project-memoria-detector
A Python tool that actively fingerprints embedded TCP/IP stacks on network devices to identify vulnerable implementations.
What is project-memoria-detector?
project-memoria-detector is a Python-based network security tool that actively fingerprints embedded TCP/IP stacks on network devices. It helps identify which specific stack a device is running, which is crucial for assessing vulnerability exposure since many embedded stacks have known security flaws. The tool was developed as part of Project Memoria research that uncovered vulnerabilities in multiple TCP/IP implementations.
Security researchers, penetration testers, and network administrators who need to assess embedded devices and IoT systems for vulnerable TCP/IP stack implementations.
It provides a specialized, multi-method approach to fingerprinting 16 different embedded TCP/IP stacks with confidence scoring, unlike generic network scanners. The tool is specifically designed for the security assessment needs identified during Project Memoria research.
Overview
project-memoria-detector is a network security tool designed to identify which embedded TCP/IP stack a target device is running. It was developed as part of Project Memoria research, which discovered vulnerabilities in multiple embedded stacks. The tool helps security researchers and network administrators assess devices for potential exposure to known stack-specific vulnerabilities.
Key Features
- Multi-Protocol Fingerprinting — Uses ICMP probing, TCP options analysis, TCP Urgent flag handling, and service banner checking (HTTP, SSH, FTP) to identify stacks.
- 16 Supported Stacks — Detects uIP/Contiki, picoTCP, Nut/Net, FNET, Nucleus NET, CycloneTCP, NDKTCPIP, uC/TCP-IP, MPLAB Harmony Net, NicheStack, FreeBSD, Microsoft ThreadX, CMX TCP/IP, emNet, Keil TCP/IP, and lwIP.
- Certainty Scoring — Reports match confidence as High, Medium, Low, No match, or No reply for each fingerprinting method.
- Bulk Scanning — Supports scanning IP ranges via CIDR notation or input files for efficient network assessment.
- Safety-Focused Design — Includes warnings about potential device crashes and recommends lab testing rather than use on mission-critical systems.
Philosophy
The tool prioritizes accurate identification of embedded TCP/IP stacks through multiple active fingerprinting methods while emphasizing responsible usage in controlled environments to avoid disrupting critical infrastructure.
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
