AwesomeREA.org

Learning resource

OWASP Firmware Security Testing Methodology (FSTM)

A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. It is organized as nine stages: information gathering, obtaining firmware, analyzing the image, extracting the filesystem, static analysis of its contents, emulation, dynamic testing, runtime analysis and binary exploitation, with example commands for tools such as binwalk, unblob, FACT, EMBA, Firmwalker, QEMU and Ghidra. An October 2025 revision added C/C++ static-analysis tools, SBOM generation and a mapping to the OWASP IoT Security Verification Standard (ISVS).

Requirements & limits

  • Reviewed at default-branch commit ec666e8 (2025-10-05). Most of the text dates from 2019–2020, with a 2022 EMBA/EMBArk update and an October 2025 revision that refreshed tool references, removed commercial ones and added the SAST, SBOM and ISVS sections; the published GitBook includes those additions. A feature branch adding ISVS requirement mappings by stage (June 2026) was not merged at review, and a shorter 2020 Chinese translation sits on the separate zhong-wen-fstm branch.
  • Its stated audience is security researchers, software developers, consultants, hobbyists and information-security professionals. It is a single long reference page of procedures and commands rather than a paced course, and it points to the OWASP IoT Security Testing Guide for hardware, wireless, network and user-interface tests outside firmware.
  • Following it needs the firmware image or the physical device under an authorized assessment; the methodology tells testers to choose acquisition methods by project objectives and rules of engagement and to follow local laws. Some stages assume hardware debug access and a chip programmer. Tools mostly run on Linux; the README links a preconfigured EmbedOS Ubuntu VM from 2020 and, for practice, deliberately vulnerable firmware such as OWASP IoTGoat, DVRF and DVID.
  • Licensed CC BY-SA 4.0 (License.md). This collection read the README at the reviewed commit and checked that the GitBook carries the 2025 sections; it did not run the commands or tools. The methodology describes no AI or REA use.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · scriptingxss/owasp-fstm · Revision ec666e8
  2. README.md#L1051-L1084 GitHub · scriptingxss/owasp-fstm · Revision ec666e8
  3. README.md#L945-L1050 GitHub · scriptingxss/owasp-fstm · Revision ec666e8
  4. License.md GitHub · scriptingxss/owasp-fstm · Revision ec666e8
  5. README.md GitHub · scriptingxss/owasp-fstm · Revision e32570c

More in References and learning

All 43 entries in References and learning