Skip to content
Get packs

Firmware Pentest Chain

Walks an agent through extracting, emulating and exploiting router/IoT firmware images

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
4 files

What it does

This skill gives an AI agent a step-by-step methodology for security testing of firmware (the software inside routers, cameras and smart-home devices), following the OWASP FSTM nine-stage framework. Once installed, the agent knows which tools to use at each stage (binwalk, unblob, EMBA, Firmadyne/FAT, QEMU, AFL++) to unpack a firmware .bin file, scan the extracted filesystem, emulate it, and look for vulnerabilities. It also includes example command lines and worked scenarios, including recovering decryption logic from a bootloader.

Great for

  • Security researchers auditing router, camera or IoT firmware they own or are authorised to test
  • Students learning the firmware analysis workflow in CTFs or lab environments
  • Penetration testers preparing firmware reviews under a written scope

Skip it if

  • Testing devices or firmware you do not own or have written permission to assess; the skill itself says unauthorised targets are out of bounds and the risk is legal, not technical
  • Non-security tasks such as normal firmware updates or device setup, since the content is focused on finding and exploiting vulnerabilities
  • Beginners expecting a turnkey tool; it assumes familiarity with reverse engineering, Linux and QEMU and references tools that must be installed separately

Try asking

  • “Analyse this router firmware .bin file and tell me what filesystem it contains and whether it is encrypted”
  • “Extract the root filesystem from this IoT firmware image with binwalk and unblob, then run EMBA on it”
  • “Help me emulate this camera firmware with Firmadyne or FAT so I can test its web interface in a lab”
  • “Find hard-coded credentials and risky system() calls in the extracted httpd binary”
Step-by-step guide: how to use Firmware Pentest ChainInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 4 original files, the MIT licence and an attribution note.

    firmware-pentest.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip firmware-pentest.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip firmware-pentest.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written authorisation and scope before running any step; the instructions tell the agent to check a precedent file, but you should verify this yourself rather than rely on it
  • Review the bootstrap step and any auto-install behaviour before allowing it to install tools on your machine, since the file references automatic installation without showing the code
  • Run emulation and fuzzing inside an isolated VM or container, because the exploit examples include reverse shells and downloads from external hosts

What's inside

  • references/emba-automated-analysis.md
  • references/emulation-and-fuzz.md
  • references/extraction-methodology.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.