Add serial-in-SSID PSK, Telnet PSK leak & cloud IDOR vectors (GivEnergy battery gateways)

[carlospolop]

What this adds

A new section in Pentesting Wi-Fi documenting the IoT battery-gateway attack chain from the GivEnergy "All In One" research, written as concrete, reusable attack vectors (not device trivia).

Section: src/generic-methodologies-and-resources/pentesting-wifi/README.md → Serial-in-SSID PSKs & dual-homed battery gateways (GivEnergy AIO case)

Attack vectors covered

1. Serial-in-SSID → WPA PSK. The gateway broadcasts WK<SERIAL> and derives the WPA PSK from that same serial (or ships the fixed 12345678), so the wireless password is recoverable from the beacon with no handshake capture or cracking. SSID pattern is also searchable in wardriving datasets (wigle.net) to pre-locate targets.
2. Telnet/HTTP admin/admin on the Hi-Flying HF-A21-SMT module → home Wi-Fi PSK in cleartext. The dual-homed gateway (own AP + STA on the home WLAN, plus optional RJ45 bridge) exposes a module console whose config dump leaks the customer's home WLAN PSK, pivoting the attacker onto the home LAN (same class as the 2015 iKettle bug).
3. Battery control via Modbus TCP 502 / vendor API 8099 — force the battery to stop charging/discharging.
4. Cloud IDOR / BOLA — GET /internal-api/inverter/data/<serial>/<date> takes the serial straight from the path with no ownership check; swapping the serial (read from the SSID) returns any customer's grid/generation/consumption/battery data.
5. Port scan = factory reset (destructive DoS) — the fragile module crashes to factory defaults under an aggressive scan, wiping config; guidance to probe one port at a time and record state first.

Cross-references to Pentesting Telnet, Pentesting Modbus, and IDOR/BOLA. Reference [30].

Note

Rewritten from the original auto-generated draft, which described these as abstract "management-plane pivot" methodology and dropped the concrete values (SSID→PSK derivation, admin/admin, the module name, the IDOR URL, the Modbus/API control plane).

Source: https://pentestpartners.com/security-blog/givenergy-enters-administration-legacy-home-batteries-still-expose-customer-networks

[carlospolop]

🔗 Additional Context

Original Blog Post: https://pentestpartners.com/security-blog/givenergy-enters-administration-legacy-home-batteries-still-expose-customer-networks

Content Categories: Based on the analysis, this content was categorized under "Pentesting WiFi / IoT gateway attacks, with cross-references to Pentesting Telnet, Pentesting Modbus, and Web IDOR".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge