brownfinesecurity/iothackbot
13 skills1.2k installs10.5k starsGitHub
Install
npx skills add https://github.com/brownfinesecurity/iothackbotSkills in this repo
1Apktoolapktool is a security-focused skill that guides reverse engineering of Android APK files with the apktool CLI. It walks through decoding resources to near-original form, extracting a readable AndroidManifest.xml, disassembling DEX to smali bytecode, and repackaging modified APKs. Security engineers use it when assessing mobile app internals, hunting vulnerabilities, or inspecting manifest permissions, exported components, and hardcoded secrets. The workflow assumes apktool and a JRE are installed locally and targets static decode, analyze, and rebuild cycles rather than dynamic runtime instrumentation.424installs2Jadxjadx is an agent skill from brownfinesecurity/iothackbot that guides decompilation of Android APK files using JADX to convert DEX bytecode into readable Java source code. Unlike apktool which outputs smali, jadx produces clean Java that security engineers can search for hardcoded credentials, trace API calls, map authentication flows, and identify vulnerable logic during IoT or mobile security reviews. Developers reach for jadx before releasing Android apps, during penetration tests, or in incident response when APK behavior must be understood without original source access. The skill activates when tasks involve decompiling APK files, analyzing app internals, searching for secrets, or understanding third-party Android binary behavior through readable source. Invoke when asked to decompile an APK, analyze Android app logic with jadx, or hunt hardcoded keys and vulnerable code paths in mobile binaries.372installs3NmapSecurity skill that drives nmap reconnaissance for IoT and edge devices: host discovery, port scans, service/version detection, and optional NSE scripts. It structures commands, interprets results, and prioritizes exposed services so teams audit networks, harden firmware endpoints, and document risks before shipping connected products.122installs4TelnetshellThis skill interacts with IoT device shells accessible over telnet for penetration testing. A developer uses it to enumerate network-accessible devices, test weak or missing authentication, and run post-exploitation commands. It bundles telnet_helper.py, which cleans output, detects device prompts, supports batch command files, and logs all I/O to /tmp/telnet_session.log.39installs5OnvifscanThis skill drives the onvifscan tool to assess the security of IP cameras and ONVIF-enabled devices. A developer uses it to test ONVIF endpoints for unauthenticated access with a non-destructive auth scan, or to brute-force credentials on protected endpoints. Brute forcing is rate-limited to avoid overloading the device.38installs6PicocomThis skill uses picocom to interact with IoT device UART consoles over a USB-to-serial connection for penetration testing. A developer uses it to enumerate embedded devices, interact with bootloaders, and gain shell access during hardware security testing. It ships a Python serial_helper.py that cleans output, detects prompts, and logs every session to /tmp/serial_session.log for observation.37installs7ChipsecThis skill uses Intel's chipsec framework to statically analyze UEFI/BIOS firmware dumps offline. A developer uses it to scan .bin/.rom/.fd/.cap files for known malware and rootkits, generate hashed EFI executable inventories, extract NVRAM variables, and parse SPI flash descriptors. It focuses on offline analysis that needs no hardware or kernel driver access.36installs8FfindThis skill drives the ffind tool to analyze files with advanced type detection and extract embedded filesystems from firmware. A developer uses it to identify file types in a firmware image and extract ext2/3/4 or F2FS filesystems for deeper analysis. It is designed for firmware and IoT device reverse engineering.36installs9IotnetThis skill drives the iotnet tool to analyze network traffic and detect IoT protocols and security vulnerabilities. A developer uses it on PCAP files or live captures to identify protocols like MQTT, CoAP, and Zigbee, and to flag unencrypted communications, weak authentication, and plaintext credentials. It reports vulnerabilities with severity levels and remediation guidance.35installs10NetflowsThis skill drives the netflows tool to extract network flows from packet captures with automatic DNS hostname resolution. A developer uses it to enumerate the destinations a device contacts, resolve IPs to hostnames from the capture's own DNS responses, and filter flows by source IP. It is useful for IoT device profiling, network forensics, and identifying C2 or exfiltration endpoints.33installs11WsdiscoveryThis skill runs a WS-Discovery protocol scanner to discover and enumerate ONVIF cameras and other IoT devices on a network. A developer uses it during reconnaissance to find network video recorders and cameras that advertise themselves via WS-Discovery. It extracts device details like IP, UUID, manufacturer, firmware version, and service endpoints (XAddrs) for further testing.33installs12LogicmsoThis skill analyzes digital and analog captures from Saleae Logic MSO devices using the saleae-mso-api Python library. A developer uses it to load binary exports, analyze signal transitions and pulse durations, and decode protocols like UART, SPI, and I2C. It is aimed at CTF challenges, hardware reverse engineering, and protocol decoding.31installs13JtagprobeThis skill drives the jtagprobe tool with a SEGGER J-Link to test whether an embedded target's SWD/JTAG debug interface is exposed. A developer uses it during a hardware pentest to classify debug access as OPEN, LOCKED, or DEAD, identify the silicon vendor from DPIDR/IDCODE, and confirm halt plus memory access. It captures per-attempt evidence for writeups mapped to CWE-1191 and CWE-1244.11installs