A Python tool that actively fingerprints embedded TCP/IP stacks on network devices to identify vulnerable implementations.
project-memoria-detector is a Python-based network security tool that actively fingerprints embedded TCP/IP stacks on network devices. It helps identify which specific stack a device is running, which is crucial for assessing vulnerability exposure since many embedded stacks have known security flaws. The tool was developed as part of Project Memoria research that uncovered vulnerabilities in multiple TCP/IP implementations.
Security researchers, penetration testers, and network administrators who need to assess embedded devices and IoT systems for vulnerable TCP/IP stack implementations.
It provides a specialized, multi-method approach to fingerprinting 16 different embedded TCP/IP stacks with confidence scoring, unlike generic network scanners. The tool is specifically designed for the security assessment needs identified during Project Memoria research.
project-memoria-detector is a network security tool designed to identify which embedded TCP/IP stack a target device is running. It was developed as part of Project Memoria research, which discovered vulnerabilities in multiple embedded stacks. The tool helps security researchers and network administrators assess devices for potential exposure to known stack-specific vulnerabilities.
The tool prioritizes accurate identification of embedded TCP/IP stacks through multiple active fingerprinting methods while emphasizing responsible usage in controlled environments to avoid disrupting critical infrastructure.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses ICMP probing, TCP options analysis, and service banners (HTTP, SSH, FTP) to cross-verify stack identification, increasing accuracy through multiple active methods.
Reports match confidence as High, Medium, Low, No match, or No reply for each fingerprinting method, helping users assess reliability and prioritize findings.
Supports scanning IP ranges via CIDR notation or input files, enabling efficient large-scale network assessments for embedded device vulnerabilities.
Includes explicit warnings about potential device crashes from malformed packets and recommends lab testing, promoting responsible usage in controlled environments.
Sends malformed ICMP and TCP packets that can crash devices, making it unsafe for production use without risking disruption to critical infrastructure.
Tested only on Linux with iptables, requires root privileges and specific Python/Scapy versions, restricting deployment on other operating systems or in locked-down environments.
Only fingerprints 16 embedded TCP/IP stacks, missing other stacks or custom implementations, which limits its usefulness for broader network assessments.