Originally published on Maker.io (DigiKey).
Before attempting an attack, a good attacker does reconnaissance. Part 3 structures that reconnaissance into four objectives: identify the payoffs (what flags exist and where they’re stored), review the overall design for known weaknesses, enumerate every attacker-controlled input into the system, and catalog potential vulnerabilities — specifically distinguishing known bugs from “interesting oddities,” things in the code that are technically correct but fragile or surprising.
The article applies this framework to the insecure example’s source code, surfaces a list of bugs and oddities, and explains where an attacker looks for additional design information: manufacturer datasheets and errata, maintenance and repair documentation, published reverse-engineering work, and the device’s own response to probing. The resulting lists of inputs and vulnerabilities become the foundation for the prioritized attack matrix in Part 4.