iothackbot collects 13 Claude Skills and custom tooling for hybrid IoT pentesting. Together they cover Android APK reverse engineering (apktool, jadx), firmware static analysis (chipsec), hardware debug interface probing (JTAG, UART), network reconnaissance and protocol detection (nmap, iotnet, netflows), and ONVIF camera scanning. The set lets IoT penetration testers, embedded security researchers, and mobile app analysts move across attack layers without switching environments.
Follow the documented setup, then try a first task.
Installs: Complete iothackbot plugin bundle · Claude Code
Platform: Linux; the documented system-package command is for Arch Linux
In a terminal, install the documented Python dependencies.
pip install colorama pyserial pexpect requests
On Arch Linux, install the documented system dependencies in a terminal. On another distribution, install equivalent packages using that distribution's supported procedure; no equivalent command is supplied here.
sudo pacman -S nmap e2fsprogs f2fs-tools python python-pip inetutils
In a terminal, from the directory where the repository should be created, clone it and enter its directory.
git clone https://github.com/BrownFineSecurity/iothackbot.git cd iothackbot
While still in the cloned repository directory, add its bin directory to PATH for the current terminal session.
export PATH="$PATH:$(pwd)/bin"
In a terminal, replace `/path/to/iothackbot` with the absolute path of the cloned repository, keeping the placeholder verbatim in the command template until substitution, and launch Claude Code with the plugin directly.
claude --plugin-dir /path/to/iothackbot
Installs: Complete persistent iothackbot plugin bundle · Claude Code
Platform: Linux; the documented system-package command is for Arch Linux and the permanent PATH command targets Bash
In a terminal, install the documented Python dependencies.
pip install colorama pyserial pexpect requests
On Arch Linux, install the documented system dependencies in a terminal. On another distribution, install equivalent packages using that distribution's supported procedure; no equivalent command is supplied here.
sudo pacman -S nmap e2fsprogs f2fs-tools python python-pip inetutils
In a terminal, from the directory where the repository should be created, clone it and enter its directory.
git clone https://github.com/BrownFineSecurity/iothackbot.git cd iothackbot
While still in the cloned repository directory, add its bin directory to PATH for the current terminal session.
export PATH="$PATH:$(pwd)/bin"
In a terminal, replace `/path/to/iothackbot` with the absolute path of the cloned repository, keeping the placeholder verbatim in the command template until substitution, and add the repository's bin directory permanently to Bash's configuration.
echo 'export PATH="$PATH:/path/to/iothackbot/bin"' >> ~/.bashrc
Manually add the documented local marketplace and plugin configuration to `~/.claude/settings.json`. Replace `/path/to/iothackbot` in the `path` value with the absolute path of the cloned repository: `{"extraKnownMarketplaces":{"iothackbot-local":{"source":{"source":"directory","path":"/path/to/iothackbot"}}},"enabledPlugins":{"iothackbot":true}}`. Merge it with any existing settings rather than discarding unrelated configuration.
Restart Claude Code so the settings take effect.
Uses wsdiscovery
Check the repository for this skill’s setup.
Use the wsdiscovery skill to inspect `<authorized-host-or-IP>` for WS-Discovery devices. Ask me for the authorized hostname or IP if I have not supplied it, use the default human-readable output without verbose XML, and summarize the discovered device identity and service endpoints.
Uses onvifscan
Check the repository for this skill’s setup.
Use the onvifscan skill to perform the recommended non-destructive authentication check against `<authorized-device-URL-or-IP>`. Do not run credential brute-forcing or use the `--all` option. Summarize which tested ONVIF endpoints require authentication.
Uses netflows
Check the repository for this skill’s setup.
Use the netflows skill to analyze the local capture at `<pcap-or-pcapng-path>`. If I provide `<device-source-IP>`, filter flows to that device; otherwise analyze all flows. Use the default text output and summarize unique TCP and UDP destinations, DNS-resolved hostnames, and unresolved IPs.
Claude