/ot-security-assessment

name: ot-security-assessment
description: >
  Operational Technology (OT) security assessment using a two-stage methodology: (1) Identification/Discovery
  of OT devices and protocols, and (2) Vulnerability Assessment using online sources and Metasploit. Use when:
  (1) Conducting authorized OT/ICS security assessments, (2) Identifying and enumerating OT protocols
  (Modbus, S7, IEC 104, DNP3, BACnet, EtherNet/IP), (3) Discovering industrial control devices and PLCs,
  (4) Assessing OT protocol vulnerabilities and security weaknesses, (5) Performing compliance scanning
  aligned with IEC 62443 standards, (6) Validating network segmentation and access controls in OT environments.
version: 0.1.0
maintainer: https://github.com/i8void/
category: offsec
tags: [ot, ics, scada, modbus, siemens, industrial-security, vulnerability-assessment, reconnaissance]
frameworks: [MITRE-ATT&CK, IEC-62443, PTES]
dependencies:
  packages: [nmap, metasploit-framework, python3]
  tools: [modbus-cli, plcscan, python-snap7, pymodbus]
references:
  - https://nmap.org/book/
  - https://docs.rapid7.com/metasploit/msf-overview/
  - https://www.cisa.gov/news-events/cybersecurity-advisories
  - https://attack.mitre.org/techniques/T1046/
  - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards

OT Security Assessment

Overview

This skill provides a structured methodology for conducting Operational Technology (OT) and Industrial Control System (ICS) security assessments. The approach follows a two-stage methodology: (1) **Identification/Discovery** of OT devices, protocols, and services, and (2) **Vulnerability Assessment** using online vulnerability databases and Metasploit Framework for deeper analysis.

**IMPORTANT**: OT security assessments may impact critical industrial processes and must only be conducted with proper authorization. Always ensure written permission before assessing OT systems. Never test production systems without explicit authorization.

**OT Network Security Considerations**:

• Well-secured OT systems will not allow internet-connected devices (like this system) to be plugged into the network for assessment
• Most production OT assessments will be conducted offline on air-gapped networks
• This skill is suitable for:
• Less secure or open OT/SCADA systems
• Lab environments and test networks
• Authorized assessment scenarios where network isolation is managed separately
• Always coordinate with operations team to ensure proper network isolation and security controls

Quick Start

Basic OT device discovery and protocol enumeration:

# TCP Connect scan for common OT ports (no root required, safer for OT)
nmap -sT -p 502,102,2404,20000,47808,2222 <target-ip>

# Modbus enumeration (no root required)
nmap -p 502 --script modbus-read-registers,modbus-read-coils <target-ip>

# Comprehensive OT scan with service detection (no root required)
nmap -sV -p 502,102,2404,20000,47808,2222 --script modbus-read-registers,s7-info,bacnet-info <target-ip>

Placeholder System

When executing commands, replace these placeholders with actual values:

• `<target-ip>` - Single IP address (e.g., `192.168.1.100`)
• `<target-network>` - IP range in CIDR notation (e.g., `192.168.1.0/24`)
• `<rhost>` - Remote host (Metasploit) - IP address or hostname
• `<rport>` - Remote port (Metasploit) - Port number
• `<unit-id>` - Modbus unit ID (typically 1-255)

Core Workflow

Workflow Checklist (for complex operations)

Progress: [ ] 1. Verify authorization and scope for OT assessment [ ] 2. Perform network discovery and identify live hosts [ ] 3. Scan for common OT protocol ports [ ] 4. Enumerate OT protocols and identify devices [ ] 5. Gather device information and service versions [ ] 6. Research vulnerabilities using online sources [ ] 7. Perform vulnerability assessment with Metasploit [ ] 8. Document findings and generate assessment report [ ] 9. Validate results and identify false positives

Work through each step systematically. Check off completed items.

1. Authorization Verification

**CRITICAL**: Before any OT assessment activities:

• Confirm written authorization from system owner and operations team
• Review scope document for in-scope IP ranges and OT systems
• Verify scanning windows and rate-limiting requirements (OT systems are sensitive)
• Document emergency contact for accidental disruption
• Confirm blacklisted hosts (production PLCs, safety systems, critical infrastructure)
• Coordinate with operations team for safe testing windows

2. Network Discovery

Identify live hosts in target OT network:

# Ping sweep (ICMP echo)
nmap -sn <target-network>/24

# ARP scan (local network only, faster and more reliable)
nmap -sn -PR <target-network>/24

# TCP SYN ping (when ICMP blocked, use OT ports)
nmap -sn -PS502,102,2404 <target-network>/24

# Disable ping, assume all hosts alive (common in OT networks)
nmap -Pn <target-network>/24

# Output live hosts to file
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt

**OT Network Discovery Techniques**:

• **ICMP Echo (-PE)**: Standard ping, often blocked in OT networks
• **TCP SYN (-PS)**: Half-open connection to OT protocol ports (502, 102, etc.)
• **UDP (-PU)**: Sends UDP packets to OT UDP ports (47808 for BACnet)
• **ARP (-PR)**: Layer 2 discovery, only works on local network segment

3. OT Protocol Port Scanning

Scan discovered hosts for common OT protocol ports:

# TCP Connect scan for common OT protocol ports (no root required)
nmap -sT -p 502,102,2404,20000,47808,2222,161,623 -iL live_hosts.txt

# Comprehensive scan with service detection (no root required)
nmap -sV -p 502,102,2404,20000,47808,2222 -iL live_hosts.txt -oA ot_scan

# UDP scan for OT protocols (BACnet, SNMP) - requires root
sudo nmap -sU -p 47808,161,623 -iL live_hosts.txt -oA ot_udp_scan

**Common OT Protocol Ports**:

• **502**: Modbus TCP
• **102**: S7/Siemen