A curated list of resources related to Industrial Control System (ICS) security.
|
AttkFinder
|
AttkFinder is a tool that performs static program analysis of PLC programs, and
produce Data-oriented Attack vectors. In a nutshell, AttkFinder takes PLC programs written
under the standard IEC-61131-3 in xml-format or structured text,
and builds a Data-Flow graph (DFG), a Control-Flow graph (CFG) and translates the program
into a Structured Intermediate Representation Language (STIR) version. A symbolic
execution engine analyses the stir-version code searching for attack vectors that can be
exploited by a malicious actuator.
|
|
CSET
|
The Cyber Security Evaluation Tool (CSET®) assists organizations in protecting their key national cyber assets.
This tool provides users with a systematic and repeatable approach for assessing the security posture of their cyber systems and networks.
It includes both high-level and detailed questions related to all industrial control and IT systems.
|
|
Digital Bond's 3S CoDeSys Tools
|
Digital Bond created three tools for interacting with PLCs that run CoDeSys, consisting of a command shell, file transfer and NMap script.
|
|
Digital Bond's ICS Enumeration Tools
|
Redpoint is a Digital Bond research project to enumerate ICS applications and devices using nmap extensions.
It can be used during assessments to discover ICS devices and pull information that would be helpful in secondary testing.
The Redpoint tools use legitimate protocol or application commands to discover and enumerate devices and applications.
There is no effort to exploit or crash anything, but be wise and careful.
|
|
GRASSMARLIN
|
GRASSMARLIN provides IP network situational awareness of industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks to support network security. Passively map, and visually display, an ICS/SCADA network topology while safely conducting device discovery, accounting, and reporting on these critical cyber-physical systems.
|
|
ics_mem_collect
|
Memory collector for GE D20MX. The project itself can be extended to work with other devices.
|
|
ISF
|
The Industrial Exploitation Framework (ISF) is an exploitation framework similar to Metasploit written in Python. It is based on the open source Routersploit tool. It contains exploits for several types of controllers, such as QNX, Siemens and Schneider devices and includes several scanners.
|
|
ISEF
|
The Industrial Security Exploitation Framework (ISEF) is an exploitation framework based on the Equation Group Fuzzbunch toolkit as released by Shadow Brokers. It's developed by the ICSMASTER Security Team.
|
|
ICSREF
|
A modular framework that automates the reverse engineering process of CODESYS binaries compiled with the CODESYS v2 compiler.
|
|
ICSFuzz
|
A PLC-side fuzzing tool for uncovering vulnerabilities in ICS control applications. The current version supports only applications based on the Codesys platform which has been modified and adapted for the Wago PLC.
|
|
ꓘamerka GUI
|
Ultimate Internet of Things/Industrial Control Systems reconnaissance tool.
|
|
mbtget
|
mbtget - Simple perl script for make some modbus transaction from the command line.
|
|
MiniCPS
|
MiniCPS: A toolkit for security research on Cyber-Physical
Systems from Singapore University of Technology and Design (SUTD).
|
|
MODBUS Penetration Testing Framework
|
smod is a modular framework with every kind of diagnostic and offensive feature you could need in order to pentest modbus protocol. It is a full Modbus protocol implementation using Python and Scapy. The framework can be used to perform vulnerability assessments.
|
|
ModbusPal
|
ModbusPal is a MODBUS slave simulator. Its purpose is to offer an easy to use interface with the capabilities to reproduce complex and realistic MODBUS environments.
|
|
ModScan
|
ModScan is a new tool designed to map a SCADA MODBUS TCP based network.
|
|
NetToPLCSim
|
TCP/IP-Network extension for the PLC simulation software Siemens PLCSim.
|
|
OpenDNP3
|
OpenDNP3 is the de facto reference implementation of IEEE-1815 (DNP3) provided under the Apache License.
It is currently in maintenance-only mode and new features are no longer being added.
Automatak has rebranded as Step Function I/O and is now focused on writing protocol libraries in Rust.
|
|
PLCinject
|
PLCinject can be used to inject code into PLCs.
|
|
plcscan
|
Tool for scaning PLC devices over the s7comm or modbus protocol.
|
|
Quickdraw IDS
|
The Quickdraw IDS project by Digital Bond includes Snort rules for SCADA devices and so-called preprocessors for network traffic.
The preprocessors provide significant additional value because of their ability to reconstruct the protocol and state for use by Snort.
|
|
S7Comm-Analyzer
|
A plugin for Bro that parses S7comm protocol data traffic.
|
|
SCADAShutdownTool
|
SCADAShutdownTool is an industrial control system automation and testing tool allows security researchers and experts to test SCADA security systems, enumerate slave controllers, read controller's registers values and rewrite registers data.
|
|
sixnet-tools
|
Tool for exploiting Sixnet RTUs. This simple command line interface allows using undocumented function codes to gain root access anc control the underlying Linux OS on certain Sixnet family industrial control devices.
|
|
Snap7
|
Snap7 is an open source, 32/64 bit, multi-platform Ethernet communication suite for interfacing natively with Siemens S7 PLCs. The new CPUs 1200/1500, the old S7200, the small LOGO 0BA7/0BA8 and SINAMICS Drives are also partially supported.
|
|
s7scan
|
A tool written in Python that scans networks, enumerates Siemens PLCs and gathers basic information about them, such as PLC firmware and hardware version, network configuration and security parameters.
|
|
S7 Password Bruteforcer
|
A tool to bruteforce the password used by S7 instances from a PCAP using a dictionary. Original created by SCADAStrangelove.
|
|
splonebox
|
splonebox is an open source network assessment tool with focus on modularity. It offers an ongoing analysis of a network and its devices. One major design decision features development of custom plugins, including ones for industrial communication protocols.
|
|
Wireshark
|
Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your network at a microscopic level. It is the de facto (and often de jure) standard across many industries and educational institutions. It has support for many protocols used in ICS.
|
|
PCS7-Hardening-Tool
|
A standalone PowerShell script that enumerates security issues on Siemens PCS 7 DCS servers, based on Siemens security guides. created by OTORIO
|
|
4SICS ICS Lab PCAPS
|
The "Geek Lounge" at 4SICS contains an ICS lab with PLCs, RTUs, servers, industrial network equipment (switches, firewalls, etc). These devices are available for hands-on "testing" by 4SICS attendees and traffic has been captured from these.
|
|
DEF CON 23 ICS Village PCAPS
|
PCAPS from the 23rd DEF CON.
|
|
ICS Map
|
A map created from data gathered by Shodan showing ICS devices. Data is made available for further analysis.
|
|
ICS PCAP Collection by Jason Smith
|
A collection of PCAPs for various ICS utilities and protocols.
|
|
ICS Radar
|
Data gathered from several types of ICS protocols by Shodan visualized on a globe.
|
|
S4x15 ICS Village
|
Mirror for the PCAPS from the S4x15 CTF as used during the contest.
|
|
S7 PCAP samples
|
Sample files for Wireshark S7 protocol dissector plugin.
|
|
SCADAPASS
|
The famous SCADA StrangeLove Default/Hardcoded Passwords List.
|
|
TRISIS/TRITON/HATMAN malware repository
|
Repository containting original and decompiled files of TRISIS/TRITON/HATMAN malware targeting Triconex Safety Instrumented System (SIS) controllers.
|
|
HVAC Traces
|
A repository that contains PCAP traces from a HVAC system of a university that can be used to ealuate Network Intrustion Detection Systems.
|
|
CS3STHLM
|
the Stockholm international summit on Cyber Security in SCADA and Industrial Control Systems - is an annual summit that gather the most important stakeholders across critical processes and industries. CS3STHLM has been organized since 2014, and has quickly become the premier ICS Security Summit in Northern Europe.
|
|
CS4CA
|
Cyber Security for Critical Assets is a global series of summits focusing on cyber security for critical infrastructure.
|
|
SANS ICS Summit Archives
|
Central repository for the presentation material for the SANS ICS Summits held worldwide (interleaved with other summits).
|
|
SANS ICS Cybersecurity Conference (WeissCon)
|
Affectionately known as WeissCon after it’s founder Joe Weiss, the conference is now owned and operated by SecurityWeek and usually runs in October at different locations each year in the US.
|
|
Kaspersky Industrial Cybersecurity conference (KICS con)
|
An annual international industrial cybersecurity conference run by Kaspersky.
|
|
ICCPS: ACM/IEEE International Conference on Cyber-Physical Systems
|
The objective of ICCPS, the ACM/IEEE International Conference on Cyber-Physical Systems, is to serve as a single-track forum for reporting advances in all aspects of cyber-physical systems, including but not limited to theory, tools, applications, systems, and testbeds.
|
|
Industrial Control System Security (ICSS) Workshop
|
The goal of this workshop is to explore new techniques to improve security-critical control systems in the face of emerging threats.
|
|
Workshop on the Security of Industrial Control Systems & of Cyber-Physical Systems (CyberICPS)
|
CyberICPS intends to bring together researchers, engineers and governmental actors with an interest in the security of ICS and CPS in the context of their increasing exposure to cyber-space, by offering a forum for discussion on all issues related to their cyber security.
|
|
Workshop on CPS & IoT Security and Privacy (CPSIoTSec)
|
Joint Workshop on CPS&IoT Security and Privacy that aims to present work done in the areas of tackling security and privacy issues for CPS and IoT.
|
|
ACM Cyber-Physical System Security Workshop (CPSS 2025)
|
This workshop will provide a platform for professionals from academia, government, and industry to discuss novel ways to address the ever-present security challenges facing CPS.
|
|
IEEE Conference on Industrial Cyber-Physical Systems (ICPS)
|
This conference aims to provide a platform to exchange research and innovation results, as well as experiences learned from industrial practices associated with new paradigms and technologies related to Industrial Cyber-Physical Systems.
|
|
IEEE International Workshop on Cyber-Physical Systems Security (CPS-Sec)
|
CPS-Sec 2024 aims to serve as a platform for researchers and practitioners from both industry and academia interested in CPS security.
|
|
ATT&CK® for Industrial Control Systems by MITRE
|
ATT&CK for ICS is a knowledge base useful for describing the actions an adversary may take while operating within an ICS network.
|
|
Library of Resources for
Industrial Control System Cyber Security
|
SCADAhacker.com's ultimate list of ICS/SCADA cybersecurity resources.
|
|
Applied Cyber Security and the Smart Grid
|
Applied Cyber Security and the Smart Grid: Implementing Security Controls into the Modern Power Infrastructure by Eric D. Knapp and Raj Samani.
|
|
A Collection of Resources for Getting Started in ICS/SCADA Cybersecurity
|
Robert M. Lee's thoughts on some good resources on ICS & SCADA security.
|
|
Hacker Machine Interface - The State of SCADA HMI Vulnerabilities
|
A TrendLabs Research Paper from the Trend Micro Zero Day Initiative Team about the current state of SCADA and HMI security.
|
|
Handbook of SCADA/Control Systems Security
|
This comprehensive handbook covers fundamental security concepts, methodologies, and relevant information pertaining to supervisory control and data acquisition (SCADA) and other industrial control systems used in utility and industrial facilities worldwide.
|
|
SCADA Cybersecurity Framework
|
Paper describing what a SCADA Cyber Security framework should consist of.
|
|
Industrial Network Security, Second Edition
|
Industrial Network Security, Second Edition: Securing Critical Infrastructure Networks for Smart Grid, SCADA, and Other Industrial Control Systems by Eric D. Knapp and Joel Thomas Langill.
|
|
Power System SCADA and Smart Grids
|
The book brings together in one concise volume the fundamentals and possible application functions of power system supervisory control and data acquisition (SCADA). Not security-oriented and geared towards power systems, but a good primer into SCADA nonetheless.
|
|
NIST SP 800-82, Revision 2
|
Guide to Industrial Control Systems (ICS) Security by NIST.
|
|
The Industrial Control System Cyber Kill Chain
|
This SANS paper describes the ICS Cyber Kill Chain. It tailors the Lockheed Martin Kill Chain to typical, two phase attacks on ICS systems.
|
|
An Abbreviated History of Automation, Industrial Control Systems, and Cybersecurity
|
This SANS paper looks at the background on ICS cybersecurity. Well worth the read to make sure you understand many of the events that have occurred over the past twenty years and how they’ve inspired security in ICS today.
|
|
Control Engineering - Networking and Security - CyberSecurity
|
Control Engineering magazine's cybersecurity news and literature.
|
|
Operational Technology Cyber Security Incidents Ontology (OT-CSIO)
|
OT-CSIO, created by FireEye, is an ontology to understand, cross-compare and assess cyber security incidents related to operational technology. It provides guidance for assessing risks and helps making informed decisions.
|
|
CIS Controls Implementation Guide for Industrial Control Systems - Version 7
|
This document provides guidance on how to apply the security best practices found in CIS Controls Version 7.1 to ICS environments.
|
|
CIS Controls Internet of Things Companion Guide - Version 7.1
|
The objective of this document is to have broad applicability across sectors. IoT affects all areas of computingacross multiple sectors, such as healthcare, aviation, public safety, and energy. This has led to sector-specific IoT security guidance, but this document is purposefully sector-agnostic.
|
评论