Practical Industrial Control System Penetration Testing

Explore default credentials for industrial control systems, and use Google and Shodan to locate exposed ICS and vulnerabilities on the CSA website, highlighting attacker techniques and operator security awareness gaps.

Examine how open source intelligence and osint techniques uncover default credentials in industrial control systems, highlighting vendor patterns, password risks, and the need for regular password changes.

Learn how Google dorks expose industrial control systems via Google Docs, filter ICS lists by vendor and product, and identify poorly configured Siemens S7 web servers exposed online.

Explore Shodan, a search engine for IoT and control systems, to locate exposed PLC devices, perform banner grabbing, and search for protocols like Modbus and S7 Comm on port 102.

Scan the public IP range with Shodan using the net filter to identify exposed Siemens controllers and ports like Telnet and SSH; banner grabbing reveals module coding and firmware version.

Identify a target system and firmware version, then research vulnerabilities on tsa.gov by filtering cybersecurity alerts for S7 300 to uncover affected versions and mitigation steps.

Set up your ICS lab by learning virtualization basics, building a virtual network, and installing software to configure virtual machines for a reusable pen test and simulation platform.

Set up a VirtualBox lab with two VMs—Ubuntu server and Kali Linux—for industrial control system tool deployment and attacks. Utilize host-only and bridged networking to access tools and the internet.

Install and configure VirtualBox, including the Windows host package and network interfaces. Set up host-only networking with 10.1.0.100 and DHCP 10.1.0.10 to prepare the penetration testing platform and simulated PLCs.

Download Kali Linux from kelly.org and choose VirtualBox to start the lab. Unpack the downloaded file into the lab folder, then add the VM in VirtualBox and complete setup.

Download Ubuntu desktop, create a VirtualBox VM with 8 GB RAM and 25 GB disk, bridge the network, install VirtualBox guest additions, and complete the initial Ubuntu server setup.

Configure the virtual machine with a bridged network and complete a two-step ubuntu setup for an ICS lab. Install ssh via nano-created scripts, reboot, and launch the emulated lab environment.

Set up Kali Linux for ICS testing by configuring bridged networking, enabling clipboard, and German keyboard, then run a script to install open-source pentesting tools and Modbus Pal.

Explore onboard Kali Linux and open source pen testing tools for industrial control systems, and practice scanning targets with Nmap and testing exploits on simulated controllers.

Boot Ubuntu server PLC VM and Kali Linux VM, open terminal, run run.sh to spawn honeypots, then switch to Kali Linux and practice sudo with tool name, IP, and port.

Perform host discovery with netdiscover to identify active devices by scanning a CIDR range, using mac address vendor detection to estimate device types, and stop the scan with ctrl+c.

Apply Nmap fingerprinting to industrial control systems by skipping host discovery with -Pn, scanning TCP and UDP ports, enabling version detection and Nmap scripting engine, and adjusting timing for scans.

Explore enumeration with snmp-check to extract device information from SNMP on UDP port 161, gathering vendor, model, firmware, and serial data to support ICS pentesting.

Explore the metasploit framework as a penetration testing toolkit, using core commands like set, set g, search, use, info, and options to load modules such as modbus and configure targets.

Explore open source tools for industrial control system pentesting, including plc scan, ICS security scripts, Siemens scan, and the Modbus command line interface, with a practical hands-on on simulated systems.

Refresh your pentesting toolkit as you begin the Siemens S7 PLC simulation, warm up before the SNAP seven setup, and change the Ubuntu VM's MAC address.

Search Shodan for exposed Siemens PLC devices using port 102, then extend the search with the vendor to identify the product series and model numbers.

Search port 102 for the S7 protocol hosts with shodan; banner grabbing shows product details for Siemens and Symantec devices, and including cpu type digits refines the results.

Filter the Excel spreadsheet for Siemens and perform a Google Docs search with the terms to locate publicly exposed devices as part of practical industrial control system penetration testing.

Filter an Excel spreadsheet for Siemens to surface docs locating Siemens devices on Google, verify a Siemens S7 1200 PLC, and halt the exercise due to legal gray areas.

Use Shodan and Google to locate exposed Siemens devices online, then search the Excel spreadsheet for default credentials for Siemens devices.

Filter for Siemens to reveal 13 entries containing default credentials for Siemens industrial switches and industrial controllers.

Conduct a vm lab pen test with Kali Linux and Ubuntu Server, using Shodan and Google Docs to locate internet-facing Siemens PLCs, start Run.sh, and map network with netdiscover cidr.

Identify your IP and network from ifconfig, then perform host discovery on 10.1.0.0/24 with sudo net discover -r, revealing three active hosts and vendor MAC addresses for further analysis.

Run two simultaneous nmap scans: sweep all tcp ports (1–65535) on the target with sudo nmap, and scan udp port 16100 in a second terminal to identify open ports.

We scan tcp ports 1 to 65535 and udp port 16100 with nmap, skipping host discovery. The com port remains undetected and snmp on udp 16100 is not detected.

Perform an SNMP enumeration using the SNMP check tool against port 16,100 to identify SNMP servers and gather information about the target.

Use the snmp enumeration tool to gather information on the target by running the snp check with port 16,100 on the target IP address.

Advance your pen testing skills by using the Nmap scripting engine in Kompot and integrating external exploits into Metasploit, after verifying your Mac address matches the course materials.

Boot the Ubuntu server plc and Kali Linux VM, run ./Run.sh to emulate Siemens S7-300 (emulation 3), then use ifconfig and sudo netdiscover -r for host discovery.

Identify host and network from your ip with ifconfig and a subnet mask, then run sudo net discovery on the network to detect devices, including Siemens via MAC vendor detection.

Scan the full TCP port range 1 to 65,535 on the Siemens device with nmap using dash p n, skipping host discovery and the UDP scan.

Run a nmap scan on the target IP with sudo nmap -Pn -p 1-65535 to identify open ports, finding ports 22 and 102 with further analysis planned for port 102.

Explore scanning port 102 with the Nmap scripting engine, using --script to run a chosen NSE script, and locate suitable S7 scripts for Siemens devices in the Nmap share.

Locate S7 scripts with find, then run the Nmap S7 Info NSC script against target on port 102, skipping host discovery to pull module, version, system name, and serial number.

Navigate to the PLC scan folder, display its contents, and run the legacy plc scan script with the target IP using Python 2 to pull information from the target.

Run a python plc scan against a target ip; it checks tcp ports 102 or 502 and extracts information, including the target's memory card serial number.

Start the Metasploit framework with MSF console, search for Siemens modules, and then search the exploit DB for Siemens exploits.

Learn to add external exploits to the Metasploit framework by locating Siemens Profinet exploits, loading them with use and info, and placing the exploit file in the framework's modules/exploits directory.

Learn practical industrial control system penetration testing by loading an external metasploit module for siemens simatic s7 plc, setting hosts, changing mode to stop, and running the module.

Set the global target IP with set host 10.1.0.1, switch to stop mode, and run on Ubuntu Server to verify status. The system rejects a malformed PDU, indicating no vulnerability.

Examine the SiemensScan ICS security script, run with sudo python3 Siemens_scan.py, and perform Profinet discovery via Metasploit. Learn manual IP entry and basic info display before moving to real hardware.

See how pen test tools work on real Siemens S7 hardware, using compote and SNAP seven, SNMP check, Nmap scripting, Metasploit modules, and Siemens security scripts to disrupt a process.

Identify the host and network from the IP and subnet, then fingerprint a Siemens S7 PLC with netdiscover, Nmap, SNMP checks, and the S7 info script.

Apply metasploit to enumerate and exploit the Siemens S-7 controller using the profinet scanner, retrieve type name, vendor, and subnet data, stop the PLC, and restart it without authentication.

Use open source tools to run PLC scan and Siemens level two discovery, extracting device details and manipulating outputs or CPU state on a target PLC.

Learn how industrial control systems in gas stations are simulated and tested for security, including osint recon, a telnet attack, and manipulating alarms, limits, and network settings.

Explore the gas station inventory controller's communication interface on port 10,001 using Shodan to count online devices. Analyze device function code 201 00 to determine exposed units.

Search port 10,001 on Shodan to reveal exposed devices, refine to gas station controllers with function code i 201 zero zero, and validate addresses using Google Maps.

Kick off a practical industrial control system pentest by launching Ubuntu Server and Kali Linux in a VM, starting gas station controller emulation, and performing ssh-based IP and NAT discovery.

Identify the ip address with ifconfig to derive the network and host parts, then use sudo net discover to scan the 10.0.0.0/24 range for mac address vendor detection.

examine this IP address with Nmap by starting Nmap, define the destination IP address, and specify the port range with -p to scan all TCP ports from 1 to 65,535.

Start nmap with the destination IP and port range 1-65535 to scan all tcp ports, and note that port 10001 is open for later examination.

Examine open port 10001 with Nmap, specify the target IP and port, and start the Nmap scripting engine; explore gas station inventory systems (ATG) and related Nmap scripts.

Demonstrate using nmap NSE scripts to locate and run a specific ATG info script, scan a target IP and port, and interpret returned controller function data, with honeypot detection.

Perform an OSINT task with a scan to pull data using i2 and 100, identify vendor, and note gas station controllers’ exposure online (ATG) and inventory system communication.

Explore osint methods to locate gas station inventory system manuals and pdfs, then reveal exposed controllers via telnet on port 10001 using function codes.

Communicate with the target via Telnet on port 10001 by sending a control character and a function code; explore over 600 serial interface function codes in the honeypot.

Demonstrate issuing function codes with control characters to retrieve inventory, delivery, leak monitoring, current shift, and current status reports for industrial control system penetration testing.

Explore Modbus based controllers in real-time fieldbus systems, assess unencrypted Modbus security, conduct osint driven exposure checks, and practice pen testing with Metasploit and Kompot in a simulated Modbus honeypot.

Learn to use Shodan to identify devices on Modbus port 502, count exposed devices, search for Schneider Electric on port 502, and refine the query by model.

Search port 502 with Modbus to locate exposed devices, then use Shodan banner grabbing to read data and reveal details like Schneider Electric Modicon M22.

Use Excel-listed vendor terms to perform a Google search targeting publicly exposed web servers of Schneider Electric devices.

Use Google dork techniques to locate Schneider Electric devices with web servers. Refine searches to industrial web control, encounter login prompts, and acknowledge the legal grey area.

Inspect the default credentials list in your Excel spreadsheet to identify default credentials for Schneider Electric devices.

Identify the default credentials for Schneider Electric devices by filtering the default credentials list for Schneider, revealing 12 entries.

Explore lab-based penetration testing of exposed Schneider Electric devices using Shodan and Google Docs, boot Ubuntu Server and Kali Linux virtual machines, and perform Modbus port 5020 testing with netdiscover.

Use ifconfig to read the ip and subnet mask, start net discover on 10.0.0.0/24, and note the mac address with Schneider Electric as detected vendor.

Examine an IP address with Nmap, start with XPN, skip host discovery, specify the destination IP, and use dash P to set the target port range for a tcp scan.

Perform a full TCP port range nmap scan with host discovery disabled, identify open ports on a honeypot, and examine port 5020 where Modbus is suspected but misdetected.

Start the Metasploit framework to investigate Modbus activity on port 5020 after Nmap did not detect it, then search for Modbus modules and prepare to run them against the target.

Search modbus in metasploit to identify scanners and modules; use the modbus client to read inputs and manipulate registers, and upload or download logic to start or stop the PLC.

Run modbus metasploit modules against the target to detect modbus operation, identify the station number via unit id, and banner grabbing, noting other modules fail on the honeypot.

Learn to run metasploit modules against a modbus target, configure global host and port (port 5020), and perform banner grabbing and unit ID discovery on a honeypot.

Explore direct interaction with the memory contents of Modbus controllers, following prior investigations, and learn how memory can be manipulated without authentication in this second part.

Start the modbus simulation on Kali Linux, add a modbus device and holding registers, run the modbus server, then discover your IP with ifconfig and scan the port with nmap.

Demonstrates using Nmap to scan all TCP ports from a VM, skipping host discovery, detect Modbus on port 502, and run the Modbus Discover script with the Nmap scripting engine.

Launch the Metasploit framework, load Modbus modules, and identify whether Modbus is running on the target and determine the target's unit ID.

Explore using a metasploit modbus module to detect modbus tcp targets, set the host IP, check unit IDs, and read or manipulate PLC registers, with a future command line alternative.

Learn to read and write memory blocks from a modbus device using the modbus cli, specifying the target IP address, start address, and length for memory data.

Read memory blocks solution demonstrates reading the first ten memory blocks by setting a starting address with percent zero followed by a ten, directly accessing memory content from blocks 0–10.

Execute a Modbus command to override memory content with zeros by specifying the target IP and memory address. Verify zeros in Modbus Pal during pentesting while noting address indexing differences.