Shelly-Loqed-Touch/Document1-Network.md

Test-ID	ISTG Reference	Name	Tools	Status	Finding
DES-02	ISTG-DES-AUTHZ-001	Unauthorized Access to Data Exchange Services	nmap, mitm, adb	Open	Test not yet performed.
DES-06	ISTG-DES-INFO-001	Disclosure of Implementation Details (DES)	nmap, jadx, smali code	Open	Test not yet performed.
DES-07	ISTG-DES-INFO-003	Disclosure of User Data	Wireshark, tcpdump, mitm	Open	Test not yet performed.
DES-08	ISTG-DES-CONF-001	Usage of Outdated Software	testssl.sh, openssl	Open	Test not yet performed.
DES-09	ISTG-DES-CONF-002	Presence of Unnecessary Software (Network Services)	nmap	PASS	No unnecesarrily open ports on the bridge
DES-10	ISTG-DES-SCRT-001	Access to Confidential Data	adb/root, Frida, SQLCipher, sqlite3	Open	Test not yet performed.
DES-11	ISTG-DES-CRYPT-001	Usage of Weak Cryptographic Algorithms (Transport Encryption)	testssl.sh, openssl	Open	Test not yet performed.
DES-12	ISTG-DES-INPV-001	Insufficient Input Validation (Network API)	mitm	Open	Test not yet performed.
DES-13	ISTG-DES-INPV-002	Code or Command Injection (Network API)	mitm	Open	Test not yet performed.

---

Test Case Execution

DES-02

• Verdict: Open

DES-06

• Verdict: Open

DES-07

• Verdict: Open

DES-08

• Verdict: Open

DES-09

Some ports have already been scanned, see initial information gathering.

nmap -p 1-65535 -T4 -A -v 10.12.2.30

Zenmap's "intense scan, all TCP ports".

The bridge is the only device with an IP network interface (the lock is BLE-only). In our network it currently has the address 10.12.2.30.

After the factory reset I had to reconfigure the bridge to determine its new IP. The procedure was captured here and re-run through the PreTester here.

• Result: nmap report

Across all TCP ports, the bridge exposes a single listening service (80/tcp, HTTP, cleartext). All other ports are filtered.

• Verdict: PASS

DES-10

• Verdict: Open

DES-11

• Verdict: Open

DES-12

• Verdict: Open

DES-13

• Verdict: Open