A tool for auditing medical devices and healthcare infrastructure. I wrote this tool becuase I could not find any tool that would help me assist in medical device auditing / pentesting.

I also added the support for web API so we can use the skill set of web application testing to test medical devices.

The tool is written to audit networks, protocols and infrastructure that runs in hospitals. At the time of writing this, the tools supports HL7 protocol. The tool will support FHIR auditing in the near future.

Here are the features of the tool:

• HL7 message sender
• HL7 Scanner
• DOS Testing
• Traffic Analysis
• API Support for using Proxies (Burp, ZAP) and REST client (e.g. Postman)
• Fuzzer - Written by Adwait Joshi (https://github.com/AdvaitJ)

To understand Pen testing medical devices, these talks will help - Blackhat Talk HITB Talk Nullcon Talk

A Screenshot of network analysis, the tool extracts HL7 traffic from a network capture file and point the message flow

Installation The project runs on python 3 and uses Django, Bootstrap 2.

For using the tool, install python 3 first and then install pip.

Download the project/ unzip it.

cd src/

pip install –r requirements.txt

python manage.py runserver 8082

Open your browser and navigate to

http://127.0.0.1:8082/about/

You should see the GUI now.

A Screenshot of the interface

Using Postman

Postman is a client tool which can be used to send REST API requests. To use postman, install the software - https://www.getpostman.com/ . Then import the JSON collections in the Postman tool. You can then modify the parameters in a JSON format and send it forward to the device you are testing.