ot-security-assessment

name	ot-security-assessment
description	Operational Technology (OT) security assessment using a two-stage methodology: (1) Identification/Discovery of OT devices and protocols, and (2) Vulnerability Assessment using online sources and Metasploit. Use when: (1) Conducting authorized OT/ICS security assessments, (2) Identifying and enumerating OT protocols (Modbus, S7, IEC 104, DNP3, BACnet, EtherNet/IP), (3) Discovering industrial control devices and PLCs, (4) Assessing OT protocol vulnerabilities and security weaknesses, (5) Performing compliance scanning aligned with IEC 62443 standards, (6) Validating network segmentation and access controls in OT environments.
version	0.1.0
maintainer	https://github.com/i8void/
category	offsec
tags	["ot","ics","scada","modbus","siemens","industrial-security","vulnerability-assessment","reconnaissance"]
frameworks	["MITRE-ATT&CK","IEC-62443","PTES"]
dependencies	{"packages":["nmap","metasploit-framework","python3"],"tools":["modbus-cli","plcscan","python-snap7","pymodbus"]}
references	["https://nmap.org/book/","https://docs.rapid7.com/metasploit/msf-overview/","https://www.cisa.gov/news-events/cybersecurity-advisories","https://attack.mitre.org/techniques/T1046/","https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards"]

OT Security Assessment

Overview

This skill provides a structured methodology for conducting Operational Technology (OT) and Industrial Control System (ICS) security assessments. The approach follows a two-stage methodology: (1) Identification/Discovery of OT devices, protocols, and services, and (2) Vulnerability Assessment using online vulnerability databases and Metasploit Framework for deeper analysis.

IMPORTANT: OT security assessments may impact critical industrial processes and must only be conducted with proper authorization. Always ensure written permission before assessing OT systems. Never test production systems without explicit authorization.

OT Network Security Considerations:

• Well-secured OT systems will not allow internet-connected devices (like this system) to be plugged into the network for assessment
• Most production OT assessments will be conducted offline on air-gapped networks
• This skill is suitable for:
  • Less secure or open OT/SCADA systems
  • Lab environments and test networks
  • Authorized assessment scenarios where network isolation is managed separately
• Always coordinate with operations team to ensure proper network isolation and security controls

Quick Start

Basic OT device discovery and protocol enumeration:

# TCP Connect scan for common OT ports (no root required, safer for OT)
nmap -sT -p 502,102,2404,20000,47808,2222 <target-ip>

# Modbus enumeration (no root required)
nmap -p 502 --script modbus-read-registers,modbus-read-coils <target-ip>

# Comprehensive OT scan with service detection (no root required)
nmap -sV -p 502,102,2404,20000,47808,2222 --script modbus-read-registers,s7-info,bacnet-info <target-ip>

Placeholder System

When executing commands, replace these placeholders with actual values:

• <target-ip> - Single IP address (e.g., 192.168.1.100)
• <target-network> - IP range in CIDR notation (e.g., 192.168.1.0/24)
• <rhost> - Remote host (Metasploit) - IP address or hostname
• <rport> - Remote port (Metasploit) - Port number
• <unit-id> - Modbus unit ID (typically 1-255)

Core Workflow

Workflow Checklist (for complex operations)

Progress: [ ] 1. Verify authorization and scope for OT assessment [ ] 2. Perform network discovery and identify live hosts [ ] 3. Scan for common OT protocol ports [ ] 4. Enumerate OT protocols and identify devices [ ] 5. Gather device information and service versions [ ] 6. Research vulnerabilities using online sources [ ] 7. Perform vulnerability assessment with Metasploit [ ] 8. Document findings and generate assessment report [ ] 9. Validate results and identify false positives