A toolkit for security testing IoT devices using protocols like CoAP, MQTT, DTLS, and HTTP/2.
Cotopaxi is a security testing toolkit specifically designed for Internet of Things (IoT) devices. It provides a set of tools to test IoT devices and servers using various network protocols like CoAP, MQTT, DTLS, and HTTP/2 to identify security vulnerabilities and misconfigurations. The toolkit helps security professionals assess the security posture of IoT deployments through protocol fuzzing, vulnerability testing, and traffic analysis.
Security researchers, penetration testers, and IoT device manufacturers who need to assess the security of IoT devices and protocols. It's particularly valuable for professionals conducting authorized security assessments of IoT infrastructure.
Developers choose Cotopaxi because it offers a specialized, protocol-aware toolkit for IoT security that supports more IoT-specific protocols than general network testing tools. Its comprehensive toolset covers both client and server testing, includes a vulnerability database specific to IoT, and integrates with Metasploit for penetration testing workflows.
Set of tools for security testing of Internet of Things devices using specific network IoT protocols
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports 13+ IoT-specific protocols including AMQP, CoAP, MQTT, and HTTP/2, enabling comprehensive security assessments across diverse IoT ecosystems as detailed in the protocol table.
Includes tools for service discovery, fingerprinting, fuzzing, and vulnerability testing, with separate tools for both client and server testing to cover all attack vectors.
Can be integrated with the Metasploit framework, allowing penetration testers to incorporate IoT-specific tests into existing workflows, as documented in the Metasploit integration guide.
Uses a YAML-based database for known IoT vulnerabilities, making it easy to add new tests and payloads, with examples provided in the vulnerabilities directory.
Relies on scapy for networking, which can cause packet delivery issues on the same machine and interference between multiple tools, reducing reliability in complex setups as noted in the known issues.
Installation requires managing different package sets (e.g., minimal vs. all), and full DTLS support needs additional scapy-ssl_tls, complicating setup and increasing maintenance overhead.
Not all tools support every protocol; for example, server_fingerprinter only works with CoAP and DTLS, limiting comprehensive assessments across all 13+ protocols listed.