Category: SCADA Hacking

As a penetration tester/hacker, we have many resources we can use to test SCADA/ICS system security. One of the most popular is the Metasploit Framework. Here, I have tried to compile a list of most of the Metasploit modules that are useful for testing/hacking SCADA/ICS. Please keep in mind that SCADA/ICS sites use varied hardware […]

SCADA/ICS systems use many different protocols to communicate than your standard IT systems. The most widely used and the de facto standard is the modbus protocol. First developed by Modicon (now Schneider Electric) in 1979 as a serial protocol, it has been modified and updated to run over TCP and is often referred to as […]

In the previous article in this series, we built a sophisticated, low-interaction SCADA honeypot with conpot. In this article, we will now test that Honeypot to see what it looks like to an outside attacker. It’s critical that our HoneyPot look and act like an authentic SCADA system, if we are to be successful in […]

In this tutorial, we will be setting up a SCADA/ICS Honeypot. As you know, a honeypot is a computer system that looks and acts like a vulnerable system. This particular honeypot is on an Ubuntu system with several SCADA protocols including modbus. Honeypots can be used to study attackers or divert them from more valuable […]

Maybe not surprisingly, many SCADA systems still are authenticated with their default passwords from the manufacturer. SCADA security managers have relied upon “security by obscurity”, but those that do now–with Shodan and these passwords–will soon be looking for a new position! Enjoy!

SCADA sites are among the most vulnerable sites on the planet. These sites include industrial control systems, water treatment facilities, nuclear power plants, the electrical grid and just about any other industrial facility. These sites are likely to be the targets in any cyber war, or worse, targets of a cyber terrorist attack. Although we […]

Welcome back, my hacker novitiates! With this lab, we will conduct recon on a SCADA target using port scanning and nmap scripts. Up until this point we have used passive recon using Shodan and Google dorks, but now we will be using a more active approach to find SCADA systems and do some active reconnaissance […]

Welcome back, my aspiring cyber warriors! Previously, I wrote a tutorial on using Shodan–the world’s most dangerous search engine–to find unprotected web cams. As you know, Shodan simply scans the world’s IP addresses and pulls the banner and then indexes those banners. We can then search through Shodan for the parameters revealed in those banners […]