Last reviewed

OT/ICS Security Tools

Tools

Specialized tools for ICS security testing, from protocol analyzers to PLC exploitation frameworks and lab simulation platforms.

Protocol-Specific Tools

Modbus Tools

pymodbus

Full Modbus protocol implementation in Python. Supports TCP, RTU, ASCII.

bash 
pip install pymodbus
pip install pymodbus

modbus-cli

Command-line tool for quick Modbus testing and enumeration.

bash 
pip install modbus-cli
pip install modbus-cli

mbtget

Simple Modbus/TCP client. Good for quick reads.

bash 
apt install mbtget
apt install mbtget

ModbusPal

Java-based Modbus slave simulator for lab testing.

bash 
# Download from SourceForge
# Download from SourceForge

Siemens S7 Tools

snap7

Open-source S7 communication library. Python bindings available.

bash 
pip install python-snap7
pip install python-snap7

s7scan

S7 network scanner and enumeration tool.

bash 
git clone https://github.com/klsecservices/s7scan
git clone https://github.com/klsecservices/s7scan

EtherNet/IP (Allen-Bradley) Tools

pycomm3

Python library for Allen-Bradley PLC communication.

bash 
pip install pycomm3
pip install pycomm3

cpppo

EtherNet/IP CIP protocol implementation.

bash 
pip install cpppo
pip install cpppo

OPC UA Tools

bash 
# Python OPC UA (asyncua = maintained; python-opcua is deprecated)
pip install asyncua

# GUI Client
pip install opcua-client-gui

# OPC UA security scanner
git clone https://github.com/SCADACS/OPC-UA-Checker
# Python OPC UA (asyncua = maintained; python-opcua is deprecated)
pip install asyncua

# GUI Client
pip install opcua-client-gui

# OPC UA security scanner
git clone https://github.com/SCADACS/OPC-UA-Checker

ICS Exploitation Frameworks

Metasploit ICS Modules

Built-in modules for ICS exploitation and enumeration.

bash 
msfconsole
search type:auxiliary modbus
search type:auxiliary scada
search type:exploit ics
msfconsole
search type:auxiliary modbus
search type:auxiliary scada
search type:exploit ics

ISF (Industrial Security Framework)

Exploitation framework specifically for ICS.

bash 
git clone https://github.com/dark-lbp/isf
git clone https://github.com/dark-lbp/isf

Metasploit ICS Modules

bash 
# Modbus modules
use auxiliary/scanner/scada/modbus_findunitid
use auxiliary/scanner/scada/modbusclient
use auxiliary/scanner/scada/modbusdetect

# S7 modules
use auxiliary/scanner/scada/s7_enumerate
use auxiliary/admin/scada/s7_control

# BACnet modules
use auxiliary/scanner/scada/bacnet_info

# EtherNet/IP modules
use auxiliary/scanner/scada/ethernetip_info

# DNP3 modules  
use auxiliary/scanner/scada/dnp3_enumerate

# Running example
use auxiliary/scanner/scada/modbus_findunitid
set RHOSTS 192.168.100.0/24
run
# Modbus modules
use auxiliary/scanner/scada/modbus_findunitid
use auxiliary/scanner/scada/modbusclient
use auxiliary/scanner/scada/modbusdetect

# S7 modules
use auxiliary/scanner/scada/s7_enumerate
use auxiliary/admin/scada/s7_control

# BACnet modules
use auxiliary/scanner/scada/bacnet_info

# EtherNet/IP modules
use auxiliary/scanner/scada/ethernetip_info

# DNP3 modules  
use auxiliary/scanner/scada/dnp3_enumerate

# Running example
use auxiliary/scanner/scada/modbus_findunitid
set RHOSTS 192.168.100.0/24
run

Network Analysis

Wireshark

Essential for ICS traffic analysis. Has dissectors for most ICS protocols.

bash 
apt install wireshark
apt install wireshark

Zeek (Bro)

Network analysis with ICS protocol support.

bash 
apt install zeek
apt install zeek

NetworkMiner

Network forensics with protocol parsing.

bash 
# Download from netresec.com
# Download from netresec.com

Grassmarlin

NSA tool for passive ICS network mapping.

bash 
git clone https://github.com/nsacyber/GRASSMARLIN
git clone https://github.com/nsacyber/GRASSMARLIN

Lab Simulators

Virtual PLCs

Tool Description Cost
OpenPLC Open-source PLC runtime (IEC 61131-3) Free
CODESYS Industrial PLC development system Free trial
Siemens PLCSim Official Siemens S7 simulator Commercial
Factory I/O 3D factory simulation for PLC training $$$

Complete ICS Labs

bash 
# GRFICSv2 - Virtual ICS/SCADA testbed
# Includes: HMI, PLCs, Process Simulation
git clone https://github.com/Fortiphyd/GRFICSv2
cd GRFICSv2
vagrant up

# SWaT Dataset - Water treatment simulation data
# Used for ICS anomaly detection research
# https://itrust.sutd.edu.sg/testbeds/secure-water-treatment-swat/

# DVCP - Damn Vulnerable Chemical Process
# Simple process simulation for learning
git clone https://github.com/satejnik/DVCP-VAM

# ConPot - ICS/SCADA honeypot (can be used as lab)
pip install conpot
conpot --template default
# GRFICSv2 - Virtual ICS/SCADA testbed
# Includes: HMI, PLCs, Process Simulation
git clone https://github.com/Fortiphyd/GRFICSv2
cd GRFICSv2
vagrant up

# SWaT Dataset - Water treatment simulation data
# Used for ICS anomaly detection research
# https://itrust.sutd.edu.sg/testbeds/secure-water-treatment-swat/

# DVCP - Damn Vulnerable Chemical Process
# Simple process simulation for learning
git clone https://github.com/satejnik/DVCP-VAM

# ConPot - ICS/SCADA honeypot (can be used as lab)
pip install conpot
conpot --template default

Vulnerability Scanners

Nmap ICS Scripts

Built-in scripts for ICS protocol detection.

bash 
ls /usr/share/nmap/scripts/*scada*
ls /usr/share/nmap/scripts/*modbus*
ls /usr/share/nmap/scripts/*s7*
ls /usr/share/nmap/scripts/*scada*
ls /usr/share/nmap/scripts/*modbus*
ls /usr/share/nmap/scripts/*s7*

Redpoint

Digital Bond's ICS enumeration scripts for Nmap.

bash 
git clone https://github.com/digitalbond/Redpoint
git clone https://github.com/digitalbond/Redpoint

Asset Discovery

bash 
# Shodan CLI for ICS discovery
pip install shodan
shodan init YOUR_API_KEY

# Search for ICS devices
shodan search port:502
shodan search port:102
shodan search "Siemens S7"

# Download results
shodan download results port:502 country:US

# Censys for ICS
pip install censys
censys search "protocols: modbus"
# Shodan CLI for ICS discovery
pip install shodan
shodan init YOUR_API_KEY

# Search for ICS devices
shodan search port:502
shodan search port:102
shodan search "Siemens S7"

# Download results
shodan download results port:502 country:US

# Censys for ICS
pip install censys
censys search "protocols: modbus"

OT Monitoring & Detection (Blue / Purple Team)

OT assessments increasingly include a defensive component — validating that intrusion detection, asset visibility, and anomaly monitoring actually see your activity. Because active scanning is risky in OT, most of these platforms are passive (SPAN/TAP-fed) and purpose-built to parse ICS protocols.

Commercial OT Detection Platforms

Dragos Platform

Passive OT asset visibility and threat detection with ICS-specific threat intelligence (the group that tracks PIPEDREAM, etc.).

Nozomi Networks

Guardian passive monitoring, asset inventory, and process anomaly detection across ICS/IoT.

Claroty (CTD / xDome)

Deep protocol inspection, vulnerability mapping, and secure remote access for OT/XIoT.

Microsoft Defender for IoT

Agentless OT monitoring (formerly CyberX) with Sentinel/Defender XDR integration for IT/OT correlation.

Open-Source Monitoring & Detection

bash 
# Malcolm - CISA/INL full-featured network traffic analysis suite
# Bundles Arkime + OpenSearch + Zeek with ICS protocol parsers
git clone https://github.com/idaholab/Malcolm

# Zeek with ICS protocol analyzers (parse OT traffic to logs)
#   Modbus/DNP3 ship with Zeek; add community packages:
zkg install zeek/cisagov/icsnpp-modbus
zkg install zeek/cisagov/icsnpp-enip
zkg install zeek/cisagov/icsnpp-bacnet
zkg install zeek/cisagov/icsnpp-s7comm
zkg install zeek/cisagov/icsnpp-dnp3

# Suricata - IDS/IPS with ICS keywords (modbus, dnp3, enip, cip)
suricata -c /etc/suricata/suricata.yaml -i eth0
# Rulesets: Emerging Threats SCADA, plus vendor advisory rules

# GRASSMARLIN - NSA passive ICS network mapping
git clone https://github.com/nsacyber/GRASSMARLIN

# ICS honeypots (detect scanning / build threat intel)
pip install conpot            # ICS/SCADA honeypot (Modbus, S7, BACnet, ...)
# Also: GridPot, T-Pot (multi-honeypot platform incl. conpot)
# Malcolm - CISA/INL full-featured network traffic analysis suite
# Bundles Arkime + OpenSearch + Zeek with ICS protocol parsers
git clone https://github.com/idaholab/Malcolm

# Zeek with ICS protocol analyzers (parse OT traffic to logs)
#   Modbus/DNP3 ship with Zeek; add community packages:
zkg install zeek/cisagov/icsnpp-modbus
zkg install zeek/cisagov/icsnpp-enip
zkg install zeek/cisagov/icsnpp-bacnet
zkg install zeek/cisagov/icsnpp-s7comm
zkg install zeek/cisagov/icsnpp-dnp3

# Suricata - IDS/IPS with ICS keywords (modbus, dnp3, enip, cip)
suricata -c /etc/suricata/suricata.yaml -i eth0
# Rulesets: Emerging Threats SCADA, plus vendor advisory rules

# GRASSMARLIN - NSA passive ICS network mapping
git clone https://github.com/nsacyber/GRASSMARLIN

# ICS honeypots (detect scanning / build threat intel)
pip install conpot            # ICS/SCADA honeypot (Modbus, S7, BACnet, ...)
# Also: GridPot, T-Pot (multi-honeypot platform incl. conpot)

Purple-Team Value

When you run authorized active tests, coordinate with the SOC and confirm each action produced an alert. "The scan crashed nothing" and "the monitoring saw the scan" are two different findings — OT engagements should report both coverage gaps and detection gaps.

Tool Installation Script

bash 
#!/bin/bash
# ICS Pentesting Tools Installation Script
# Run on Kali Linux

echo "[*] Installing ICS/OT pentesting tools..."

# Update system
sudo apt update

# Python libraries for ICS protocols
pip3 install pymodbus
pip3 install python-snap7
pip3 install pycomm3
pip3 install opcua asyncua
pip3 install BAC0
pip3 install scapy
pip3 install shodan censys

# Nmap (should be installed)
sudo apt install -y nmap

# Wireshark
sudo apt install -y wireshark tshark

# Clone repositories
mkdir -p ~/ics-tools
cd ~/ics-tools

# s7scan
git clone https://github.com/klsecservices/s7scan

# ISF - Industrial Security Framework
git clone https://github.com/dark-lbp/isf

# Redpoint Nmap scripts
git clone https://github.com/digitalbond/Redpoint
sudo cp Redpoint/*.nse /usr/share/nmap/scripts/

# GRFICSv2 (requires vagrant)
git clone https://github.com/Fortiphyd/GRFICSv2

# ConPot honeypot
pip3 install conpot

# OpenPLC
git clone https://github.com/thiagoralves/OpenPLC_v3
cd OpenPLC_v3
./install.sh linux
cd ..

# GRASSMARLIN
git clone https://github.com/nsacyber/GRASSMARLIN

echo "[+] Installation complete!"
echo "[*] Remember to configure Wireshark for non-root capture:"
echo "    sudo dpkg-reconfigure wireshark-common"
echo "    sudo usermod -aG wireshark $USER"
#!/bin/bash
# ICS Pentesting Tools Installation Script
# Run on Kali Linux

echo "[*] Installing ICS/OT pentesting tools..."

# Update system
sudo apt update

# Python libraries for ICS protocols
pip3 install pymodbus
pip3 install python-snap7
pip3 install pycomm3
pip3 install opcua asyncua
pip3 install BAC0
pip3 install scapy
pip3 install shodan censys

# Nmap (should be installed)
sudo apt install -y nmap

# Wireshark
sudo apt install -y wireshark tshark

# Clone repositories
mkdir -p ~/ics-tools
cd ~/ics-tools

# s7scan
git clone https://github.com/klsecservices/s7scan

# ISF - Industrial Security Framework
git clone https://github.com/dark-lbp/isf

# Redpoint Nmap scripts
git clone https://github.com/digitalbond/Redpoint
sudo cp Redpoint/*.nse /usr/share/nmap/scripts/

# GRFICSv2 (requires vagrant)
git clone https://github.com/Fortiphyd/GRFICSv2

# ConPot honeypot
pip3 install conpot

# OpenPLC
git clone https://github.com/thiagoralves/OpenPLC_v3
cd OpenPLC_v3
./install.sh linux
cd ..

# GRASSMARLIN
git clone https://github.com/nsacyber/GRASSMARLIN

echo "[+] Installation complete!"
echo "[*] Remember to configure Wireshark for non-root capture:"
echo "    sudo dpkg-reconfigure wireshark-common"
echo "    sudo usermod -aG wireshark $USER"

Resources

Certifications

Consider ICS-specific certifications: GICSP (SANS), GRID (SANS), or ISA/IEC 62443 certificates for comprehensive OT security knowledge.

Related Topics

OT/ICS Security

ICS Reconnaissance

All Cheatsheets
← Safety Considerations Back to OT/ICS Overview →