How many 0days can a research team discover in 4 years of vulnerability research in IoT? How many of them are relevant and can be used even today? How to get started (or advance further) with IoT vulnerability research? This talk will answer all these questions and show some hands-on shell-popping and authentication bypasses as well as some new stuff being published especially for RSAC 2021.