MedAudit
A tool for auditing medical devices and healthcare infrastructure. I wrote this tool because I could not find any tool that would help me assist in medical device auditing / pentesting.
I also added the support for web API so we can use the skill set of web application testing to test medical devices.
The tool is written to audit networks, protocols, and infrastructure that runs in hospitals. At the time of writing this, the tools support HL7 protocol. The tool will support FHIR auditing in the near future.
Here are the features of the tool:
- HL7 message sender
- HL7 Scanner
- DOS Testing
- Traffic Analysis
- API Support for using Proxies (Burp, ZAP) and REST client (e.g. Postman)
- Fuzzer – Written by Adwait Joshi (https://github.com/AdvaitJ)
To understand Pen testing medical devices, these talks will help – Blackhat Talk HITB Talk Nullcon Talk
A Screenshot of network analysis, the tool extracts HL7 traffic from a network capture file and point the message flow
Install
git clone https://github.com/anirudhduggal/medaudit.git
cd medaudit/src/
pip install –r requirements.txt
Use
python manage.py runserver 8082
Open your browser and navigate to
http://127.0.0.1:8082/about/
You should see the GUI now.
A Screenshot of the interface
Using Postman
A postman is a client tool which can be used to send REST API requests. To use postman, install the software – https://www.getpostman.com/. Then import the JSON collections in the Postman tool. You can then modify the parameters in a JSON format and send it forward to the device you are testing.
Copyright (C) 2019 anirudhduggal
Source: https://github.com/anirudhduggal/
