Generative AI-Based Tool for Brute Forcing IoT Devices' Default Credentials

This study beneficially uses the power of generative AI to search for vendor-specific default credentials and uses them to brute force IoT devices logins. IoT devices have a diverse set of open ports used for accessing and configuration. With the increased usage of IoT devices, keeping all devices' ports wellsecured is overwhelming and costly, especially for SMEs. Using a variety of methods to approach the problem, this research studied IoT attacks, characteristics, IoT penetration tools, and small to medium size enterprises (SMEs) requirements to produce an automated solution. Findings indicated that a lot of IoT devices are still configured with default credentials making the networks they are connected to vulnerable attacks. The solution presented, is a script that integrates OpenAI GPT to search for default credentials, Nmap to scan for open ports, and Hydra to attack the device. The tool is implemented to assess some specific widely used ports. To detect vulnerable IoT devices and report them to the user, the tool analyses login pages available on ports 80 and 443 to search for the brand and model of the IoT device. The output is used for the default credentials GPT search. Despite its ability to shortlist the dictionary for a brute force list, it should be tested on an experiential environment that includes different IoT simulators with several open ports on changed credentials and default ones. Then verified its functionality on a real IoT network. Further research could explore implementing machine learning to thoroughly analyse IoT device firmware.