ics-ot-overview
ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-CRITICAL: always confirm written scope before any write/control class action.
소스 정보
- 저장소
- BitterSecurity/Decepticon
- 최근 소스 활동
- 2026년 5월 30일 11:42
- 감지된 SKILL.md 언어
- 영어
- 스타
- 5,565
- 포크
- 1,053
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
8 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- ics-ot-overview
- description
- ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-CRITICAL: always confirm written scope before any write/control class action.
- allowed-tools
- Bash Read Write
- metadata
- {"when_to_use":"ics ot industrial scada plc rtu modbus bacnet s7 siemens dnp3 hmi mes opc opc-ua profinet ethernet/ip cip","subdomain":"ics-ot","tags":"ics, ot, scada, industrial","mitre_attack":"T0855, T0836, T0846, T0816"}
# Industrial Control Systems / OT Category
This is a routing skill for industrial protocol engagements. Identify the protocol by port + wire format, then load the matching sub-skill.
## SAFETY FIRST
Writes to ICS/OT devices can move physical actuators — open valves, trip breakers, freeze pumps, override safety setpoints. **Confirm written scope authorization for any write/control class operation. Read-only enumeration is generally safe.** If unsure, default to read-only.
## Protocol routing
| Protocol | TCP/UDP Port | Sub-skill | Wire fingerprint |
|---|---|---|---|
| **Modbus TCP** | TCP 502 | `modbus` | MBAP header, function codes 1-127 |
| **BACnet/IP** | UDP 47808 | `bacnet` | APDU PDU types 0-15, Who-Is/I-Am |
| **Siemens S7Comm** | TCP 102 | `s7comm` | ISO-on-TCP (RFC 1006) + S7 protocol IDs |
| **DNP3** | TCP 20000 | `dnp3` | Start bytes 0x05 0x64, link layer |
| **EtherNet/IP + CIP** | TCP 44818, UDP 2222 | (use enumeration; CVE-driven exploits) | ENIP encapsulation header |
| **PROFINET RT** | UDP 34962-34964 | (use enumeration) | EtherType 0x8892 (L2) |
| **OPC UA** | TCP 4840 | (use enumeration) | OPC UA Binary protocol |
## Quick fingerprint sweep
```bash
nmap -sV -p 102,502,20000,44818,4840 --script="*ics*,*scada*,modbus-discover,s7-info,dnp3-info,bacnet-info,enip-info" 10.0.0.0/24
```
## Useful tooling
| Tool | Use |
|---|---|
| `pymodbus`, `mbtget` | Modbus client |
| `bacpypes`, `bacnet-stack` | BACnet client |
| `snap7`, `python-snap7` | S7Comm client |
| `opendnp3`, `dnp3-toolkit` | DNP3 master |
| `cip-py`, `pylogix` | EtherNet/IP / CIP (Allen-Bradley) |
| `python-opcua` / `opcua-asyncio` | OPC UA |
| `ISF` (Industrial Security Framework) | Mass enumeration + exploit framework |
| `PLCinject` | Siemens S7 logic injection |
## Defender baseline (useful for triage)
ICS-CERT advisories (https://www.cisa.gov/uscert/ics/advisories), Dragos Threat Intel Briefs, Nozomi / Claroty / Tenable.ot for telemetry. Understanding what defenders see helps you stay below detection thresholds.
GitHub에서 보기