<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing ICS Penetration Testing — API & Tool Reference

> Quick reference for tools, commands, and APIs used in performing-ics-penetration-testing.

## Tools

### `nmap`

Network scanner with ICS NSE scripts for OT asset discovery.

**Usage:**
```bash
nmap -sT -Pn -p 102,502,44818 --script s7-info <target>
```

**Key Flags:**
  - `-sT`: TCP connect scan (safer for ICS)
  - `-Pn`: skip host discovery
  - `--max-rate`: limit scan speed to prevent process disruption
  - `--script`: ICS protocol scripts (modbus-discover, s7-info, enip-info)

---

### `plcscan`

PLC discovery and identification tool.

**Usage:**
```bash
plcscan -t 10.10.0.0/24
```

**Key Flags:**
  - `-t`: target range
  - Identifies PLC vendor and model

---

### `snap7`

Python library for Siemens S7 PLC communication.

**Usage:**
```python
import snap7
plc = snap7.client.Client()
plc.connect(host, rack, slot)
```

**Key Methods:**
  - `connect()`: establish S7 session
  - `get_cpu_state()`: read PLC run state
  - `get_cpu_info()`: read PLC metadata
  - `db_read()`: read data blocks

---

### `modbus-cli`

Command-line Modbus TCP client for register operations.

**Usage:**
```bash
modbus-cli read <host> <address> <count>
```

**Key Flags:**
  - `read`: read holding registers
  - `write`: write register (⚠️ lab only)
  - `--slave`: unit ID

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- NEVER run exploitation tools against production without written authorization
- Rate-limit all scans to prevent process disruption
- OT operator must be on standby during active testing phases

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
- PTES Technical Guidelines — ICS Addendum
