<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ics-penetration-testing
description: >-
  Plan and execute authorized penetration tests against ICS/SCADA environments
  including PLC exploitation, protocol fuzzing, HMI bypass, and lateral movement
  through OT network segments using ICS-specific tooling and safety constraints.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - penetration-testing
  - ics
  - scada
  - plc
  - exploitation
  - red-team
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0812", "T0886", "T0867"]
  nist-csf: ["PR.PT-3", "ID.RA-1"]
  iec-62443: ["SR 7.1", "SR 7.6"]
  uuid: a1b2c3d4-1001-4000-a001-000000000002
---

# Performing ICS Penetration Testing

## Overview

ICS penetration testing validates security controls in operational technology
environments where availability is paramount. Unlike IT pentesting, ICS engagements
require strict safety gates, process-aware scoping, and understanding of real-time
control system behavior. A misplaced packet can trip a safety system or halt production.

Mode: `[MODE: RED]` for active testing; `[MODE: PURPLE]` for coverage validation.

## Prerequisites

| Requirement | Details |
|---|---|
| Written authorization with explicit scope (network ranges, device types, test windows) | Required |
| ISA/IEC 62443 zone and conduit diagrams for target environment | Required |
| Safety system isolation verification (SIS must be out of scope or hardware-bypassed) | Required |
| ICS-specific tools | PLCScan, Redpoint NSE scripts, ISF (Industrial Exploitation Framework) |
| Nmap 7.90+ with ICS NSE scripts, Metasploit with ICS modules | Required |
| Isolated lab replica for exploit development (NEVER develop on production) | Required |
| Emergency rollback procedures and OT operator on standby | Required |

## Key Concepts

### Safety-First Engagement Rules

```yaml
# ICS Pentest Safety Gates
gate_1_pre_engagement:
  - Verify SIS independence from test scope
  - Confirm maintenance window with operations
  - Document all device firmware versions
  - Establish kill-switch communication channel

gate_2_passive_only:
  - Network mapping via passive sniffing only
  - No active scanning until gate_3 approval
  - Document all discovered assets

gate_3_active_recon:
  - Low-rate port scanning (max 10 pps)
  - Service identification on known ICS ports
  - Protocol enumeration (Modbus, EtherNet/IP, DNP3, OPC UA)

gate_4_exploitation:
  - Exploit only pre-approved targets
  - OT operator confirms process stability before each test
  - Immediate halt on any safety alarm
```

### ICS Network Discovery

```bash
# Passive discovery — ARP and broadcast monitoring
tcpdump -i eth1 -w passive_recon.pcap -G 3600 -W 1 'arp or broadcast'

# Low-rate Nmap scan with ICS scripts (AUTHORIZED ONLY)
nmap -sT -Pn -n --max-rate 10 -p 102,502,2222,4840,20000,44818,47808 \
  --script modbus-discover,s7-info,enip-info,bacnet-info \
  -oA ics_scan 10.10.0.0/24

# PLCScan — identify PLC types and firmware
plcscan -t 10.10.0.0/24

# Redpoint Nmap scripts for Siemens S7
nmap -Pn -sT -p 102 --script s7-info,s7-enumerate 10.10.0.50
```

### Protocol-Specific Testing

```bash
# Modbus — read coils without auth (demonstrates lack of access control)
modbus-cli read 10.10.0.50 0 100 --slave 1

# EtherNet/IP — list services on target
python3 -c "
from cpppo.server.enip import client
with client.connector(host='10.10.0.50') as conn:
    conn.list_services()
    conn.list_identity()
    for rsp in conn:
        print(rsp)
"

# OPC UA — enumerate endpoints and security policies
opcua-client -u opc.tcp://10.10.0.50:4840 --enumerate

# S7comm — read SZL (System Status List) from Siemens PLC
python3 -c "
import snap7
plc = snap7.client.Client()
plc.connect('10.10.0.50', 0, 1)
print('CPU State:', plc.get_cpu_state())
print('CPU Info:', plc.get_cpu_info())
plc.disconnect()
"

# DNP3 — enumerate outstations
nmap -Pn -sT -p 20000 --script dnp3-info 10.10.0.50
```

### Lateral Movement in OT

```bash
# Pivot from IT-OT DMZ to Level 1
# Check for dual-homed hosts bridging zones
arp -a | grep -E "10\.10\." | sort

# Identify shared credentials across HMI stations
crackmapexec smb 10.10.0.0/24 -u operator -p 'Summer2024!'

# VNC access to HMI (common in legacy SCADA)
nmap -Pn -sT -p 5900-5910 10.10.0.0/24 --script vnc-info
```

## Workflow

### Step 1: Passive Reconnaissance

```bash
# Map OT network passively for 4 hours
tcpdump -i eth1 -w ot_passive.pcap -G 14400 -W 1

# Extract unique ICS protocol conversations
tshark -r ot_passive.pcap -Y "modbus || s7comm || enip || dnp3" \
  -T fields -e ip.src -e ip.dst -e tcp.dstport | sort -u > ics_conversations.txt
```

### Step 2: Active Enumeration (Gate 3)

```bash
# Targeted scan of discovered ICS assets
nmap -sT -Pn -n --max-rate 5 -sV -p 102,502,4840,20000,44818 \
  -iL discovered_hosts.txt -oA ics_services
```

### Step 3: Vulnerability Assessment

```bash
# Check for known CVEs on discovered firmware versions
searchsploit "siemens s7-1200" "firmware 4.2"
searchsploit "allen-bradley" "compactlogix"

# Test default credentials on HMI web interfaces
hydra -L ics_users.txt -P ics_defaults.txt 10.10.0.100 http-get /
```

### Step 4: Controlled Exploitation (Gate 4)

```bash
# Demonstrate PLC stop capability (lab only, with operator approval)
python3 -c "
import snap7
plc = snap7.client.Client()
plc.connect('10.10.0.50', 0, 1)
# plc.plc_stop()  # UNCOMMENT ONLY IN LAB WITH AUTHORIZATION
print('CPU State:', plc.get_cpu_state())
plc.disconnect()
"
```

## Verification

- [ ] Written authorization obtained and scope documented
- [ ] Safety systems verified independent of test scope
- [ ] Passive recon completed before any active scanning
- [ ] All scans rate-limited to prevent process disruption
- [ ] Vulnerabilities validated in lab before production testing
- [ ] Emergency rollback tested and communication channel verified
- [ ] Findings documented with CVSS scores and ICS-specific impact
- [ ] Evidence preserved with timestamps and chain of custody

## Detection Opportunities

- Unusual port scanning from IT network into OT VLANs → pentest or real attack
- New Modbus/S7/EtherNet-IP sources → unauthorized device or pivot point
- Failed authentication attempts on HMI/SCADA servers → credential testing
- PLC CPU state changes outside maintenance windows → exploitation attempt
- Nmap service fingerprinting packets on ICS ports → active reconnaissance

```yaml
title: Ics Penetration Testing Detection
id: b005fbd5-4d28-460f-8367-98ab4c6cd0df
status: experimental
description: Detects suspicious activity related to performing ics penetration testing techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0812
  - attack.t0886
  - attack.t0867
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NIST SP 800-82 Rev 3: Guide to OT Security
- IEC 62443-4-2: Technical Security Requirements for IACS Components
- PTES Technical Guidelines — ICS Addendum
- CISA ICS-CERT Advisories Database
