# Building Firmware Penetration Testing Chains Following OWASP FSTM Methodology

> Automate firmware penetration testing with the reverse-skill framework. Follow OWASP FSTM methodology for efficient task routing, dependency bootstrapping, and auditable reports.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-09

---

**The reverse-skill framework automates OWASP FSTM-aligned firmware penetration testing through a three-layer architecture that routes tasks, bootstraps dependencies, and generates auditable reports.**

The `zhaoxuya520/reverse-skill` repository provides a platform-agnostic skill router designed to steer AI agents and security analysts through repeatable workflows for complex tasks. When building firmware penetration testing chains following OWASP FSTM methodology, the framework orchestrates everything from initial firmware extraction to final exploit development through automated routing decisions and evidence collection.

## Three-Layer Architecture for Firmware Security Testing

The reverse-skill framework implements a structured approach to firmware security testing through three distinct operational layers, each handling specific aspects of the OWASP FSTM workflow.

### Routing Layer and Decision Logic

At the foundation, the **Routing Layer** maps user intent to concrete skills using [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) as the single source of truth for 41 routing rules. When a firmware-related task arrives, [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) performs fast-track matching to the `firmware-pentest` skill, while [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) contains the complete routing matrix. This layer ensures that requests like "analyze embedded firmware" immediately trigger the correct testing chain without manual tool selection.

### Execution Layer and Tool Bootstrap

The **Execution Layer** handles environment preparation through scripts located in `skills/scripts/*.ps1` for Windows and `kali/scripts/*.sh` for Kali Linux. Before executing any firmware analysis, the system consults [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) to verify the presence of required utilities such as `binwalk`, `Ghidra`, and `radare2`. Missing dependencies are auto-installed using the bootstrap process defined in [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json), ensuring the toolchain is always ready for extraction and reverse engineering tasks.

### Outcome Layer and Evidence Management

The **Outcome Layer** manages the post-execution workflow through `field-journal/`, `docs-generator`, and `case-review/` directories. After completing dynamic analysis or crash discovery, this layer validates the evidence graph for traceability, generates structured reports with `diagram-generator`, and writes findings back to the knowledge base for automatic reuse in future firmware assessments.

## OWASP FSTM Implementation Workflow

The firmware penetration testing chain operates as a module within the **Vulnerability Exploitation** sub-graph, following a seven-step methodology that aligns with OWASP FSTM standards.

### Case Initialization and Security Gates

Every firmware assessment begins with the **Auth & Network Profile gate** enforced by [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md). Analysts must initialize the case using `skills/scripts/case-init.ps1` before any tools execute:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 -Hint "Firmware pentest of device XYZ"

```

This command establishes the case directory, defines scope boundaries, and creates evidence templates that ensure all subsequent actions remain auditable and within authorized parameters.

### Automated Tool Discovery

Once initialized, the framework refreshes the local tool index to detect available firmware analysis utilities:

```bash

# Windows environment

powershell -File skills/scripts/refresh-tool-index.ps1

# Linux or macOS

bash skills/scripts/refresh-tool-index.sh

# Kali Linux specific

bash kali/scripts/refresh-tool-index.sh

```

These scripts update [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) and trigger automatic installation of missing components required for firmware extraction and emulation.

### Four-Phase Skill Execution

The `firmware-pentest` skill orchestrates a complete OWASP FSTM-aligned chain stored in `skills/firmware-pentest/`:

1. **Extraction** – Unpacks firmware images using `binwalk` or custom extraction scripts to recover filesystems and binaries.
2. **Static Analysis** – Identifies vulnerable binaries, libraries, and configuration files through automated scanning.
3. **Dynamic Emulation** – Executes selected components in QEMU or Unicorn emulators to surface runtime crashes and behavior.
4. **Crash-to-Exploit** – Feeds crash data into the `pwn-chain` module for structured exploit development and vulnerability confirmation.

### Knowledge Capture and Reporting

Upon completion, `case-review/` validates the evidence graph to maintain traceability from initial firmware image to confirmed vulnerability. The `docs-generator` produces structured reports with visual diagrams from `diagram-generator`, while findings persist to `field-journal/` to improve future routing decisions.

## Executing the Firmware Pentest Chain

To run the complete firmware penetration testing workflow directly, invoke the master router with a specific hint:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "firmware pentest"

```

After modifying routing rules or adding new firmware analysis tools, validate the entire chain using the regression suite:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1

```

## Summary

- The reverse-skill framework implements OWASP FSTM through a three-layer architecture comprising Routing, Execution, and Outcome layers.
- **Routing decisions** rely on [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) and [`MASTER-ROUTING.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/MASTER-ROUTING.md) to map firmware tasks to the correct testing modules.
- **Tool bootstrapping** automatically installs missing dependencies like `binwalk` and `Ghidra` via `refresh-tool-index` scripts before execution.
- The **firmware-pentest skill** follows a four-phase flow: Extraction, Static Analysis, Dynamic Emulation, and Crash-to-Exploit development.
- All activities require initialization through `case-init.ps1` and respect the security gates defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md).
- Evidence traceability is maintained through `field-journal/` and `case-review/` directories, ensuring auditable penetration testing workflows.

## Frequently Asked Questions

### What is OWASP FSTM and how does reverse-skill implement it?

The OWASP Firmware Security Testing Methodology (FSTM) provides a systematic approach to analyzing embedded firmware for vulnerabilities. The reverse-skill framework implements FSTM through automated routing to the `firmware-pentest` skill, which executes standardized phases including extraction, static analysis, dynamic emulation, and exploit development while maintaining full audit trails in the `field-journal/` directory.

### How does the routing system determine which firmware testing tools to use?

The routing system consults [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json)—the single source of truth containing 41 routing rules—to match firmware-related hints to the appropriate skill module. Once matched, [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) is checked against the current environment, and missing tools are auto-installed via [`bootstrap-manifest.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/bootstrap-manifest.json) before the `skills/firmware-pentest/` playbooks execute.

### Can the framework run on both Windows and Linux environments?

Yes, the framework provides platform-specific execution scripts: `skills/scripts/*.ps1` for Windows PowerShell and `kali/scripts/*.sh` for Kali Linux environments. The `refresh-tool-index` utility detects the host operating system and uses the appropriate package managers to bootstrap dependencies, ensuring consistent firmware analysis capabilities across platforms.

### How is evidence traceability maintained throughout the penetration test?

Evidence traceability is enforced through mandatory case initialization via `case-init.ps1`, which creates scoped directories and templates before any tools run. The `case-review/` module validates the evidence graph after execution, while `docs-generator` produces structured reports linking every finding back to the original firmware image, ensuring complete auditability for compliance and research purposes.