OWASP FSTM provides a comprehensive nine-stage methodology to guide security professionals in conducting thorough firmware security assessments.
The Firmware Security Testing Methodology (FSTM) is composed of nine stages tailored to enable security researchers, software developers, consultants, and Information Security professionals with conducting firmware security assessments.
This methodology is designed for security researchers, software developers, consultants, and information security professionals who need a structured approach to assess firmware security. It is used to systematically gather information, analyze, emulate, and exploit firmware to identify vulnerabilities and improve device security.
This repository provides a methodology rather than executable tools; users should leverage the recommended EmbedOS VM for practical firmware testing tools. The methodology emphasizes thorough information gathering and collaboration with product teams for effective assessments. Users should stay updated via the OWASP IoT Project for methodology improvements.
Download the preconfigured Ubuntu virtual machine EmbedOS from https://tinyurl.com/EmbedOS-2020
Refer to the EmbedOS GitHub repository at https://github.com/scriptingxss/EmbedOS for tool details and setup
Use the methodology documentation as a guide for manual and automated firmware security assessments