Industrial protocol
Modbus / Modbus TCP
502/TCP
Used for: Simple register and coil-based communication between HMIs, PLCs, RTUs, gateways, and simulators.
Where seen: Utilities, manufacturing, building automation, labs, gateways, legacy ICS environments.
Security model: Classic Modbus has no authentication, no encryption, and no native authorization.
Offensive notes
- • Identify function codes, unit IDs, coils, discrete inputs, holding registers, and input registers.
- • Read-only enumeration can reveal process values, device state, and control logic assumptions.
- • Write functions can alter coils/registers and may directly affect equipment or simulated process state.
- • Map master/slave or client/server relationships before touching anything active.
Safety notes
- • Avoid write function codes in production.
- • Do not fuzz unknown controllers.
- • Coordinate any active reads with operations when targeting real PLCs.
- • Validate whether a gateway proxies multiple downstream devices.
Operator Guidance
Modbus is simple and common, but the security issue is that it was designed for trusted networks. I would enumerate it passively first, identify clients, servers, function codes, and register patterns, and avoid writes unless explicitly approved.
Used for: SCADA communication between control centers, substations, RTUs, and field devices.
Where seen: Electric utilities, substations, water, oil and gas telemetry environments.
Security model: Classic DNP3 lacks strong security by default; Secure Authentication exists but is not universal.
Offensive notes
- • Identify masters, outstations, unsolicited responses, object groups, and event data.
- • Look for routable control-center-to-field-device paths.
- • Understand whether traffic is serial-to-IP converted through gateways.
- • Telemetry patterns can reveal operational states and process events.
Safety notes
- • Be very cautious with control operations.
- • Avoid malformed packet testing in production.
- • Coordinate with operators before active interrogation.
- • Understand if testing can trigger alarms or operational events.
Operator Guidance
For DNP3 I care about master/outstation relationships, telemetry flow, and whether secure authentication is used. I would start with passive packet analysis and avoid control operations unless explicitly scoped.
Industrial Ethernet
EtherNet/IP / CIP
44818/TCP44818/UDP2222/UDP
Used for: Industrial automation communication using CIP objects, commonly associated with Rockwell Automation ecosystems.
Where seen: Manufacturing, packaging, process control, Rockwell/Allen-Bradley environments.
Security model: Often lacks strong authentication in legacy deployments; CIP Security exists but is not universal.
Offensive notes
- • Identify devices, sessions, vendor IDs, product names, firmware, and CIP services.
- • Look for PLCs, drives, I/O adapters, and engineering workstation communication.
- • Understand implicit versus explicit messaging.
- • Engineering workstation access can be more important than protocol abuse.
Safety notes
- • Do not issue control or logic-altering operations.
- • Avoid high-rate polling against controllers.
- • Be careful with device identity scans on fragile networks.
- • Coordinate testing around production windows.
Operator Guidance
EtherNet/IP is common in Rockwell environments. I would look for CIP identity data, controller relationships, and engineering workstation paths, but I would avoid logic or state-changing operations in production.
Industrial middleware
OPC UA
4840/TCP
Used for: Structured industrial data exchange between PLCs, HMIs, historians, SCADA, MES, and enterprise systems.
Where seen: Modern ICS integrations, historians, gateways, manufacturing, process environments.
Security model: Supports certificates, signing, encryption, and authentication, but may be misconfigured.
Offensive notes
- • Enumerate endpoints, security modes, certificates, namespaces, nodes, and exposed objects.
- • Look for anonymous access or weak security policies.
- • Map integrations between OT and business systems.
- • OPC often exposes rich process context useful for attack-path understanding.
Safety notes
- • Avoid writes to nodes in production.
- • Do not brute force authentication.
- • Treat exposed namespaces as potentially sensitive process data.
- • Validate whether OPC bridges IT and OT zones.
Operator Guidance
OPC UA is powerful because it exposes structured process data. I would check endpoint security policies, anonymous access, certificates, namespace exposure, and whether it bridges segmentation boundaries.
Industrial Ethernet
PROFINET
34962/UDP34963/UDP34964/UDP
Used for: Industrial communication for Siemens and other automation environments.
Where seen: Manufacturing, process automation, Siemens-heavy environments.
Security model: Historically assumes trusted industrial networks; security depends heavily on segmentation and device configuration.
Offensive notes
- • Identify controllers, IO devices, device names, and topology.
- • Look for engineering workstation communication.
- • Map device roles and network relationships.
- • Discovery traffic can reveal device identity and layout.
Safety notes
- • Avoid disruptive discovery or malformed packet testing.
- • Do not rename or reconfigure devices.
- • Coordinate active testing with control engineers.
- • Be careful around real-time industrial traffic.
Operator Guidance
For PROFINET I focus on topology, controller-to-device relationships, engineering workstation access, and segmentation. I would be cautious because discovery or configuration actions can affect operations.
Building automation
BACnet
47808/UDP
Used for: Building automation communication for HVAC, access control, lighting, sensors, and facility systems.
Where seen: Commercial buildings, hospitals, campuses, data centers, industrial facilities.
Security model: BACnet/IP commonly lacks authentication unless newer security features or compensating controls are implemented.
Offensive notes
- • Enumerate devices, objects, properties, building controllers, and exposed BBMDs.
- • Look for internet exposure or flat facility networks.
- • Building systems can support physical security and environmental operations.
- • Object names may disclose sensitive facility details.
Safety notes
- • Avoid changing setpoints or schedules.
- • Do not disrupt HVAC in sensitive environments.
- • Coordinate testing with facilities teams.
- • Treat building automation as operational technology.
Operator Guidance
BACnet is important because building systems can affect safety, comfort, physical security, and environmental control. I would enumerate passively where possible and avoid setpoint or schedule changes.
Electric utility SCADA
IEC 60870-5-104
2404/TCP
Used for: Telecontrol communication in electric power and utility environments.
Where seen: Transmission, distribution, substations, utility SCADA networks.
Security model: Often relies on network trust and segmentation; secure variants and compensating controls vary.
Offensive notes
- • Identify control center and outstation communication.
- • Map telemetry and command paths.
- • Understand cause-of-transmission and ASDU structures at a high level.
- • Utility protocol testing requires very strong safety discipline.
Safety notes
- • Avoid commands or malformed testing.
- • Do not test against live substations without strict authorization.
- • Coordinate with grid/utility operators.
- • Passive-first is mandatory in realistic production contexts.
Operator Guidance
IEC-104 is high-impact because it is used in power environments. I would focus on passive mapping, segmentation validation, and telemetry understanding, not active command testing in production.