro+to+Bluetooth+Low+Energy+v1.1.pdf)
- [蓝牙 LE 安全学习指南](https://www.bluetooth.com/bluetooth-resources/le-security-study-guide/)
- [逆向工程 BLE 设备](https://reverse-engineering-ble-devices.readthedocs.io/en/latest/)
- [我的智能手环逆向工程之旅 - 蓝牙 LE 逆向工程](https://medium.com/@arunmag/my-journey-towards-reverse-engineering-a-smart-band-bluetooth-le-re-d1dea00e4de2)

#### 利用技术

- [Intel Edison 作为蓝牙低功耗漏洞利用盒](https://medium.com/@arunmag/intel-edison-as-bluetooth-le-exploit-box-a63e4cad6580)
- [逆向工程并利用智能按摩器](https://medium.com/@arunmag/how-i-reverse-engineered-and-exploited-a-smart-massager-ee7c9f21bf33)
- [我入侵了 MiBand 3](https://medium.com/@yogeshojha/i-hacked-xiaomi-miband-3-and-here-is-how-i-did-it-43d68c272391)
- [GATTacking 蓝牙智能设备](https://securing.pl/en/gattacking-bluetooth-smart-devices-introducing-a-new-ble-proxy-tool/index.html)
- [检视 August 智能锁](https://blog.quarkslab.com/examining-the-august-smart-lock.html)
- [BLE GATT 逆向工程实践入门](https://jcjc-dev.com/2023/03/19/reversing-domyos-el500-elliptical/)
- [MojoBox - 又一个不那么智能的锁](https://mandomat.github.io/2023-03-15-testing-mojobox-security/)
- [蓝牙智能锁](https://www.getkisi.com/blog/smart-locks-hacked-bluetooth-ble)
- [蓝牙信标漏洞](https://www.beaconzone.co.uk/blog/category/security/)
- [拒绝愉悦：使用 Flipper Zero 攻击不寻常的 BLE 目标](https://www.whid.ninja/blog/denial-of-pleasure-attacking-unusual-ble-targets-with-a-flipper-zero)
- [侠盗猎车手：BLE 中继攻击一瞥](https://rollingpwn.github.io/BLE-Relay-Aattck/)
- [我如何入侵智能灯：CVE-2022-47758](https://pwning.tech/cve-2022-47758/)

#### 漏洞研究

- [在蓝牙中发现漏洞](https://bluetooth.lol/)
- [Sweyntooth 漏洞](https://asset-group.github.io/disclosures/sweyntooth/)
- [BrakTooth：对蓝牙链路管理器造成严重破坏](https://asset-group.github.io/disclosures/braktooth/)
- [BLUFFS：蓝牙前向与未来保密性攻击（CVE-2023-24023）](https://github.com/francozappa/bluffs)
- [AirDrop 泄露 - 嗅探 Apple 设备的 BLE 流量](https://github.com/hexway/apple_bleee)
- [BleedingTooth：Linux 蓝牙零点击远程代码执行](https://google.github.io/security-research/pocs/linux/bleedingtooth/writeup.html)
- [BRAKTOOTH：对蓝牙链路管理器造成严重破坏（PDF）](https://asset-group.github.io/disclosures/braktooth/braktooth.pdf)
- [Norec 攻击：剥离 Nordic 库中的 BLE 加密（CVE-2020-15509）](https://infosecwriteups.com/norec-attack-stripping-ble-encryption-from-nordics-library-cve-2020-15509-9798ab893b95)
- [BlueDucky - 对未修补 Android 的 HID 注入（CVE-2023-45866）](https://github.com/pentestfunctions/BlueDucky)
- [Microsoft 蓝牙驱动程序欺骗 - CVE-2024-21306](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21306)
- [蓝牙 Auracast / LE Audio 安全分析](https://www.bluetooth.com/learn-about-bluetooth/recent-enhancements/le-audio/)

#### 会议演讲

- [Blue2thprinting：我到底在看什么？](https://darkmentor.com/publication/2023-11-hardweario/)
- [未愈合的伤口：过去 5 年让蓝牙持续流血](https://darkmentor.com/publication/2023-10-hacklu/)
- [疫情期间隔着口罩嗅探蓝牙](https://darkmentor.com/publication/2023-08-hitb/)

#### 工具 - 软件

- [Bluing - 蓝牙情报收集](https://github.com/fO-000/bluing)
- [BlueToolkit - 蓝牙经典漏洞测试](https://github.com/sgxgsx/BlueToolkit)
- [btproxy](https://github.com/conorpp/btproxy)
- [hcitool 和 bluez](https://www.pcsuggest.com/linux-bluetooth-setup-hcitool-bluez)
- [使用 GATT Tool 进行测试](https://www.jaredwolff.com/blog/get-started-with-bluetooth-low-energy/)
- [crackle - 破解 BLE 加密](https://github.com/mikeryan/crackle)
- [bettercap](https://github.com/bettercap/bettercap)
- [GATTacker](https://github.com/securing/gattacker)
- [BTLEjack - BLE 瑞士军刀](https://github.com/virtualabs/btlejack)
- [DEDSEC 蓝牙漏洞利用](https://github.com/0xbitx/DEDSEC-Bluetooth-exploit)
- [BrakTooth ESP32 PoC](https://github.com/Matheus-Garbelini/braktooth_esp32_bluetooth_classic_attacks)
- [SweynTooth BLE 攻击](https://github.com/Matheus-Garbelini/sweyntooth_bluetooth_low_energy_attacks)
- [ESP32 蓝牙经典嗅探器](https://github.com/Matheus-Garbelini/esp32_bluetooth_classic_sniffer)
- [蓝牙黑客工具合集](https://github.com/zedxpace/bluetooth-hacking-)

#### 工具 - 硬件

- [nRF52840 Dongle](https://www.nordicsemi.com/Software-and-tools/Development-Kits/nRF52840-Dongle)
- [Ubertooth One](https://github.com/greatscottgadgets/ubertooth/wiki/Ubertooth-One)
- [CSR 4.0 蓝牙适配器](https://www.amazon.in/GENERIC-Ultra-Mini-Bluetooth-Dongle-Adapter/dp/B0117H7GZ6/)
- [ESP32](https://www.espressif.com/en/products/hardware/esp32/overview)
- [Sena UD100](https://web.archive.org/web/2020/http://www.senanetworks.com/ud100-g03.html)
- [ESP-WROVER-KIT](https://www.digikey.in/en/products/detail/espressif-systems/ESP-WROVER-KIT-VB/8544301)

#### 工具

- [ice9-bluetooth-sniffer](https://github.com/mikeryan/ice9-bluetooth-sniffer)
- [InternalBlue - 蓝牙实验框架](https://github.com/seemoo-lab/internalblue)

#### 入侵蓝牙咖啡机

- [通过 GitHub Actions 入侵蓝牙煮咖啡 - 第 1 部分](https://grack.com/blog/2022/12/01/hacking-bluetooth-to-brew-coffee-on-github-actions-part-1/)
- [通过 GitHub Actions 入侵蓝牙煮咖啡 - 第 2 部分](https://grack.com/blog/2022/12/02/hacking-bluetooth-to-brew-coffee-on-github-actions-part-2/)
- [通过 GitHub Actions 入侵蓝牙煮咖啡 - 第 3 部分](https://grack.com/blog/2022/12/04/hacking-bluetooth-to-brew-coffee-on-github-actions-part-3/)

### Zigbee / Z-Wave

#### 基础知识

- [简介与协议概述](http://www.informit.com/articles/article.aspx?p=1409785)
- [ZigBee 与 Z-Wave 安全简报](http://www.riverloopsecurity.com/blog/2018/05/zigbee-zwave-part1/)
- [入侵 ZigBee 网络](https://www.infosecinstitute.com/resources/hacking/hacking-zigbee-networks/)

#### 漏洞利用

- [使用 Attify Zigbee 框架入侵 IoT 设备](https://blog.attify.com/hack-iot-devices-zigbee-sniffing-exploitation/)
- [Zigator：分析 Zigbee 智能家居的安全性](https://mews.sv.cmu.edu/papers/wisec-20.pdf)
- [使用 Zigator 和 GNU Radio 对 Zigbee 进行安全分析](https://mews.sv.cmu.edu/research/zigator/testbed-grcon2020-slides.pdf)
- [低成本 ZigBee 选择性干扰](https://www.bastibl.net/reactive-zigbee-jamming/)

#### 工具 - 软件

- [Killerbee](https://github.com/riverloopsec/killerbee)
- [ZigDiggity](https://github.com/BishopFox/zigdiggity)
- [Zigator](https://github.com/akestoridis/zigator)
- [Z3sec](https://github.com/IoTsec/Z3sec)
- [zigbear](https://github.com/philippnormann/zigbear)

#### 工具 - 硬件

- [ApiMote](https://www.riverloopsecurity.com/projects/apimote/)
- [RaspBee](https://phoscon.de/en/raspbee/)
- [ATUSB IEEE 802.15.4 适配器](http://shop.sysmocom.de/products/atusb)
- [USRP](https://www.ettus.com/products/)

### LoRa / LoRaWAN

- [LoRaWAN 安全概述 - Tektelic](https://tektelic.com/expertise/lorawan-security/)
- [LoRaWAN 中的安全漏洞](https://www.cyber-threat-intelligence.com/publications/IoTDI2018-LoraWAN.pdf)
- [低功耗与高风险：针对 LoRaWAN 设备的攻击](https://www.trendmicro.com/en_us/research/21/a/Low-Powered-but-High-Risk-Evaluating-Possible-Attacks-on-LoRaWAN-Devices.html)
- [LAF - LoRaWAN 审计框架](https://github.com/IOActive/laf)
- [ChirpOTLE - LoRaWAN 安全框架](https://github.com/seemoo-lab/chirpotle)

#### 基础知识

- [LoRaWAN 安全调查 - ScienceDirect](https://www.sciencedirect.com/science/article/abs/pii/S2542660520301359)
- [LoRaWAN - 维基百科](https://en.wikipedia.org/wiki/LoRa)

#### 漏洞利用

- [数百万使用 LoRaWAN 的设备暴露于黑客攻击之下 - SecurityWeek](https://www.securityweek.com/millions-devices-using-lorawan-exposed-hacker-attacks/)
- [你是否盲目信任 LoRaWAN 网络？ - IOActive](https://www.ioactive.com/do-you-blindly-trust-lorawan-networks-for-iot/)
- [LoRaWAN 加密密钥易于破解 - Threatpost](https://threatpost.com/lorawan-encryption-keys-easy-to-crack-jeopardizing-security-of-iot-networks/152276/)
- [LoPT：LoRa 渗透测试工具（PDF）](https://www.ijitee.org/wp-content/uploads/papers/v8i9S2/I10810789S219.pdf)

#### 工具

- [LoRa Craft - 数据包拦截](https://github.com/PentHertz/LoRa_Craft)
- [开源 LoRaWAN 黑客工具](https://www.thethingsnetwork.org/forum/t/open-source-tool-for-hacking-auditing-and-monitoring-lorawan-networks/31185)
- [LoRaWAN Hackaday 项目](https://hackaday.com/tag/lorawan/)

### Matter / Thread

#### 基础知识

- [Matter 标准 - CSA-IoT](https://csa-iot.org/all-solutions/matter/)
- [Matter 协议维基百科](https://en.wikipedia.org/wiki/Matter_%28standard%29)
- [Matter 协议完全指南 2025](https://thinkrobotics.com/blogs/learn/matter-protocol-explained-for-smart-homes-complete-guide-2025)
- [如何使用 Matter 保护智能家居设备](https://www.iot-now.com/2022/07/12/122292-how-to-secure-smart-home-devices-with-the-matter-standard/)
- [面向 Matter 的智能家居设备解决方案 - DigiCert](https://www.digicert.com/solutions/security-solutions-for-matter-devices)

#### 安全研究

- [采用 Matter 的智能家居中的安全漏洞与攻击场景](https://www.ndss-symposium.org/wp-content/uploads/2024/07/sdiotsec2024-48-paper.pdf)
- [信任至关重要：揭示 Matter 协议中的漏洞 - Nozomi](https://www.nozominetworks.com/blog/trust-matters-uncovering-vulnerabilities-in-the-matter-protocol)
- [基于 Thread 的 Matter 安全](https://sensereo.com/community/matter-over-thread-security-how-safe-is-your-smart-home-network/)
- [物联网无线 PAN 协议安全的最新综述](https://www.mdpi.com/2073-8994/12/4/579)
- [Matter 智能家居 - Krasamo](https://www.krasamo.com/matter-smart-home/)
- [Threadbare：针对 Thread 网络的实用攻击（Black Hat USA 2024）](https://www.blackhat.com/us-24/briefings/schedule/#threadbare-practical-attacks-on-thread-networks-39616)
- [Matter 规范 1.3 - 连接标准联盟](https://csa-iot.org/developer-resource/specifications-download-request/)
- [Thread Group 安全分析](https://www.threadgroup.org/Portals/0/documents/support/ThreadCommissioningWhitePaper_2120.pdf)

### 蜂窝网络（GSM/LTE/5G）

- [Awesome Cellular Hacking](https://github.com/W00t3k/Awesome-Cellular-Hacking/)
- [GSM 安全简介](http://www.pentestingexperts.com/introduction-to-gsm-security/)
- [在第二层攻破 LTE](https://alter-attack.net/)
- [5Ghoul - 5G NR 攻击与模糊测试](https://github.com/asset-group/5ghoul-5g-nr-attacks)
- [利用 MediaTek 基带中的 CSN.1 漏洞](https://labs.taszk.io/articles/post/mtk_baseband_csn1_exploitation/)
- [SIM 卡劫持](https://sensepost.com/blog/2022/sim-hijacking/)
- [SigPloit - 电信信令利用框架](https://github.com/SigPloiter/SigPloit)
- [LTE Sniffer](https://github.com/SysSec-KAIST/LTESniffer)
- [5G NR 干扰、欺骗与嗅探](https://github.com/aligungr/UERANSIM)
- [LTrack：LTE 中移动电话的隐蔽追踪](https://www.usenix.org/conference/usenixsecurity22/presentation/kotuliak)
- [Open5GS - 开源 5G/4G 核心网](https://github.com/open5gs/open5gs)
- [SCAT - 蜂窝网络信令采集与分析工具](https://github.com/fgsect/scat)

#### 基础知识

- [GSM 安全 第 2 部分](https://web.archive.org/web/2020/https://www.ehacking.net/2011/02/gsm-security-2.html)
- [什么是基站收发信台](https://en.wikipedia.org/wiki/Base_transceiver_station)
- [SS7 信令简介](https://www.patton.com/whitepapers/Intro_to_SS7_Tutorial.pdf)
- [SS7 网络架构](https://youtu.be/pg47dDUL1T0)
- [SIGTRAN 简介](https://www.youtube.com/watch?v=XUY6pyoRKsg)

#### 漏洞利用

- [如何搭建自己的流氓 GSM 基站](https://l33t.gg/how-to-build-a-rogue-gsm-bts/)
- [使用 USRP B200 利用 GSM 漏洞](https://ieeexplore.ieee.org/document/7581461/)
- [4G（LTE）网络的安全测试](https://web.archive.org/web/2018/https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-44con-lte-presentation-2012-09-11.pdf)
- [SS7/SIGTRAN 评估案例研究](https://nullcon.net/website/archives/pdf/goa-2017/case-study-of-SS7-sigtran.pdf)

#### 工具

- [ss7MAPer - SS7 渗透测试工具包](https://n0where.net/ss7-pentesting-toolkit-ss7maper)
- [伪基站检测器 (SCL-8521)](https://www.shoghicom.com/fake-bts-detector.php)

### NFC/RFID

- [Awesome RFID/NFC 安全演讲合集](https://github.com/doegox/awesome-rfid-talks)
- [RFID Discord 群组](https://discord.gg/Z43TrcVyPr)
- [SoK：EMV 非接触式支付系统的安全性](https://arxiv.org/pdf/2504.12812)
- [针对 Tesla Model Y 的 NFC 中继攻击](https://act-on.ioactive.com/acton/attachment/34793/f-6460b49e-1afe-41c3-8f73-17dc14916847/1/-/-/-/-/NFC-relay-TESlA_JRoriguez.pdf)

### DECT（数字增强无线通信）

- [DECT 无绳电话的实时拦截](https://www.youtube.com/watch?v=MDF1eUvOte0)
- [窃听未加密的 DECT 语音流量](https://www.youtube.com/watch?v=WBvYsXrs3DI)
- [解码 DECT 语音流量：深入解析](https://www.youtube.com/watch?v=oiMkirm_xfY)

---

### Wi-Fi

#### 协议漏洞

- [构造帧：通过操纵发送队列绕过 Wi-Fi 加密](https://papers.mathyvanhoef.com/usenix2023-wifi.pdf)
- [无需流氓 AP 的中间人攻击：当 WPA 遇上 ICMP 重定向](https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf)
- [WPAxFuzz：嗅探 Wi-Fi 实现中的漏洞](https://www.mdpi.com/2410-387X/6/4/53/)
- [解开症结：攻破家庭无线网状网络的访问控制](https://www.cs.ucr.edu/%7Ezhiyunq/pub/ccs24_wireless_mesh.pdf)

#### 漏洞利用

- [Over The Air：利用 Broadcom 的 Wi-Fi 协议栈（第 1 部分）](https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html)
- [Over The Air：利用 Broadcom 的 Wi-Fi 协议栈（第 2 部分）](https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html)

---

[Read more](https://github.com/v33ru/awesome-connected-things-sec)
下载工具
最受欢迎

awesome-connected-things-sec
