iti / ics-security-tools

Tools, tips, tricks, and more for exploring ICS Security.

ICS Security Tools, Tips, and Trade

Developed as a community asset

This effort intends to pull together tools, tips, and tricks of the trade to working on cyber security in the ICS environment.

The code repository will house any specific scripts, tools, configurations, or other useful tidbits to utilize in this space.

General Structure:

• /companies/

• /configurations/

• /feeds/

• /guides/

• /hardware/

• /hwinfo/

• /pcaps/

• /protocols/

• /scripts/

• /tools/

  • /tools/analysis
  • /tools/audit
  • /tools/general
  • /tools/honeypots
  • /tools/mirrored
  • /tools/misc
  • /tools/simulation
  • /tools/testbeds

Enjoy!

(creative commons license)

ics-security-tools's Issues

Molex EIP tool

A great tool for EIP is the free molex EIP tool. It can be used to send EIP messages to a device for testing. This is a free tool for anyone to download.

https://www.molex.com/mx_upload/superfamily/iccc/EtherNet_IPTool.html

pcap organization

ATM, pcaps are just tossed into folders based on where they came from, rather than organized by protocol.

I have a wide swath of DNP3 pcaps I'd like to add to this that were recorded for validating parsers/firewalls. Where should they go?

Would you accept a pull request if I reorganized the existing pcaps by protocol, instead of by "where they came from"?

Modbus capture in profinet folder?

So far as I can tell, the file mb2.pcap in the pcaps/profinet/ directory actually contains Modbus/TCP packets, not profinet.

Unless I'm incorrect, please move it.

add 61850 zeek parser link

Please add the IEC 61850 Zeek parser to the Zeek page
https://github.com/smartgridadsc/Goose-protocol-parser-for-Zeek-IDS

BSI LARS Link update

Describe the bug
The current link for the BSI LARS Link is wrong here:
https://github.com/ITI/ICS-Security-Tools/blob/master/tools/audit/README.md

To Reproduce
Steps to reproduce the behavior:

1. Click on the current link
2. It's goging to a error Page

Expected behavior
Goes to the correct page:
https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Industrielle-Steuerungs-und-Automatisierungssysteme/Tools/LarsICS/LarsICS_node.html

Wireshark missing

Is your feature request related to a problem? Please describe.
I can't see Wireshark in this list...why?

Describe the solution you'd like
Add WireShark to this repo (or explain me why it's missing)

Describe alternatives you've considered
Maybe there is a specific reason because it's missing

Additional context
Add any other context or screenshots about the feature request here.

Go

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

scadapass - updated

updated passwords were just released by SCADA Strangelove

https://github.com/scadastrangelove/SCADAPASS

SCADAPASS-master.zip

profinet write request packet capture

i have been developing a means to read from and write to holding registers of a Device through Profinet Protocol,

regarding the same i have been able to

1. find a device on the network through PN-DCP
2. get/set device parameters
3. Connect to IO of a device sending aconnect request and recieved a response thus, being allocated a new AR.
4. Read a specific api/slot/subslot through PNIO-cm(with your help)

to do: write to a particular api/slot/subslot.

dependency: i could not form a packet to do the same having all properties at hand
help required: if you could please upload a sample write request packet capture as a .pcap file, i would be able to do that.

Look Forward to responses from all sides.

Thanks

IOC Editor

Indicator of Compromise editor by FireEye
https://www.fireeye.com/services/freeware/ioc-editor.html

Quickdraw Modbus pcap

These traffic is normal or abnormal ?
If its abnormal, where can i get an abnormal list?
Thank you!