Industrial Control Systems : Pentesting PLCs 101 (Part 1/2)
summary
Hands-on workshop that shows how to find and attack real PLCs: Siemens S7-1200 and Schneider M340 are targeted live, with a Kali VM and tools (modpoll/mbtget/PLCScan/Snap7, Metasploit modules, ModbusPal simulator). Demonstrations expose Modbus/TCP on port 502, reading/writing coils and registers, Wireshark captures, and Shodan searches that reveal internet‑reachable PLCs. Cites ~200 documented ICS attacks (≈80 successful), Modbus limits (≈250 slaves per master), and unauthenticated stop/start and program‑download weaknesses that reproduce on the devices.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:41About me
- 1:33Agenda
- 2:23Additional Tools
- 3:43Overview
- 7:44Vocabulary
- 8:54Sensors Actuators
- 9:49HMI
- 10:40PLC
- 11:18Supervision Screen
- 11:44Data Server
- 12:16Security Awareness
- 12:36Before 2011
- 12:59Stuxnet
- 13:25ICS Assessments
- 13:38ICS Security
- 22:31ICSCERT
- 23:35What is a PLC
- 26:18Ladder Logic
- 31:53Showdown Example
- 33:41Scan Example
- 40:55Modbus TCP
- 52:07Source Code
related talks
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
39mIn-Field Emulation & Fuzzing of PLCs to Uncover the Next Zero-Day in Industrial Control Systems
44mRogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs
21mOops, It Halted Again: Exploiting PLC Memory for Fun and Profit in Industrial Control...
50mDead Man’s PLC: Ransoming the Physical World via Operational Technology
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
45mLet’s Play a Game – Challenges...
29mFuzzing and Breaking Security Functions of SIMATIC PLCs