A deliberately insecure OpenWrt-based firmware designed to teach IoT security testing through hands-on vulnerability challenges.
IoTGoat is a deliberately insecure firmware based on OpenWrt, designed to teach IoT security testing through hands-on vulnerability challenges. It provides a safe environment to practice identifying and exploiting common IoT flaws, such as weak passwords, insecure network services, and lack of secure updates. The project is maintained by OWASP and aligns with the OWASP IoT Top 10 to cover real-world security risks.
Security professionals, penetration testers, IoT developers, and students who want to learn IoT security testing in a practical, controlled setting. It's ideal for those seeking hands-on experience with firmware analysis and vulnerability exploitation.
IoTGoat offers a legal, purpose-built platform for practicing IoT penetration testing without the risks of attacking real devices. Its integration with OWASP resources and multiple deployment options (VMware, QEMU, Raspberry Pi) makes it a versatile educational tool for both beginners and experienced testers.
IoTGoat is a deliberately insecure firmware based on OpenWrt.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Based on the OWASP IoT Top 10, it includes deliberate flaws like weak passwords and insecure network services, providing a realistic training ground for common IoT security issues.
Supports running as a VMware VM, emulated via QEMU tools, or flashed on Raspberry Pi 2, allowing users to choose the best environment for hands-on testing.
Links directly to OWASP's Firmware Security Testing Methodology and Web Security Testing Guide, offering structured learning paths alongside the challenges.
Includes a wiki with specific vulnerability challenges and 'easter eggs,' enabling guided, practical skill development in IoT penetration testing.
Built on OpenWrt 18.06.2, an older version that may not reflect current IoT security vulnerabilities or receive updates, limiting relevance for modern threats.
Building from source requires 10-15GB disk space, specific Linux distributions, and manual configuration via menuconfig, making it less accessible for quick setups.
Officially supports only x86 and Raspberry Pi 2 platforms, restricting use on newer or diverse IoT hardware commonly found in today's ecosystem.