This tool is from Jonathan Squire's presentation "A Fox in the Hen House (UPnP IGD)", presented at Blackhat 2008.

[UPnPwn] and its associated libraries are implemented in the Ruby programming and provide basic classes for interacting with SSDP and UPnP enabled devices
UPnPwn itself: hxxp://
Presentation video: hxxps://
Presentation audio: hxxps://
White Paper: hxxp:// aper.pdf

"Quickstart Guide" to perk your interest:
Add a port forward from ANY -> WAN:1234/TCP ->
./UPnPwn.rb  --portmap add 1234 TCP

Delete portmap ANY -> WAN:1234/TCP ->
./UPnPwn.rb --portmap del 1234 TCP

Add a port forward from -> WAN:4444/TCP ->
./UPnPwn.rb --portmap add 4444 TCP 5555

Delete portmap -> WAN:4444/TCP ->
./UPnPwn.rb --portmap del 4444 TCP

Run a test server (for testing your portmappings, it will run on
./UPnPwn.rb --test_server

List all portmappings on a device
./UPnPwn.rb --list

Listen to the network for all SSDP traffic (this is a good way to find other UPnP Devices)
./UPnPwn.rb --ssdp_listen

Get info about first found IGD
./UPnPwn.rb --info