Using Nmap to scan SCADA/ICS
Nmap provides multiple scripts, and its function also allows users to create multiple custom scripts to identify the SCADA systems that are present in a network. This allows an analyst to create specific test cases to test the SCADA systems. Some of the scripts that are available by default in the latest Nmap Script library are as follows:
s7-info.nse: This is used to enumerate Siemens S7 PLC devices and collect information such as system name, version, module, and type. This script works similarly to that of the PLCScan utility.modbus-discover.nse: Enumerates SCADA Modbus slave ids (sids) and collects information such as sid number and slave ID data. Modbus is a protocol used by various PLC and SCADA systems.
We will see the syntax and the usage of these scripts in the following recipes.
Getting ready
In order to complete this activity, you will have to satisfy the following prerequisites on your machine:
- You must have Nmap installed.
- You must have network access...
