Awesome Industrial Protocols

Compilation of industrial network protocols resources focusing on offensive security.

In this repository:

• You are currently viewing the Awesome Industrial Protocols page.
• Detailed pages for protocols are available in protocols.
• All data is stored in MongoDB databases in db.
• Turn/IP (in srcs) is a handy tool to manipulate this data, generate the awesome list and protocol pages, and simplify the research and test process on industrial protocols.

Note: Sometimes it is unclear whether a name refers to a protocol, a standard, or a complete environment, or if a protocol on a serial link can be accessed in any way from the Ethernet link (through a dedicated implementation or a gateway). I apologize for any confusion, and of course, I welcome any remarks or contributions.

Contents

• BACnet/IP
• CAN
• CC-Link IE
• CIP
• CODESYS
• CSPv4
• DeviceNet
• DF1
• DICOM
• DNP3
• Ether-S-I/O
• EtherCAT
• Ethernet/IP
• ETP
• FF-HSE
• FINS
• FL-net
• GE-SRTP
• HART-IP
• HICP
• HL7
• ICCP
• IEC-60870-5-104
• IEC-61850
• IEEE-C37.118
• ISA100.11a
• KNXnet/IP
• LIS
• LoRaWAN
• M-Bus
• MELSEC
• Modbus
• MQTT
• Niagara Fox
• OPC-DA
• OPC-UA
• PC-WORX
• PCCC
• POWERLINK
• ProConOs
• Profinet-DCP
• Profinet-IO
• S-Bus
• S7comm
• SECS/GEM
• SERCOS-III
• SLMP
• SOME/IP
• TriStation
• TSAA
• UMAS
• WITS
• ZigBee

BACnet/IP

Articles

• 10 things you should know about BACnet - Blog post on RTAutomation
• BACnet CVE-2019-12480 - On M's blog (2019)
• BACnet data representation - Blog post on RTAutomation

Conferences

• (in)Security in Building Automation: How to Create Dark Buildings with Light Speed - Thomas Brandstetter @ Black Hat USA (2017)
• HVACking Understand the Delta Between Security and Reality - Douglas McKee & Mark Bereza @ DEF CON 27 (2019)
• InSecurity in Building Automation - Thomas Brandsetter @ DEF CON 25 ICS Village (2017)
• Mixing industrial protocols with web application security - Bertin Bervis @ DEF CON 27 IoT Village (2019)
• Owning a Building: Exploiting Access Control and Facility Management Systems - Billy Rios @ Black Hat Asia (2014)

Tools

• BACnet Stack - BACnet open source protocol stack
• bacnet-docker - BACnet Tools in Docker

CAN

Documentations

• DBC Specification - A description of CAN database layout
• Linux SocketCAN documentation - kernel.org

Articles

• CAN Injection: keyless car theft - CANIS Automative Labs CTO blog (2023)
• CAN-FD - The basic idea - CAN in Automation
• Click here to download more cars - djnn

Conferences

• (Pen)Testing Vehicles with CANToolz - Alexey Sintsov @ Black Hat Europe (2016)
• All Aboard the CAN Bus or Motorcycle - Derrick @ DEF CON Safe Mode Car Hacking Village (2020)
• CAN Bus in Aviation Investigating CAN Bus in Avionics - Patrick Kiley @ DEF CON 27 Aviation Village (2019)
• CANSPY: Auditing CAN Devices - Jonathan Christofer Demay, Arnaud Lebrun @ DEF CON 24 (2016)
• Cantact: An Open Tool for Automative Exploitation - Eric Evenchick @ Black Hat Asia (2016)
• canTot A CAN Bus Hacking Framework - Jay Turla @ DEF CON 30 Car Hacking Village (2022)
• Deep Learning on CAN BUS - Jun Li @ DEF CON 24 Car Hacking Village (2016)
• DEF CON 31 Car Hacking Village - Abusing CAN Bus Spec for DoS in Embedded Systems - Martin Petran - @ DEF CON (2023)
• Free-Fall: Hacking Tesla from Wireless to CAN Bus - Ling Liu, Sen Nie & Yuefeng Du @ Black Hat USA (2017)
• Fuzzing CAN / CAN FD ECU's and Network - Samir Bhagwat @ DEF CON 29 Car Hacking Village (2021)
• Hopping on the CAN Bus - Eric Evenchick @ Black Hat USA (2015)
• Self-Driving and Connected Cars: Fooling Sensors and Tracking Drivers - Jonathan Petit @ Black Hat Europe (2015)

Papers

• A Fuzz Testing Methodology for Cyber-security Assurance of the Automotive CAN Bus - Daniel S. Fowler, Coventry University (2019)

Tools

• cantools - Python library to play with CAN databases & messages
• opendbc - A list of CAN databases retrieved from reverse-engineered cars
• python-can - Python library to plug to various CAN connectors

CC-Link IE

Documentations

• CC-Link IE Field Network playlist - Mitsubishi Training

CIP

Documentations

• Common Industrial Protocol (CIP) - Overview on ODVA.org
• CompoNet - Overview on ODVA.org
• ControlNet - Overview on ODVA.org
• DeviceNet - Overview on ODVA.org
• Ethernet/IP - Overview on ODVA.org

Conferences

• Hunting EtherNet/IP Protocol Stacks - Sharon Brizinov @ SANS ICS Security Summit 2022

CODESYS

Conferences

• Analyzing PIPEDREAM - Challenges in Testing an ICS Attack Toolkit - Jimmy Wylie @ DEF CON 30 (2022)

CSPv4

DeviceNet

Documentations

• Common Industrial Protocol (CIP) and the family of CIP networks - ODVA publication (2016)
• DeviceNet - Overview on ODVA.org

Articles

• DeviceNet and Ethernet/IP - Blog post on RTAutomation

DF1

Articles

• AB/DF1 Protocol Tips - Lynn's Industrial Automation Protocol Tips blog

Tools

• abdf1 - AB DF1 Protocol RS232 driver for Micrologix, SLC500, PLC 5
• Df1 - Df1 protocol for Allen-Bradley PLC

DICOM

Conferences

• I Am Not a Doctor but I Play One on Your Network - Tim Elrod & Stefan Morris @ DEF CON 19 (2011)

Tools

• DCMTK - DICOM ToolKit
• dicom-server - Microsoft's OSS Implementation of DICOMweb standard
• pydicom - Python package to read, modify and write DICOM files

DNP3

Conferences

• NSM 101 for ICS - Chris Sistrunk @ DEF CON 23 101 Track (2015)
• SCADA Protocol Implementation Considerations | SANS ICS Concepts - @ SANS ICS Security (2022)
• Sniffing SCADA - Karl Koscher @ DEF CON 23 Packet Capture Village (2015)
• Unraveling SCADA Protocols Using Sulley Fuzzer - Ganesh Devarajan @ DEF CON 15 (2014)

Tools

• dnp-info - Nmap discovery script for DNP3
• dnp3-simulator - .NET DNP3 simulator with GUI
• FreyrSCADA DNP3 - DNP3 Protocol - Outstation Server and Client Master Simulator
• gec/dnp3 - Open source Distributed Network Protocol
• gec/dnp3slavesim - Parallel dnp3 slave simulator
• opendnp3 - DNP3 (IEEE-1815) protocol stack. Modern C++ with bindings for .NET and Java
• Step Function I/O DNP3 - Rust implementation of DNP3 (IEEE 1815) with idiomatic bindings for C, .NET, C++, and Java

Ether-S-I/O

EtherCAT

Articles

• Industrial Network Options: EtherCAT Advantages, Challenges, and Specs - Carlos Aguilar, Control Automation (2023)

Ethernet/IP

Documentations

• Common Industrial Protocol (CIP) and the family of CIP networks - ODVA publication (2016)
• Ethernet/IP - Overview on ODVA.org

Articles

• Fuzzing and PR’ing: How We Found Bugs in a Popular Third-Party EtherNet/IP Protocol Stack - Sharon Brizinov, Tal Keren (Claroty, 2021)

Conferences

• Hunting EtherNet/IP Protocol Stacks - Sharon Brizinov @ SANS ICS Security Summit 2022

Tools

• CIPster - Ethernet/IP (Common Industrial Protocol) stack in C++
• cpppo - Communications Protocol Python Parser and Originator -- EtherNet/IP CIP
• enip-stack-detector - EtherNet/IP & CIP Stack Detector
• OpENer - EtherNet/IP stack for I/O adapter devices
• pycomm3 - A Python Ethernet/IP library for communicating with Allen-Bradley PLCs
• scapy-cip-enip - Ethernet/IP dissectors for Scapy

ETP

FF-HSE

FINS

Conferences

• Analyzing PIPEDREAM - Challenges in Testing an ICS Attack Toolkit - Jimmy Wylie @ DEF CON 30 (2022)

FL-net

GE-SRTP

HART-IP

Articles

• WirelessHART Radio Communication Standard - Lessons in Industrial Automation textbook, Control Automation

Conferences

• Dissecting Industrial Wireless Implementations - Blake Johnson @ DEF CON 25 ICS Village (2017)
• DTM Components: Shadow Keys to the ICS Kingdom - Alexander Bolshev and Gleb Cherbov @ Black Hat Europe (2014)
• ICSCorsair: How I Will PWN Your ERP Through 4-20 mA Current Loop - Alexander Bolshev and Gleb Cherbov @ Black Hat USA (2014)
• It WISNt Me Attacking Industrial Wireless Mesh Networks - Paternotte and van Ommeren @ DEF CON 25 (2018)

HICP

HL7

Conferences

• HL7Magic Medical Data Hacking Made Easy - Katie Inns @ DEF CON 31 (2023)
• I Am Not a Doctor but I Play One on Your Network - Tim Elrod & Stefan Morris @ DEF CON 19 (2011)
• Pestilential Protocol: How Unsecure HL7 Messages Threaten Patient Lives - Christian Dameff, Jeffrey Tully & Maxwell Bland @ Black Hat USA (2018)
• Playing with FHIR - Alissa Knight, Mitch Parker @ DEF CON 29 Biohacking Village (2021)
• Understanding HL7 2.X Standards, Pen Testing, and Defending HL7 2.X Messages - Anirudh Duggal @ Black Hat USA (2016)

ICCP

Conferences

• Unraveling SCADA Protocols Using Sulley Fuzzer - Ganesh Devarajan @ DEF CON 15 (2014)

IEC-60870-5-104

Conferences

• Industroyer/Crashoverride: Zero Things Cool About a Threat Group Targeting the Power Grid - Anton Cherepanov, Ben Miller, Joe Slowik, Robert Lee, and Robert Lipovsky @ Black Hat USA (2017)
• Industroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again - Robert Lipovsky & Anton Cherepanov @ Black Hat USA (2022)

Papers

• Description and analysis of IEC 104 Protocol - Technical report by Petr Matousek @ Faculty of Information Techology, Czech Republic (2017)

Tools

• FreyrSCADA IEC-60870-5-104 - IEC 60870-5-104 Protocol - RTU Server and Master Client Simulator
• lib60870 - Implementation of the IEC 60870-5-101/104 protocol

IEC-61850

Conferences

• Fuzz Testing IEC 61850 - Markus Mahrla @ CS3STHLM 2019

Tools

• libiec61850 - Open-source library for the IEC 61850 protocols

IEEE-C37.118

Tools

• OpenPDC - Open Source Phasor Data Concentrator
• PyMU - Library based on the C37.118.2-2011 standard used for accessing PMU data in real-time

ISA100.11a

Conferences

• It WISNt Me Attacking Industrial Wireless Mesh Networks - Paternotte and van Ommeren @ DEF CON 25 (2018)

KNXnet/IP

Documentations

• knx.org - KNX official website

Conferences

• (in)Security in Building Automation: How to Create Dark Buildings with Light Speed - Thomas Brandstetter @ Black Hat USA (2017)
• InSecurity in Building Automation - Thomas Brandsetter @ DEF CON 25 ICS Village (2017)
• Learn how to control every room at a luxury hotel remotely - Jesus Molina @ DEF CON 22 (2015)
• Learn How to Control Every Room at a Luxury Hotel Remotely - Jesus Nomeames @ Black Hat USA (2014)
• Sneak into buildings with KNXnet/IP - Claire Vacherot @ DEF CON 29 (2021)

Papers

• An Overview of Wireless IoT Protocol Security in the Smart Home Domain - Stefan Marksteiner, Víctor Juan Expósito Jiménez, Heribert Vallant, Herwig Zeiner (2018)

Tools

• BOF - Testing framework for industrial protocols
• calimero - Lightweight KNX/IP framework in Java
• ETS - Engineering Tool Software for KNXnet/IP (ETS Demo is free)
• KNX Virtual - Windows-based application simulating a KNX installation
• knxd - KNXd service
• KNXmap - KNXnet/IP scanning and auditing tool
• Unpwning A Building - Peter Panholzer @ S4x22 (2022)
• XKNX - A KNX library written in Python

LIS

LoRaWAN

Conferences

• Can you hear me now DEF CON - wasabi @ DEF CON 26 Wireless Village (2018)
• Lora Smart Water Meter Security Analysis - Zeng and Panel @ DEF CON 26 (2018)
• Outsmarting the Smart City - Daniel Crowley, Jennifer Savage and Mauro Paredes @ Black Hat USA (2018)
• Reversting LoRa Deconstructing a Next Gen Proprietary LP - Matt Knight @ DEF CON 24 Wireless Village (2016)

Tools

• ChirpOTLE - LoRaWAN Security Evaluation Framework
• ChirpStack Network Server - Open-source LoRaWAN network-server
• lorawan-server - Compact server for private LoRaWAN networks
• lorawan-stack - Open Source LoRaWAN Network Server

M-Bus

MELSEC

Conferences

• Taking Apart and Taking Over ICS & SCADA Ecosystems - Mars Cheng & Selmon Yang @ DEF CON 29 (2021)

Modbus

Articles

• Articles about Modbus - Ozeki
• Introduction to Modbus and Modbus Function Codes - Shawn Dietrich, Control Automation (2023)

Conferences

• Analyzing PIPEDREAM - Challenges in Testing an ICS Attack Toolkit - Jimmy Wylie @ DEF CON 30 (2022)
• Fun with Modbus 0x5a Nothing New Still Relevant? - Arnaud Soullié @ DEF CON 25 ICS Village (2017)
• Industrial Control Systems : Pentesting PLCs 101 (Part 1/2) - Arnaud Soullie @ Black Hat Europe (2014)
• Industrial Control Systems : Pentesting PLCs 101 (Part 2/2) - Arnaud Soullie @ Black Hat Europe (2014)
• Industrial Protocol Gateways Under Analysis - Marco Balduzzi @ Black Hat USA (2020)
• Modbus Enumeration | SANS ICS Concepts - @ SANS ICS Security (2021)
• Modbus Man-In-The-Middle | SANS ICS Concepts - @ SANS ICS Security (2021)
• ModScan: A SCADA MODBUS Network Scanner - Mark Bristow @ DEF CON 16 (2013)
• Out of Control: Demonstrating SCADA device exploitation - Eric Forner & Brian Meixell @ Black Hat USA (2013)
• The SCADA That Didn't Cry Wolf- Who's Really Attacking Your ICS Devices - Kyle Wilhoit @ Black Hat USA (2013)
• Understanding SCADA's Modbus Protocol - Justin Searle @ Black Hat Asia (2015)
• Unraveling SCADA Protocols Using Sulley Fuzzer - Ganesh Devarajan @ DEF CON 15 (2014)

Tools

• ctmodbus - A tool to interact with the Modbus protocol
• Malmod - Scripts to attack Modicon M340 via UMAS
• PyModbus - A full modbus protocol written in python

MQTT

Articles

• Not Just Another IIoT Article: MQTT for Pneumatic Cylinder Maintenance - Shawn Dietrich, Control Automation (2023)

Conferences

• Choo Choo, Network Train - The One to Rule Your Perimeter - Martin Hron @ Black Hat Europe (2022)
• Light Weight Protocol: Critical Implications - Lucas Lundgren, Neal Hindocha @ DEF CON 24 (2016)
• When Machines Can't Talk - Federico Maggi & Davide Quarta @ Black Hat Europe (2018)

Niagara Fox

Tools

• foxdissector - Wireshark dissector for the Niagara Fox protocol in Lua

OPC-DA

Papers

• Exploring the OPC attack surface - Claroty Team82 (2021)

Tools

• OPC Data Access IDAPython script - IDA Pro script to reverse engineer binaries containing OPC DA (ESET)

OPC-UA

Articles

• OPC UA Deep Dive (Part 1): History of the OPC UA Protocol - Claroty Team82 (2023)
• OPC UA Deep Dive (Part 2): What is OPC UA? - Claroty Team82 (2023)
• OPC UA Deep Dive (Part 3): Exploring the OPC UA Protocol - Claroty Team82 (2023)
• OPC UA Deep Dive Series (Part 4): Targeting Core OPC UA Components - Claroty Team82 (2023)
• OPC UA Deep Dive Series (Part 5): Inside Team82’s Research Methodology - Claroty Team82 (2023)
• Practical example of fuzzing OPC UA applications - Kaspersky ICS-CERT (2020)
• Understanding the OPC Unified Architecture (OPC UA) Protocol - Anthony King Ho, Control Automation (2023)

Conferences

• A Broken Chain: Discovering OPC UA Attack Surface and Exploiting the Supply Chain - Eran Jacob @ Black Hat USA (2021)
• Analyzing PIPEDREAM - Challenges in Testing an ICS Attack Toolkit - Jimmy Wylie @ DEF CON 30 (2022)
• Exploiting OPC UA - Practical Attacks Against OPC UA Architectures - Sharon Brizinov, Noam Moshe @ DEF CON 31 (2023)
• Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments - Alessandro Erba & Nils Ole Tippenhauer @ Black Hat Europe (2021)

Papers

• Exploring the OPC attack surface - Claroty Team82 (2021)
• OPC UA Security Analysis - German Federal office for Information Security (2022)
• Security Analysis of Vendor Implementations of the OPC UA Protocol for Industrial Control Systems - Alessandro Erba, Anne Müller, Nils Ole Tippenhauer (2021)

Tools

• freeopcua - Open Source C++ OPC-UA Server and Client Library
• OpalOPC - OPC UA vulnerability and misconfiguration scanner
• opcua-client-gui - Simple OPC-UA GUI client
• python-opcua - OPC UA Client and Server in Python
• UA-.NETStandard - Official OPC UA .NET Standard Stack from the OPC Foundation

PC-WORX

PCCC

Articles

• AB/PCCC Protocol Tips - Lynn's Industrial Automation Protocol Tips blog
• Ethernet/IP PCCC Service Codes - Lynn's Industrial protocols over IP blog

POWERLINK

Articles

• Quick Start - POWERLINK on Raspberry Pi2 - Kalycito, 2018 (Web Archive, domain expired)

Tools

• openCONFIGURATOR - Open-source POWERLINK network configuration toolkit
• openPOWERLINK - Open-source POWERLINK protocol stack
• openPOWERLINK_V2 - GitHub page to openPOWERLINK protocol stack release 2

ProConOs

Profinet-DCP

Profinet-IO

Articles

• What Is the Difference Between Profibus and Profinet? - Antonio Armenta, Control Automation (2021)

S-Bus

S7comm

Articles

• The Siemens S7 Communication - Part 1 General Structure - On GyM's Personal Blog (2016)
• The Siemens S7 Communication - Part 2 Job Requests and Ack Data - On GyM's Personal Blog (2017)

Conferences

• Fuzzing and Breaking Security Functions of SIMATIC PLCs - Gao Jian @ Black Hat Europe (2022)
• PLC-Blaster: A worm Living Solely In The PLC - Ralf Spenneberg, Maik Brueggemann & Hendrik Schwartke @ Black Hat Asia (2016)
• Rogue7: Rogue Engineering-Station Attacks on S7 Simatic PLCs - Uriel Malin, Sara Bitan, Avishai Wool and Eli Biham @ Black Hat USA (2019)
• The spear to break the security wall of S7CommPlus - Cheng Lei @ DEF CON 25 (2017)

Tools

• python-snap7 - A Python wrapper for the snap7 PLC communication library
• s7-pcaps - Traffic captures between STEP7/WinCC and S7-300/S7-400 PLCs
• s7scan - Scan networks to gather basic information about Siemens PLCs
• Snap7 - Step7 Open Source Ethernet Communication Suite

SECS/GEM

SERCOS-III

SLMP

Tools

• PySLMPClient - Python client for SLMP

SOME/IP

Documentations

• SOME-IP.com - Main website with resources about SOME/IP

Conferences

• Automotive Ethernet Fuzzing - Jonghyuk Song, Soohwan Oh, Woongjo Choi @ DEF CON 30 (2022)

TriStation

Articles

• Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure - Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer @ Mandiant (2017, updated 2022)

Conferences

• How TRITON Disrupted Safety Systems & Changed the Threat Landscape of Industrial Control Systems - Andrea Carcano, Marina Krotofil & Younes Dragoni @ Black Hat USA (2018)
• Thru the Eyes of the Attacker Designing Embedded Systems for ICS - Krotofil, Wetzels @ DEF CON 26 (2018)

Tools

• tricotools - Triconex TriStation utilities and tools

TSAA

Documentations

• Triconex System Access Application (TSAA) playlist - What Did You Learn Today (2021)

UMAS

Articles

• Reverse of a schneider network protocol - biero llagas (2022)
• The secrets of Schneider Electric’s UMAS protocol - Kaspersky ICS CERT (2022)
• The Unity (UMAS) protocol (Part I) - Liras en la red (2017)
• The Unity (UMAS) protocol (Part II) - Liras en la red (2017)
• The Unity (UMAS) protocol (Part III) - Liras en la red (2017)
• The Unity (UMAS) protocol (Part IV) - Liras en la red (2017)
• The Unity (UMAS) protocol (Part V) - Liras en la red (2017)

Tools

• Malmod - Scripts to attack Modicon M340 via UMAS

WITS

ZigBee

Conferences

• A Lightbulb Worm? - Colin O'Flynn @ Black Hat USA (2016)
• Dont Be Silly It's Only a Lightbulb - Eyal Itkin @ DEF CON Safe Mode (2020)
• Exploring the 802 15 4 Attack Surface - FAZ @ DEF CON 26 WIRELESS VILLAGE (2018)
• Im A Newbie Yet I Can Hack ZigBee - Qing Yang @ DEF CON 23 (2015)
• ZigBee Exploited The Good, The Bad, And The Ugly - Tobias Zillner & Sebastian Strobl @ Black Hat USA (2015)

Papers

• An Overview of Wireless IoT Protocol Security in the Smart Home Domain - Stefan Marksteiner, Víctor Juan Expósito Jiménez, Heribert Vallant, Herwig Zeiner (2018)

Tools

• KillerBee - IEEE 802.15.4/ZigBee Security Research Toolkit
• Mirage - Framework dedicated to the security analysis of wireless communications

All unreviewed AI-generated data is marked with *.
AI is used as a search engine with an extra step. It is never used to find resources because it does not find them, it invents them. More details here.

awesome-industrial-protocols is licensed under CC0. Turn/IP is licensed under GPL-v3.