Enumerating Modbus devices
Modbus TCP/IP is a communication protocol used for transmitting information by many SCADA devices. It is considered one of the most popular open protocols and it is possible to find valid slave IDs and obtain information about the device and software remotely.
This recipe shows you how to enumerate Modbus Slave IDs (SIDs) with Nmap.
How to do it...
Open your terminal and enter the following Nmap command:
$ nmap -Pn -sT -p502 --script modbus-discover <target>
By default, the modbus-discover
script will obtain the first SID device information, as shown next. The information displayed depends on the device's response:
PORT STATE SERVICE 502/tcp open    modbus | modbus-discover: |    sid0x0: |_   Slave ID data: \xB4\xFFLMB3.0.3
How it works...
The modbus-discover
script enumerates Modbus devices and their SID information. It was written by Alexander Rudakov to improve the...