Pentest Your Own Energizer Doorbell

Perform a professional IoT security assessment on your own doorbell.

Introduction

30 Second Summary

Your smart doorbell watches your front porch around the clock. But have you ever wondered what it is doing behind the scenes on your home network? IoT devices are notorious for opening hidden doors that attackers can exploit.

In this project, you will perform a professional penetration test on your own Energizer Connect doorbell using Nmap and Wireshark. You will discover its open ports, capture its live network traffic, and document your findings in a structured security assessment report.

What You'll Build

You will run a scan against your own doorbell, see hidden services light up on ports you never knew were open, watch its traffic flow to cloud servers in real-time, and compile a security assessment report you could hand to a client or show in a job interview.

By the end of this project, you'll have:

A network reconnaissance map showing every open port and running service on your doorbell, revealing an attack surface invisible to normal users.
A live traffic capture exposing exactly where your doorbell sends data, how often it phones home, and whether that data travels encrypted or in the clear.
A structured security assessment report following the same format professional pentesters deliver to clients, with each finding rated by severity.
Secret Mission: Probe the doorbell's web interface for default credential vulnerabilities and document the full authentication test.

Are there any prerequisites?

This project assumes you have a Windows PC with Nmap and Wireshark already installed, and an Energizer Connect doorbell connected to your local network. You should also know your doorbell's IP address (found in your router's admin page or the Energizer Connect app).

Basic familiarity with opening Command Prompt on Windows is all you need to get started.

Before We Start

Before you start scanning and capturing traffic, take a moment to lock in what you're about to assess and why this skill set matters for your pentesting career.

Verify Your Lab Environment

Before scanning anything, you need to confirm your tools are working and that your machine can actually reach the target device on the network.

A scan against an unreachable host returns nothing useful and wastes time troubleshooting the wrong problem. In this step, you will verify Nmap, test connectivity to your doorbell, and confirm Wireshark is ready for traffic capture.

In this step, get ready to:

Confirm Nmap is running version 7.99 in an Administrator Command Prompt.
Test that your doorbell is reachable on the network.
Verify Wireshark can see your network interfaces.

Open Command Prompt as Administrator

Nmap requires Administrator privileges to perform the SYN scan and OS detection techniques you will use in later steps. Without elevation, Nmap falls back to slower, less effective TCP connect scans.

Press the Windows key to open your search bar.
Type cmd in the search box.
In the search results, right-click Command Prompt and select Run as administrator.
If the User Account Control window appears, click Yes.

Your Command Prompt title bar should now read "Administrator: Command Prompt".

Why run as Administrator?

Running as Administrator gives Nmap raw packet access. This is required for the -sS (SYN scan) and -O (OS detection) flags you will use in later steps. Without it, Nmap falls back to TCP connect scans (-sT) which are slower and more detectable by the target device.

Verify Nmap is installed and accessible by running this command:

nmap --version

Check the first line of output for a version number.

✔️ I see Nmap version 7.99

Nmap is installed and ready. Continue to the next substep.

ⓧ I see an older version number

Your Nmap installation is outdated. The scans in this project work best with the latest release.

Download nmap-7.99-setup.exe from nmap.org/download.html.
Run the installer. It will replace your existing Nmap installation with version 7.99.
Close your current Command Prompt and reopen it as Administrator (repeat the steps above).
Run nmap --version again to confirm it now shows 7.99.

ⓧ Command not found

Nmap is not installed or not in your system PATH.

Download nmap-7.99-setup.exe from nmap.org/download.html.
Run the installer and accept the default options (this includes Npcap, which Nmap requires for packet capture).
Close your current Command Prompt and reopen it as Administrator (repeat the steps above).
Run nmap --version again to confirm it now shows 7.99.

Test connectivity to your doorbell

A quick ping confirms your PC can reach the doorbell over the local network. If packets come back, you know the target is online and routable.

Ping your doorbell by running this command:

ping [[DOORBELL_IP="your doorbell's IP address"]]

✔️ I see reply packets from my doorbell

Your doorbell is reachable on the network. Continue to the next substep.

ⓧ I see "Request timed out" or no response

Some IoT devices block ICMP ping requests as a security measure. This is normal for many IoT devices.

The Nmap scan in the next step will confirm reachability through a different method. You can continue safely.

Confirm Wireshark is ready

Wireshark needs to see your network adapter to capture traffic later. You just need to confirm it launches and detects your interface.

Press the Windows key to open your search bar.
Type Wireshark and press Enter to open it.

Wireshark's home screen should display a list of your network interfaces (Wi-Fi, Ethernet, or both). You may also see a small activity graph next to interfaces that currently have traffic.

✔️ I see my network interfaces listed

Wireshark is ready for traffic capture. You do not need to start a capture yet.

ⓧ Wireshark does not open or shows no interfaces

If Wireshark does not open, confirm it is installed by checking your Start menu for the Wireshark application.

If it is missing, download and install Wireshark 4.6.7 from wireshark.org/download.html. The Windows installer includes Npcap, which is required for live packet capture.
If Wireshark opens but shows no interfaces, close it and relaunch it as Administrator (right-click the search result and select Run as administrator).

Your lab environment is confirmed. Nmap is ready for scanning, your doorbell is on the network, and Wireshark can see your adapter. Next up, you will run your first real scan and discover the doorbell's attack surface.

Discover the Doorbell's Attack Surface

Your lab environment is confirmed and your doorbell is reachable on the network. Now it's time to do what every pentester does first on an engagement: reconnaissance.

You need to know what ports are open and listening before you can probe deeper. This basic scan gives you a map of the doorbell's network footprint, your first real look at what an attacker would see.

In this step, get ready to:

Run a default Nmap scan against your doorbell.
Review the scan output and note open ports and service names.
Identify the limitations of the default scan for vulnerability assessment.

Run a default scan against your doorbell

A pentester always starts with the lightest-touch scan to get an initial picture of the target. Before you run this, consider: do you think a basic scan will give you enough information to determine if any of these services are actually vulnerable?

Run a default Nmap scan against your doorbell by running this command in your Administrator Command Prompt:

nmap [[DOORBELL_IP="your doorbell's IP address"]]

What does this scan do?

This performs a SYN scan of the top 1,000 most common TCP ports. Because you are running Command Prompt as Administrator, Nmap has raw packet privileges and uses its default SYN scan technique (-sS) automatically.

Nmap sends a SYN packet to each port, watches for a SYN-ACK reply (meaning the port is open), and reports the results in a table. The service names in the output are guesses based on looking up the port number in Nmap's built-in nmap-services file.

The scan takes a few seconds to complete. When it finishes, you will see a table in your Command Prompt with columns labeled PORT, STATE, and SERVICE.

Look at the PORT column for the port numbers and protocols (e.g. 80/tcp, 554/tcp).
Look at the STATE column. Ports showing open are actively accepting connections.
Look at the SERVICE column for Nmap's guess at what service runs on each port (e.g. http, rtsp).

What should I see?

Your output will look something like this (your specific ports will differ):

PORT     STATE SERVICE
80/tcp   open  http
554/tcp  open  rtsp
8080/tcp open  http-proxy

The exact ports depend on your doorbell's model and firmware. As long as you see at least one port with STATE showing open, your scan is working.

Not seeing any open ports?

If all 1,000 ports show as filtered or closed, double-check that you are scanning the correct IP address. Confirm the doorbell is powered on and connected to your Wi-Fi network via the Energizer Connect app.

If you see a message about the host being down, try adding the -Pn flag to skip host discovery: nmap -Pn <your-doorbell-ip>. Some IoT devices block ping but still have open ports.

help me troubleshoot why Nmap is not finding open ports on my IoT doorbell

Notice what the scan cannot tell you

Look at your results carefully. You now have port numbers and generic service names. But ask yourself: can you tell what specific software is running behind those ports?

The answer is no. Here is what is missing from this scan:

The SERVICE column is just a guess based on port number lookups. Port 80 is labeled http because port 80 is commonly HTTP. Nmap did not actually connect to verify what is running there.
There is no version information. You cannot tell if the HTTP service is a full web server, a firmware update endpoint, or a camera feed interface.
The scan only checked the top 1,000 TCP ports out of 65,535 total. Your doorbell may have services running on uncommon ports that this scan missed entirely.

Why does this matter?

You cannot determine if a service is vulnerable without knowing the exact software and version running behind it. A port labeled http could be running a secure, patched web server or an ancient, unpatched firmware interface. The default scan cannot tell you which.

This is the gap you will close in the next step with more aggressive scanning techniques.

Write down the open ports and their generic service names from your scan output. This becomes the starting point for Section 1 of your assessment report.

You have your first map of the doorbell's network footprint. Next up, you will probe those open ports with version detection and scan all 65,535 ports to get the full picture.

Enumerate Services and Fingerprint the Device

Your basic scan revealed which ports are open on your doorbell. You know the doors exist, but you do not know what is behind them.

Without specific version information, you cannot assess whether a service is vulnerable. In this step, you will probe each open port to identify exact software names, version numbers, and the operating system. This turns your port list into actionable intelligence.

In this step, get ready to:

Run an aggressive scan to detect service versions and fingerprint the OS.
Scan all 65,535 TCP ports to find services hiding on non-standard ports.
Document your complete findings as Section 1 of your assessment report.

Run an aggressive scan with version detection

Your default scan from the last step reported generic service names guessed from port numbers alone. The -A flag tells Nmap to actively interrogate each open port, fingerprint the operating system, run default scripts, and trace the network path to your target.

Before you run this, think back to your default scan output. What do you expect will be different this time?

In your Command Prompt, run the aggressive scan against your doorbell:

nmap -A [[DOORBELL_IP="your doorbell's IP address"]]

What does the -A flag do?

The -A flag enables four capabilities at once:

OS detection (-O): fingerprints the device's operating system using TCP/IP stack behavior.
Version detection (-sV): probes each open port to identify the exact software and version number.
Script scanning (-sC): runs Nmap's default scripts to extract additional information from each service.
Traceroute: maps the network hops between your machine and the target.

This scan takes longer than the basic scan. When it finishes, you should see a PORT/STATE/SERVICE/VERSION table where the VERSION column now contains actual software names and version numbers instead of blanks.

You may also see an "OS detection" section with a guess at the device's operating system, and script output lines (prefixed with |) showing additional details pulled from each service.

Scan taking a very long time?

The aggressive scan probes every open port in detail, so it can take several minutes on slower networks. If it exceeds 5 minutes, let it continue. Nmap is waiting for probe responses from the device.

If it appears stuck indefinitely, press Ctrl+C to cancel, then re-run the command. Some IoT devices throttle responses when they detect rapid probing.

help me troubleshoot my Nmap aggressive scan timing out against my IoT doorbell

Scan all ports to find hidden services

Your default scan only checked the top 1,000 most common ports. IoT devices often run services on unusual, high-numbered ports that this scan missed entirely.

Run a full port range scan to check all 65,535 TCP ports:

nmap -p- --open [[DOORBELL_IP="your doorbell's IP address"]]

What do these flags do?

The -p- flag tells Nmap to scan all 65,535 TCP ports instead of just the top 1,000. This catches any service hiding on a non-standard port number.

The --open flag filters the output to only show ports confirmed as open. This keeps your results clean and focused on what matters.

When this scan finishes, compare the results to your earlier scans. Any new port numbers that appear were completely invisible to the default 1,000-port scan.

Full port scan seems very slow?

Scanning all 65,535 ports takes significantly longer than the default 1,000. This can take 5-15 minutes depending on your network speed and the doorbell's response rate.

If you need to speed it up, you can add -T4 to use a more aggressive timing template. However, letting the default timing run gives more reliable results against IoT devices.

help me understand why my full port scan is taking so long

Document your findings in a text file

You now have two sets of results: detailed version information from the aggressive scan and a complete port list from the full scan. Combining these into a structured document creates Section 1 of your professional assessment report.

Open Notepad by pressing the Windows key, typing Notepad, and pressing Enter.
At the top of the file, type a header: Section 1: Port and Service Enumeration.
For each open port you discovered across both scans, record on a new line: the port number, protocol (TCP), service name, version (if detected by the -A scan), and any notable script output.
If the full port scan revealed ports that did not appear in your default scan, note those separately and mark them as "discovered only via full port scan."
Save the file to your Desktop as doorbell-assessment.txt by pressing Ctrl+S, navigating to your Desktop, and typing the filename.

What should each entry look like?

A good entry records everything a pentester needs at a glance. For example: the port number, whether it is TCP or UDP, the service name Nmap reported, the software version string (if any), and any script output that reveals extra detail about the service.

If Nmap could not determine the version for a port, record that too. "Version: not detected" is still useful information for your report.

Confirm doorbell-assessment.txt exists on your Desktop by checking in File Explorer. You should see the file listed.

Not sure what to write for a port?

Scroll up in your Command Prompt to review the aggressive scan output. Each open port has its information displayed in order: port/protocol, state, service, and version string. Copy these values directly.

If your Command Prompt scrollback has cleared, re-run nmap -A against your doorbell. The results will be identical.

help me document my Nmap scan findings in a structured format

Your -A scan output should show version strings (software names and version numbers) next to at least one open port. You may also see an "OS detection" section with a guess at the device's operating system. This is the actionable intelligence your basic scan could not provide.

You now have a complete picture of your doorbell's network footprint: every open port, the software behind it, and a documented record. Next up, you will capture live traffic to see what your doorbell actually does on the network.

Capture and Analyze Live Traffic

Port scanning told you what services are running on your doorbell. But it cannot tell you what the device actually does with those connections.

IoT devices are notorious for phoning home to cloud servers constantly, often sending data without encryption. Capturing live traffic with Wireshark exposes this behavior and uncovers vulnerabilities that port scanning alone cannot find.

In this step, get ready to:

Capture live network traffic from your doorbell during idle and active states.
Filter and analyze the captured packets to identify protocols, remote endpoints, and encryption status.
Document your traffic analysis findings as Section 2 of your assessment report.

Start a packet capture on your network

To observe the doorbell's real network behavior, you need to record all the packets it sends and receives over a period of time. You will capture during both idle and active states to see the full picture.

Switch to Wireshark (it should still be showing the interface list from earlier).
Identify the network adapter connected to the same network as your doorbell. On most home setups, this is your Wi-Fi adapter. Look for the interface with a sparkline showing activity.
Double-click that interface to start capturing immediately.

Packets start flowing into the packet list pane. You will see rows appearing rapidly with timestamps, source IPs, destination IPs, protocols, and info summaries.

What is happening right now?

Wireshark is recording every packet that crosses your selected network interface. This includes traffic from your own PC, your doorbell, and any other device sharing the adapter's network segment.

On a typical home network, you will primarily see traffic between your PC and the router, broadcast traffic, and DNS queries. Triggering doorbell activity (next step) generates traffic you can directly observe.

Let the capture run for 60 to 90 seconds with the doorbell idle. This captures baseline "phone home" behavior.
Now trigger activity on the doorbell: press the physical doorbell button, or open the Energizer Connect app on your phone to view the live video feed.
Let the capture continue for another 30 seconds after triggering activity.
Stop the capture by clicking Capture in the menu bar, then clicking Stop. You can also press Ctrl+E.

The packet list stops scrolling. You now have a frozen snapshot of all network activity during your capture window.

Not seeing any packets?

Make sure you selected the correct network interface. If you chose the wrong one, you will see zero packets. Close the capture without saving (File then Close), then double-click the correct interface to try again.

If Wireshark shows no interfaces at all, it may not have been installed with Npcap. Reinstalling Wireshark and ensuring Npcap is included should fix this.

help me figure out why Wireshark isn't capturing packets from my network adapter

Filter and analyze the doorbell's packets

Your capture contains traffic from every device on the network segment. To focus on just the doorbell, you will apply a display filter that isolates packets by IP address.

Before you apply the filter, take a guess: how many different protocols do you think your doorbell uses? Just one, or several?

Locate the filter toolbar at the top of the Wireshark window (just below the main toolbar). It has a text field that says "Apply a display filter".
Type the following display filter into that field, replacing the IP with your doorbell's actual IP address:

ip.addr==[[DOORBELL_IP="your doorbell's IP address"]]

Press Enter to apply the filter.

The packet list now shows only traffic to and from your doorbell. The total packet count drops dramatically because you filtered out everything else.

What does this filter do?

The ip.addr filter matches against both the source and destination IP address fields in every packet. Any packet where your doorbell's IP appears as either the sender or the receiver passes through.

If you wanted to see only traffic going TO the doorbell, you could use ip.dst instead. For traffic coming FROM the doorbell, use ip.src.

Look at the Protocol column in the filtered packet list. Note each unique protocol you see. Common ones include:
For any DNS packets, click on one and check the Info column. It shows the domain names your doorbell is looking up. These reveal exactly which cloud services the doorbell communicates with.
For any HTTP packets (not HTTPS/TLS), click on one and expand the packet details in the lower pane. Any data sent over HTTP travels unencrypted, meaning anyone on the network could read it. This is a security finding.

Not seeing much doorbell traffic?

On a switched home network, your PC may not see all unicast traffic between the doorbell and the router. You will reliably see DNS queries and any traffic generated when you open the Energizer Connect app from the same device. Triggering the doorbell button also generates observable connection activity.

Document your traffic analysis findings

Your filtered capture revealed the doorbell's real network behavior. Now you will record these findings as Section 2 of your security assessment report.

Open the text file where you documented Section 1 (your port and service findings from the previous step).
Add a new heading: Section 2: Traffic Analysis.
List each unique protocol you observed in the Protocol column (e.g., DNS, TLS, HTTP, RTSP, TCP, UDP).
List the remote IP addresses and domain names the doorbell communicates with. Pull these from DNS query responses and the destination IP column.
Flag any unencrypted communication (HTTP instead of HTTPS, plain TCP data streams) as a potential security finding.
For each finding, assign a severity: High for unencrypted data transmission, Medium for unnecessary open protocols, Informational for normal encrypted cloud communication.
Save the file.

What should a good Section 2 include?

A professional traffic analysis section covers: total capture duration, unique protocols observed, every external endpoint (IP and domain) contacted, whether each connection is encrypted, and a finding + severity for anything concerning.

Even "everything is encrypted" is worth documenting. It tells the client the device handles transport security properly.

Confirm your report now has two complete sections: port/service enumeration from Step 3, and traffic analysis from this step.

Unsure what counts as a finding?

If you see any HTTP traffic (not HTTPS), that is a finding. If you see the doorbell contacting unexpected domains unrelated to Energizer's services, that is a finding. If all traffic is TLS-encrypted to expected cloud endpoints, document that as a positive security observation.

help me decide what counts as a security finding in my doorbell traffic analysis

Secret mission

Test the Web Interface for Default Credentials

Default credentials are the number one IoT vulnerability. In this mission, you'll probe your doorbell's web interface for factory-default logins and document a full authentication test, completing your professional assessment report.

Clean Up Your Resources

This project runs entirely locally on your Windows machine, so there are no ongoing cloud costs or subscriptions to worry about. Decide whether to keep your files for future reference, close running processes to free up memory, or delete everything entirely.

Resources you used:

IoT security assessment report (text file you created during the project).
Wireshark packet capture file(s) saved during Step 4.
Open processes: Command Prompt (Administrator), Wireshark, web browser.

Keep everything running

No action needed. Choose this if you plan to continue exploring your doorbell's security or want to run additional scans later.

Your assessment report stays wherever you saved it for future reference or portfolio use.
Your Wireshark capture file is preserved so you can revisit traffic patterns or apply new filters later.
Nmap and Wireshark remain installed on your system for future penetration testing projects.

Pause - I'll come back to this later

Close running processes to free up system memory while keeping your project files intact.

Close the Command Prompt window (type exit and press Enter).
In Wireshark, save any unsaved capture if prompted, then close the application.
Close the browser tabs you used to access the doorbell's web interface.
Your report file and capture file remain on disk for when you return.

Delete - I don't want to use this again

Remove all project files created during this assessment. Nmap and Wireshark remain installed since they were on your system before this project.

Close Wireshark and the web browser.
Delete your assessment report text file. In your Command Prompt, navigate to where you saved it and run:

del [[REPORT_FILE="your-report-filename.txt"]]

Delete your Wireshark capture file(s). Navigate to where you saved them and run:

del [[CAPTURE_FILE="your-capture-filename.pcapng"]]

Close the Command Prompt window by typing exit and pressing Enter.

Nice Work!

You just completed a professional-grade IoT security assessment on your own Energizer Connect doorbell. You performed the exact same reconnaissance and traffic analysis workflow that pentesters use on their first day of an engagement.

You've learned how to:

Perform network reconnaissance on a real IoT device using Nmap, discovering open ports, running services, exact software versions, and operating system fingerprints.
Capture and analyze live network traffic using Wireshark, identifying protocols, cloud endpoints, and encryption status to uncover what your device does behind the scenes.
Produce a structured IoT security assessment report with severity ratings following the same format professional pentesters deliver to clients.
Tested a web interface for default credential vulnerabilities, the number one IoT weakness according to the OWASP IoT Top 10.

Ready to quiz yourself?