Does Metasploit have functionality to demo penetration testing on Smart Meter or Zigbee?

closed as off-topic by schroeder, RoraΖ, Lucas Kauffman, Mark, Graham Hill May 13 '15 at 11:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, RoraΖ, Lucas Kauffman, Mark, Graham Hill
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    Metasploit modules exploits services rather than products. Smart meter is an embedded device while Zigbee is a protocol suite. A lot of embedded devices can be exploited e.g. home routers by exploiting the services running in them such as HTTP, SNMP etc. – void_in May 12 '15 at 14:13
  • You must be thinking of Killerbee -- code.google.com/p/killerbee/wiki/GettingStarted – atdre May 12 '15 at 15:57
  • Contact Metasploit for a list of available modules: rapid7.com/db/modules – schroeder May 12 '15 at 17:16

The Short answer is Yes, however, like most IoT Devices, you would not be exploiting hardware-specific vulnerabilities, you would likely need to focus on services running on those devices.

For example if a IoT device connects to a remote server to store captured data into a Database, your could easily research current vulnerabilities that apply to that Database Software.

In order to find out what Services are running on a device connected to an IP-Based Network, you would need to simply run a IP/Port/Service scan while connected to the same network. After a scan is successful, then you may use MetaSploit to execute a payload against the Network or Device.

  • 1
    Also majority of embedded device vulnerabilities include backdoor/service accounts, hard coded passwords for root, unauthenticated access to supposedly restricted and admin areas etc. Don't assume exploitation only means traditional memory corruptions as reverse engineering the firmware will almost always give juicy information. – void_in May 12 '15 at 17:05
  • 1
    Nice point ! Pen testing also includes identifying hard coded passwords and similar kind of issues ! – Irene May 13 '15 at 13:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.