Firmwalker is an automated tool designed to aid in the analysis of extracted Linux-based firmware file systems. It quickly identifies critical information such as password files, SSH keys, and configuration files, making it a useful tool for pentesters and security researchers focusing on embedded devices and IoT security.
Automated Scanning
Firmwalker parses through the entire extracted file system, looking for key files related to security, such as credentials, configuration files, and certificates.
Focused Output
It categorizes findings such as passwords, SSH keys, web server information, and more, making it easy to focus on potential vulnerabilities.
File System Search
Specifically designed for Linux-based firmware.
Text File Parsing
Extracts useful information from plaintext configuration files and scripts.
# Clone the Firmwalker repository
git clone https://github.com/craigz28/firmwalker
# Navigate to the Firmwalker directory
cd firmwalker
# Run Firmwalker on an extracted firmware file system
./firmwalker /path/to/extracted/filesystemTo use Firmwalker, you’ll need to clone the repository and run the script on a pre-extracted file system from a firmware image. Here’s how to get started:
Clone the repository:
Navigate to the firmwalker directory:
Ensure you have bash installed, as Firmwalker is a bash script.
To run Firmwalker, the firmware image must first be extracted (you can use a tool like Binwalk for this). Once extracted, you can point Firmwalker to the root of the file system:
Firmwalker will then parse the file system and output a categorized report of its findings.
Firmwalker automatically searches for the following types of files and data in the extracted file system:
Password Files: Looks for files such as passwd, shadow, and login.defs.
SSH Keys: Searches for private keys (id_rsa), known hosts, and other SSH configuration files.
Configuration Files: Identifies configuration files that may contain sensitive data, such as config, .conf, and .ini files.
Web Server Info: Looks for web server files such as nginx or httpd configuration files, and web root directories.
SSL Certificates: Finds SSL certificates and related private keys.
Scripts: Parses through shell scripts or other automation scripts that might reveal hardcoded credentials or system configurations.
Miscellaneous: Searches for any .sql files (databases), crontab files (schedules), and more.
Once the firmware has been extracted, run the following command to analyze the file system:
The output will be a structured list of findings, highlighting the critical files and directories of interest.
Firmwalker provides a categorized output similar to:
Firmwalker works on an extracted file system, meaning you’ll need to extract the firmware first before running the tool.
The findings give a quick overview of critical files to investigate further, making it ideal for initial reconnaissance of firmware images.
Last updated
git clone https://github.com/craigz28/firmwalkercd firmwalker./firmwalker <path_to_extracted_firmware>./firmwalker /path/to/extracted/filesystem--- Password Files ---
/etc/passwd
/etc/shadow
--- SSH Keys ---
/root/.ssh/id_rsa
--- Configuration Files ---
/etc/nginx/nginx.conf