ICS fieldbus protocol penetration testing covering all major industrial protocols BEYOND Modbus TCP. This domain specializes in the protocols that govern power utilities, oil & gas, water treatment, building automation, and discrete manufacturing. The skill targets protocols that scada-ics-security either omits or only covers superficially.
Industrial fieldbus protocols are the central nervous system of critical infrastructure. Unlike Modbus TCP (covered by scada-ics-security), these protocols vary dramatically across industry verticals:
Power utilities use DNP3, IEC 60870-5-101/104, IEC 61850 (GOOSE/SV/MMS), and ICCP/TASE.2 — these protocols were the targets of the Ukraine 2015 (BlackEnergy) and 2016 (Industroyer/CrashOverride) attacks that caused widespread blackouts.
Process automation (oil & gas, chemical) uses Foundation Fieldbus, HART, and PROFIBUS PA for intrinsically-safe instrument communication in hazardous areas.
Discrete manufacturing uses PROFINET, EtherCAT, and EtherNet/IP for sub-millisecond motion control loops that tolerate zero disruption.
Building automation uses BACnet for HVAC, lighting, and physical access control.
Automotive and railway fieldbuses (CAN, LIN, FlexRay, MVBC) are covered in — this skill focuses on plant-side manufacturing and infrastructure.
automotive-vehicle-security
Each protocol family has its own framing, addressing model, security model (or lack thereof), and exploitation patterns. This skill provides deep-dive testing methodologies for all of them.
Safety bypass: Disable SIS (Safety Instrumented System) before main attack.
Differentiation
This skill is distinct from and complementary toscada-ics-security:
Aspect
scada-ics-security
ics-fieldbus-attack (this skill)
Primary scope
Modbus TCP, S7comm, EtherNet/IP basic, OPC UA
Fieldbus protocols beyond Modbus
Power utility coverage
Brief DNP3 mention
Deep DNP3, IEC 60870-5-101/104, IEC 61850 (GOOSE/SV/MMS)
Process automation
None
Foundation Fieldbus H1/HSE, HART/WirelessHART
Discrete manufacturing
None
PROFINET RT/IRT, EtherCAT, CC-Link IE
Building automation
Brief BACnet mention
Deep BACnet object model, BACnet/SC, WriteProperty exploitation
Layer-2 attacks
GOOSE mention only
Full GOOSE/SV frame injection at Layer 2, multicast spoofing
Real-world incident focus
Stuxnet reference
BlackEnergy 2015, Industroyer 2016, Triton 2017, Florida water 2021
Fuzzing
csric generic
Boofuzz templates per protocol family
Tool depth
8 tools, basic usage
13 tools, protocol-specific dissectors and crafters
Target vertical
Generic ICS
Power utility, process, manufacturing, building
If the engagement target is a power utility, water/wastewater, or natural gas distribution facility, this skill is primary. If the target uses Modbus TCP or Siemens S7 PLCs in a factory floor, scada-ics-security may suffice.
Use Cases
DNP3 Outstation Assessment — Enumerate DNP3 outstations, read analog/binary points without authentication, test Direct Operate (FC 5) command authorization
IEC 60870-5-104 (TCP) Replay and Injection — Capture and replay APDU commands to RTUs, test for ASDU type 45 (command) authorization
IEC 61850 GOOSE Frame Injection — Forge Layer 2 GOOSE messages with elevated stNum to spoof breaker status or trip protection relays
IEC 61850 MMS Server Assessment — Enumerate IED logical nodes, read/write SetDataValues, test MMS authentication
PROFINET IRT Real-Time Spoofing — Inject forged real-time frames into the PROFINET cycle to disrupt motion control
Protocol-aware fuzzer with fieldbus templates (DNP3, IEC 104, GOOSE, Modbus)
python3 fuzz_dnp3.py --target 192.168.1.10:20000
Conpot
Honeypot emulating ICS protocols including Modbus, S7comm, IEC 104
conpot -f --template iec104_honeypot
Nmap NSE
Script engine with ICS dissectors: dnp3-info, enip-info, s7-info, BACnet-discover, modbus-stuxnet
nmap -p 20000 --script dnp3-info 192.168.1.10
Ettercap / Bettercap
ARP poisoning and MITM with custom filters for ICS protocol mutation
bettercap -iface eth0 -caplet IEC104-mitm.cap
Claroty / Nozomi (reference)
Commercial passive ICS asset discovery and monitoring — use for client-side validation
(Vendor reference; for comparison only)
Methodology
Phase 1: Passive Reconnaissance (Read-Only, Safe)
Traffic Capture Setup — Configure span port or network tap on OT switch; never introduce active devices into a fieldbus segment without explicit authorization. For PROFIBUS/PROFINET, use a ProfiShark tap.
Protocol Dissection — Use Wireshark with fieldbus-specific display filters to identify protocols in use: dnp3, iec60870_asdu, iecgoose, pn_mrp, pn_dcp, ecat, ff_h1, hart_ip, bacnet, cip.
Master-Slave Topology Mapping — Map which IPs are masters (pollers) versus slaves (responders) by analyzing request-response patterns. Identify polling intervals and device addresses.
Baseline Traffic Capture — Record 24+ hours of traffic for anomaly baseline. Fieldbus traffic is highly periodic; deviations indicate either failures or attacks in progress.
Command Authorization Testing — For each protocol, attempt command operations and verify whether authentication is enforced:
DNP3: Try Direct Operate (FC 5) without authentication
IEC 104: Try ASDU type 45 (single command) without auth
IEC 61850 MMS: Try SetDataValues on control objects
BACnet: Try WriteProperty to Present_Value on Analog Output objects
PROFINET: Try Connect/Release cycle control
Register/Point Enumeration — Systematically enumerate all readable points to map process state (temperatures, pressures, breaker positions, valve states).
Protocol Behavior Fingerprinting — Send malformed requests and record exception responses. Each vendor handles malformed input differently — useful for fingerprinting.
Phase 4: Vulnerability Assessment
CVE Cross-Reference — Match discovered firmware versions against ICS-CERT, ISA-99, and vendor advisory databases. Note: many ICS CVEs are disclosed years after discovery.
Protocol Fuzzing — Use Boofuzz with protocol-specific templates to identify parser crashes:
DNP3 fuzz template: link layer, transport layer, application layer
IEC 104 fuzz template: ASDU structure, cause of transmission, IOA ranges
Modbus fuzz template: function code coverage, register range overflow
Authentication Bypass Testing — Test Secure Authentication Version (SAv) downgrade attacks on DNP3; test certificate bypass on IEC 61850 MMS; test BACnet/SC vs legacy BACnet/IPv4 fallback.
Replay Attack Validation — Capture legitimate command sequences and replay with tcpreplay. Many protocols accept replays without nonce/timestamp validation.
Phase 5: MITM and Injection (High Impact, Lab Only with Operator Awareness)
ARP Poisoning — Use Ettercap or Bettercap to position the attacker between master and slave. Verify with traffic capture.
Custom Filter Development — Write protocol-aware filters that mutate specific fields (setpoints, breaker commands) while passing other traffic unchanged.
Layer-2 GOOSE/SV Injection — Forge GOOSE frames with elevated stNum values to override legitimate device status. This is a real-world attack vector used by Industroyer.
Real-Time Cycle Disruption — For PROFINET IRT and EtherCAT, inject frames into the real-time cycle to test device fault tolerance. WARNING: This can cause physical damage.
Command Injection — During MITM, inject unauthorized control commands. Use lab replicas of physical processes to assess safety impact.
Phase 6: Reporting and Remediation
ICS Risk Scoring — Apply ISA-99 / IEC 62443 risk scoring that accounts for safety implications, not just confidentiality/availability/integrity.
Purdue Model Gap Analysis — Document segmentation violations, cross-zone paths, and DMZ bypass.
No Built-in Security by Design — DNP3, IEC 60870-5, IEC 61850 GOOSE, PROFIBUS, and Foundation Fieldbus H1 were all designed before cybersecurity was a concern. Authentication and encryption are afterthoughts layered on via DNP3 SAv, IEC 62351, and BACnet/SC.
Determinism Trumps Security — Real-time protocols (GOOSE, PROFINET IRT, EtherCAT) prioritize deterministic timing (sub-4ms transfer) over encryption, which adds latency. This is why TLS on GOOSE is impractical for time-critical operations.
Long Equipment Lifecycles — Fieldbus devices deployed 20+ years ago remain in service. Firmware updates are rare, risky, and require planned outages. Patches that break compatibility are unacceptable.
Physical Process Risk — A fieldbus attack is not a data breach — it is a potential physical catastrophe. Industroyer (2016) opened breakers and crashed power grids. Triton (2017) modified Safety Instrumented System logic.
IEC 62443 Defense Architecture
The IEC 62443 standard defines zones and conduits for OT security:
Unsolicited Link Reset, Direct Operate from non-master IP, SAv downgrade attempts
Suricata dnp3 rules, Nozomi Guardian
IEC 104
ASDU type 45 (command) outside operational hours, ASDU type 70 (interrogation) from unknown IPs
Suricata iec60870 rules, Claroty
GOOSE
stNum jumps >1, sqNum wraparound, new source MAC on multicast group
Wireshark GOOSE analysis,_dragos
MMS
Unauthorized SetDataValues, new client certificate
IEC 61850 security gateway
PROFINET
DCP Identify from non-engineering MAC, unexpected RT cycle disruptions
PROFINET diagnostic, Tenable.ot
EtherCAT
Mailbox overload, slave state transitions outside maintenance windows
EtherCAT diagnostic, Claroty
BACnet
WriteProperty to Present_Value, ReinitializeDevice, Who-Is floods
Wireshark BACnet analysis, Black Lantern
HART
Loop current anomalies, WirelessHART join from unknown EUI-64
HART gateway diagnostics
Hardening Measures
Upgrade Protocol Versions — Where supported, migrate to DNP3 Secure Authentication v5, IEC 62351-secured IEC 61850, BACnet/SC.
Deploy Protocol-Aware Firewalls — Use Tofino, Bayshore, or Clarke-Taylor firewalls that decode and validate ICS protocols at Layer 7.
Implement Unidirectional Gateways — For critical zones (generation, transmission), deploy Waterfall or Owl data diodes that physically prevent inbound traffic.
Segment Multicast Domains — GOOSE, PROFINET, and EtherCAT use multicast. Restrict multicast to dedicated VLANs and enforce port security on switch ports.
Certificate-Based Authentication — For MMS, OPC UA, and BACnet/SC, mandate X.509 certificates from a managed CA. Disable anonymous access.
Continuous Asset Inventory — Deploy passive ICS discovery tools (Claroty, Nozomi, Dragos) to maintain real-time asset inventory. Active scanning is too risky for production OT.
Operator Training — Train operators to recognize fieldbus attack indicators: unexplained breaker operations, setpoint changes without operator action, GOOSE stNum anomalies in HMI logs.
ICS Fieldbus Attack Matrix
The matrix below maps attack techniques to fieldbus protocols. Use this to plan engagement scope based on which protocols the target facility operates.
Hardcoded ICS payloads execute: open breakers, disable protection relays
DoS module floods the upstream communications server
Wiper module destroys evidence on exit
Scenario 3: Triton/Trisis 2017 (Triconex SIS)
Initial access via engineering workstation phishing
Attacker gains access to TriStation 1131 SIS programming environment
Trojanized firmware deployed to Triconex MP3008 controllers
SIS fails to trip on demand during intentional process upset
First known malware designed to disable physical safety systems
Scenario 4: Florida Water Treatment 2021 (Remote HMI)
Compromised TeamViewer credentials (reused password) on HMI
Attacker connected remotely and changed sodium hydroxide setpoint
Setpoint changed from 100 ppm to 11,100 ppm (100x normal)
Operator detected change within 90 seconds and reverted
No physical harm, but demonstrated feasibility of remote mass-casualty attack
Safety Considerations
Fieldbus Safety Doctrine
Fieldbus attacks are qualitatively different from IT penetration tests. A successful write to a holding register or a forged GOOSE frame can:
Open circuit breakers on transmission lines, causing regional blackouts
Modify setpoints on chemical dosing pumps, contaminating water supplies
Disable safety instrumented systems, allowing process upsets to cascade
Trigger spurious trips on protection relays, isolating healthy equipment
Disrupt motion control cycles, damaging multi-million-dollar machinery
Pre-Assessment Safety Requirements
Before any active testing on a fieldbus network:
Written authorization must explicitly identify in-scope protocols, devices, and zones. Exclusions must include Safety Instrumented Systems (SIS), emergency shutdown systems, and any device whose failure could cause injury or environmental release.
Operations team must be present during all active testing. Establish a clear stop signal and abort procedure.
Production system testing is generally prohibited. All write operations, fuzzing, and DoS testing must occur on lab replicas. Where production testing is unavoidable (rare), it must occur during planned outages.
Identify SIS boundaries and ensure they are air-gapped or out-of-scope.
Have emergency contacts for facility safety officer, shift supervisor, and incident response.
Never disrupt real-time cycles — PROFINET IRT, EtherCAT, GOOSE operate on sub-millisecond cycles. Any introduced latency can cause faults.
Respect polling intervals — DNP3 and IEC 104 masters poll every 1-5 seconds. Injected traffic must fit between polls.
Multicast traffic requires care — GOOSE and PROFINET multicast floods can saturate switch buffers and crash uninvolved devices.
Serial protocols have no network control — Profibus DP, IEC 60870-5-101, HART, Foundation Fieldbus H1 are serial. There is no network-layer filtering — the only defense is physical access control.
HART loops carry process current — HART modulation rides on 4-20mA current loops that represent process values. A malformed HART command may also change loop current, triggering process alarms.
Emergency Procedures
If an unexpected process response occurs during testing:
Halt all testing — Kill scan tools, fuzzers, MITM daemons immediately.
Notify the control room operator in person or by phone (not email).
Provide the exact operation that triggered the response — protocol, command, target device, timestamp.
Do not attempt remediation — Let operators handle recovery. Tester interference can worsen outcomes.
Preserve forensic evidence — Capture pcap files, tool logs, and timestamps for post-incident review.
Engage the facility safety officer for formal incident review before resuming any work.
Lab Environment
Building a fieldbus test lab is non-trivial because the protocols require specialized hardware. The recommended lab stack combines software simulators with optional hardware taps:
Software Simulators
Tool
Protocols
Purpose
OpenDNP3
DNP3
Reference DNP3 master and outstation
lib60870
IEC 60870-5-101, IEC 60870-5-104
MZ Automation reference stack
libiec61850
IEC 61850 (MMS, GOOSE, SV)
Reference IED implementation
PLCsim
S7comm, Modbus TCP
Siemens PLC emulator (TIA Portal)
Conpot
Modbus, S7comm, IEC 104, IPMI
Honeypot that doubles as test target
Recondog
BACnet
BACnet device emulator
OpENer
EtherNet/IP, CIP
Open-source EtherNet/IP stack
Softing syGate
PROFINET, EtherCAT, OPC UA
Commercial simulators with free eval
Hardware (Optional)
ProfiShark tap — Capture PROFIBUS DP/PA and PROFINET
HART modem (USB) — Send/receive HART FSK over current loops
CAN adapter (PCAN-USB) — For automotive fieldbus testing (companion skill)
USB-to-RS-485 adapter — For Profibus, IEC 60870-5-101, Modbus RTU
Beckhoff EtherCAT coupler (EL6690) — EtherCAT test bridge
Triconex MP3008 (training unit) — For SIS testing (Triton research)
Lab Setup Script (Reference)
# Install core fieldbus tooling on Kali
sudo apt update
sudo apt install -y wireshark tshark nmap python3-pip build-essential cmake git
# Python tooling
pip3 install scapy boofuzz python-snappy pyserial
# OpenDNP3 from source
git clone https://github.com/dnp3/opendnp3.git
cd opendnp3 && mkdir build && cd build
cmake -DDNP3_TESTS=OFF -DDNP3_EXAMPLES=ON ..
make -j$(nproc) && sudo make install
# lib60870 (MZ Automation) - reference IEC 60870-5-101/104
git clone https://github.com/mz-automation/lib60870.git
cd lib60870 && mkdir build && cd build
cmake .. -DBUILD_EXAMPLES=ON
make -j$(nproc) && sudo make install
# libiec61850 - IEC 61850 reference stack
git clone https://github.com/mz-automation/libiec61850.git
cd libiec61850 && mkdir build && cd build
cmake .. -DBUILD_EXAMPLES=ON
make -j$(nproc) && sudo make install
# conpot ICS honeypot
pip3 install conpot
# Verify installations
opendnp3-demo-master --help
iec104_demo_server --help
Common Pitfalls
Treating OT Like IT — Standard IT pentest tools (Nessus, Burp, Metasploit) can crash ICS devices. Aggressive port scanning has caused PLC faults and process shutdowns. Use ICS-specific tools with conservative timing.
Assuming Protocol Authentication — DNP3, IEC 104, GOOSE, BACnet, PROFINET, EtherCAT, and Foundation Fieldbus all lack authentication by default. Do not assume the existence of access controls just because devices respond.
Ignoring Serial Protocols — Many fieldbus protocols (Profibus DP/PA, IEC 60870-5-101, HART, FF H1, Modbus RTU) are serial. TCP-based scanning misses these entirely. Physical access to terminal servers and protocol gateways is required.
Multicast Negligence — GOOSE, PROFINET, and EtherCAT use Layer-2 multicast. A poorly configured tap can flood multicast back into the network, causing device crashes. Use one-way taps or span ports configured for ingress-only.
Overlooking Safety Instrumented Systems — SIS components (Triconex, HIMA, ICS Triplex) must be explicitly excluded from testing scope. Triton/Trisis demonstrated that SIS attacks are possible and potentially catastrophic.
Confusing Vendor Implementations — "DNP3" varies between Siemens, Schweitzer, ABB, GE, and Motorola implementations. Generic tools may not parse vendor-specific extensions. Test against the actual vendor stack when possible.
Forgetting Time Synchronization — IEC 61850 Sampled Values (SV) and GOOSE rely on precise time sync via PTP (IEEE 1588). Disrupting PTP can cause SV/GOOSE faults. Many fieldbus attacks operate by disrupting timing infrastructure.
Disregarding Physical Layer Hazards — Profibus PA and Foundation Fieldbus H1 run on intrinsically-safe segments in hazardous areas (Zone 0/1/2). Test equipment must be rated for the zone. Standard Ethernet taps can ignite explosive atmospheres.
Neglecting Engineering Workstations — The EWS is often the pivot point between IT and OT. It contains PLC programs, HMI projects, and protocol gateway credentials. Compromising an EWS grants attacker the same protocol access as a legitimate engineer.
Underestimating Long Lifecycles — A fieldbus device deployed in 2005 may still be in service in 2030. The vendor may no longer exist. Patches are unavailable. Document these as residual risks, not as actionable findings.
Reference: Protocol Quick Reference Table
Protocol
Industry
Port/Media
Auth
Encryption
Real-Time
Common Vendors
Modbus TCP
Generic ICS
TCP 502
None
None
No
Schneider, Siemens, AB
Modbus RTU
Generic ICS
RS-485 serial
None
None
No
All
S7comm
Discrete mfg
TCP 102
Optional password
None
No
Siemens
DNP3
Power, water
TCP/UDP 20000
SAv2-5 optional
SAv5 only
No
GE, Schweitzer, ABB
IEC 60870-5-101
Power (serial)
RS-232/485
None
None
No
Multiple
IEC 60870-5-104
Power (TCP)
TCP 2404
None
None
No
Multiple
IEC 61850 GOOSE
Substations
Ethertype 0x88B8
None
None (opt IEC 62351)
<4ms
ABB, Siemens, SEL
IEC 61850 SV
Substations
Ethertype 0x88BA
None
None
<4ms
ABB, Siemens, SEL
IEC 61850 MMS
Substations
TCP 102
X.509 optional
TLS optional
No
ABB, Siemens, SEL
ICCP/TASE.2
Power inter-utility
TCP 102
Optional
Optional
No
Multiple
PROFINET RT
Discrete mfg
UDP 34962-34964 + L2
None
None
<1ms
Siemens, Phoenix
PROFINET IRT
Discrete mfg
L2 reserved
None
None
<1ms
Siemens
Profibus DP
Discrete mfg
RS-485
None
None
No
Siemens, Phoenix
Profibus PA
Process
MBP (31.25 kbps)
None
None
No
Siemens, Emerson
EtherCAT
Discrete mfg
Ethertype 0x88A4
None
None
<100us
Beckhoff
EtherNet/IP
Generic ICS
TCP 44818 / UDP 2222
None (CIP Security opt)
CIP Security opt
No
AB, Rockwell, Omron
Foundation FF H1
Process
31.25 kbps MBP
None
None
No
Emerson, Yokogawa
Foundation FF HSE
Process
TCP/IP
None
None
No
Emerson, Yokogawa
HART
Process
4-20mA FSK
None
None
No
Rosemount, Endress
WirelessHART
Process
IEEE 802.15.4
AES-128
Yes
No
Emerson, Pepperl+Fuchs
ISA100 Wireless
Process
IEEE 802.15.4
AES-128
Yes
No
Yokogawa, Honeywell
CC-Link
Discrete mfg
RS-485 / Ethernet
None
None
No
Mitsubishi
CC-Link IE TSN
Discrete mfg
Ethernet TSN
Optional
Optional
<1ms
Mitsubishi
BACnet/IPv4
Buildings
UDP 47808
None
None
No
Honeywell, JCI, Schneider
BACnet/SC
Buildings
TCP
X.509
TLS
No
Emerging
ICCP / TASE.2
Power inter-utility
TCP 102
Optional
TLS optional
No
Multiple
OPC UA
Cross-industry
TCP 4840
X.509 + user
TLS + message
No
Cross-vendor
Cross-Reference to Related Skills
Related Skill
Relationship
When to Use Both
scada-ics-security
Parent skill covering Modbus/S7comm basic
Use parent for general ICS, this skill for non-Modbus protocols
automotive-vehicle-security
CAN/LIN/FlexRay/MOST fieldbuses
Use for in-vehicle networks, plant-side vehicles
network-tunneling-proxy
Pivot tunnels into OT zones
Use to maintain foothold across segmented OT
privilege-escalation
Gaining EWS/PLC engineer privileges
Use to escalate to engineering workstation access
digital-forensics
Post-incident OT forensics
Use for incident response on fieldbus devices
deception-honeypot
Conpot deployment methodology
Use for decoy ICS deployments
anti-forensics
(Defensive) Understanding attacker cleanup
Use for red team cleanup awareness only
Attribution and References
This skill draws on publicly available research, vendor documentation, and ICS-CERT advisories. Key references include:
IEC 62443 series — Industrial communication networks security
ISA-99 — Industrial Automation and Control Systems Security
NIST SP 800-82 — Guide to Industrial Control Systems Security
DHS CISA ICS-CERT advisories
Dragos ICS threat intelligence reports
Claroty, Nozomi, Tenable.ot research blogs
SANS ICS Summit presentations
SCADA StrangeLove research team publications
Moscow-based Positive Technologies ICS research (公开发表/publications)
All command examples are intended for authorized lab environments only.
