Security Assessment of IoT Devices Using Penetration Testing Frameworks
Karki, Saurav (2025)
2025
All rights reserved. This publication is copyrighted. You may download, display and print it for Your own personal use. Commercial use is prohibited.
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2025110326919
https://urn.fi/URN:NBN:fi:amk-2025110326919
Tiivistelmä
This study presents the design and implementation of a virtual Internet of Things (IoT) testbed to analyze communication security and network vulnerabilities. The testbed, developed using virtual machines on VirtualBox, enabled communication between an Ubuntu-based IoT node and a Kali Linux monitoring system. Tools such as Nmap, Wireshark, and Mosquitto were used to capture and evaluate HTTP and MQTT traffic.
The experiment reveals successful data exchanges but also showed unencrypted transmission and potential data exposure. Protocol hierarchy analysis indicated that HTTP accounted for 70% of traffic when MQTT represented 30%, confirming the protocol coexistence in IoT communications. Findings were assessed using the OWASP IoT Top 10 (2023) framework, identifying common risks such as insecure communication and weak authentication.
Security recommendations include enabling TLS/SSL, implementing broker authentication, limiting open ports, and adopting intrusion detection systems to enhance Internet of Things (IoT) network resilience.
The experiment reveals successful data exchanges but also showed unencrypted transmission and potential data exposure. Protocol hierarchy analysis indicated that HTTP accounted for 70% of traffic when MQTT represented 30%, confirming the protocol coexistence in IoT communications. Findings were assessed using the OWASP IoT Top 10 (2023) framework, identifying common risks such as insecure communication and weak authentication.
Security recommendations include enabling TLS/SSL, implementing broker authentication, limiting open ports, and adopting intrusion detection systems to enhance Internet of Things (IoT) network resilience.