XUTS OT Operator Node

Modbus Fundamentals

Modbus is a common industrial protocol used for communication between clients and devices such as PLCs, RTUs, gateways, and simulators. Modbus/TCP commonly uses port 502.

Difficultyeasy

XP Reward100

PurdueL3/L2

AssetOT System

OT / ICSSafety Aware

OT Safety Gate

Assume every action can affect the process until proven otherwise.

OT testing is not just exploitation. It is controlled validation around availability, safety, process continuity, deterministic operations, and recovery.

Prefer passive enumeration before active scanning. OT networks may contain fragile controllers, legacy stacks, deterministic traffic patterns, and vendor-supported systems that react poorly to noisy probes.

Never perform protocol writes, force coils, download logic, change controller state, or interact with safety systems in production unless the scope, approval, rollback plan, and operational window are explicit.

Treat engineering workstations, historians, HMI servers, jump hosts, and OT domain controllers as high-impact assets because they can affect visibility, control, recovery, and trusted engineering workflows.

Coordinate testing with operations, control engineers, vendors, and site leadership. In OT, the blast radius can include production, safety, environmental impact, and physical equipment damage.

What it is

Modbus is a common industrial protocol used for communication between clients and devices such as PLCs, RTUs, gateways, and simulators. Modbus/TCP commonly uses port 502.

Why it matters

Modbus is simple, common, and often lacks authentication. Operators must understand the difference between passive observation, safe reads, and dangerous writes.

How to identify it

Look for TCP/502 exposure in OT or lab networks.Identify Modbus-speaking devices through banners, traffic, documentation, or safe protocol-aware tooling.Differentiate coils, discrete inputs, input registers, and holding registers.Understand whether the testing scope allows read-only interaction.

Expected output

A list of Modbus endpoints.A safe understanding of whether the device appears to support read functions.A warning boundary around write functions and process impact.

Success looks like

You can explain Modbus function codes at a high level.You understand why writing coils or registers can be dangerous.You can identify where Modbus exists without blindly manipulating process values.

Failure looks like

You use write functions during discovery.You confuse simulated lab behavior with production-safe behavior.You perform high-rate polling that could affect fragile devices.

Troubleshooting

If Modbus does not respond, confirm routing, firewall rules, unit IDs, and whether the endpoint is actually a gateway.

If reads return unclear data, remember that register meaning depends on process context and documentation.

If testing production, default to passive evidence unless read interaction is explicitly approved.

Lab setup ideas

Use a Modbus simulator to practice reading coils and registers safely.

Build a simple dashboard that changes values in a simulator so students can understand process context.

Practice documenting what would be unsafe in production.

EXO automation ideas

Flag Modbus services and generate safe-read-only guidance.

Differentiate protocol discovery from process manipulation.

Warn when a proposed action uses write-capable function codes.

Operational Tradecraft

How to talk about this like an OT operator

Lead with process risk.

Explain how this topic affects visibility, control, safety, availability, recovery, and engineering workflows.

Explain passive-first methodology.

Mention SPAN/TAP collection, firewall review, switch tables, historian visibility, HMI observation, configuration review, and controlled validation before active probing.

Tie the concept to an attack path.

Connect the node to IT/OT pivoting, Level 3 operations, historians, engineering workstations, HMIs, PLCs, protocols, vendor access, and segmentation boundaries.

EXO Guidance

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.