sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB · Embedded Linux/Yocto dynamic path — QEMU boot (runqemu/FirmAE) → DAST + pentest #149

New Issue
Open
opened 2026-07-12 21:56:20 +00:00 by sharang · 1 comment
sharang commented 2026-07-12 21:56:20 +00:00
Owner
Copy Link
Copy Source

Part of #118. Gives Embedded Linux / Yocto targets a dynamic (DAST + pentest) dimension by booting the image in an emulator — no hardware.

Context

A Yocto device is a full Linux (kernel + userspace + apps), so it spans SAST + DAST + pentest. The unlock for the dynamic side is QEMU: the built image can be booted and its live services scanned like any running target.

Approach

  • Boot bridge: runqemu for Yocto-built images; FirmAE / Firmadyne for image-only firmware (network-boots firmware in QEMU). Expose the emulated device's services (SSH, web admin UI, MQTT, custom daemons).
  • Reuse existing engines: point the DAST crawler + LLM pentest at the emulated device's services; add nmap service discovery.

Test targets (OSS)

Prebuilt Yocto qemux86-64 core images; IoTGoat (OWASP vulnerable embedded-Linux firmware); OpenWrt images.

Depends

Onboarding EmbeddedLinuxYocto, firmware ingest (#120), DAST/pentest infra. Pairs with the firmware-static issue and the bitbake-provider issue.

Part of #118. Gives **Embedded Linux / Yocto** targets a dynamic (DAST + pentest) dimension by booting the image in an emulator — no hardware. ## Context A Yocto device is a full Linux (kernel + userspace + apps), so it spans SAST + DAST + pentest. The unlock for the dynamic side is **QEMU**: the built image can be booted and its live services scanned like any running target. ## Approach - **Boot bridge:** `runqemu` for Yocto-built images; **FirmAE / Firmadyne** for image-only firmware (network-boots firmware in QEMU). Expose the emulated device's services (SSH, web admin UI, MQTT, custom daemons). - **Reuse existing engines:** point the DAST crawler + LLM pentest at the emulated device's services; add nmap service discovery. ## Test targets (OSS) Prebuilt Yocto `qemux86-64` core images; **IoTGoat** (OWASP vulnerable embedded-Linux firmware); OpenWrt images. ## Depends Onboarding EmbeddedLinuxYocto, firmware ingest (#120), DAST/pentest infra. Pairs with the firmware-static issue and the bitbake-provider issue.
sharang added this to the Onboarding v1 milestone 2026-07-12 21:56:20 +00:00
sharang added the onboardingenhancement labels 2026-07-12 21:56:20 +00:00
sharang commented 2026-07-16 10:41:30 +00:00
Author
Owner
Copy Link
Copy Source

Customer context (tracker #167): this Yocto device also hosts a CODESYS runtime + control app. The QEMU dynamic path should expose both the Linux services and the CODESYS/ICS services (see #148), so DAST + pentest cover the whole device from one target. Matrix enabler: #164.

Customer context (tracker #167): this Yocto device also hosts a **CODESYS runtime + control app**. The QEMU dynamic path should expose both the Linux services and the CODESYS/ICS services (see #148), so DAST + pentest cover the whole device from one target. Matrix enabler: #164.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#149