SlideShare a Scribd company logo
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet




  Gleb Gritsai, Alexander Timorin, Yuri Goltsev, Roman Ilin



               http://scadastrangelove.org/
vendor                product                      google dork                 network info

Siemens     S7-200
                                                                    all models: tcp/udp/102 (by vuln info)




            S7-300                                                  snmp: Siemens, SIMATIC, S7




            S7-3** , PCS7          inurl:/Portal0000.htm            http: /S7Web.css



            Simatic S7                                              snmp: Siemens, SIMATIC S7, CPU-1200
                                                                    Siemens, SIMATIC S7, CPU317-2 PN/DP
                                                                    Siemens, SIMATIC S7, CPU315-2 PN/DP
Siemens, SIMATIC S7 ***

                                      inurl:"Portal/Portal.mwsl"   http: /S7Web.css




Automation License Manager                                         tcp/4410 (by vuln info)




Scalance S,X Security Module firewall                              telnet: Simatic, Scalance
                                                                   snmp: Scalance S*, Scalance W*,
                                                                   Scalance X*
                                                                   DCP protocol (by vuln info)
                                                                   tcp/80




                                                                   netbios: WINCC_SRV21 <0x0>
                                                                   SIEMENS <0x0>
Wincc flexible                                                     WINCC_SRV21 <0x20>
Wincc flexible runtime / TIA Portal                                tcp/2308 (by vuln info)
                                                                   tcp/50523 (by vuln info)
Synco OZW (Web server)                                                       http




SIMATIC HMI Miniweb      intitle:"Miniweb Start Page" | "/CSS/Miniweb.css"   http: /CSS/Miniweb.css




Simatic HMI                                                                  snmp: Siemens, SIMATIC HMI, ***




                                                                             telnet:Welcome to the Windows CE
                                                                             Telnet Service on HMI_Panel
vendor                  product                                google dork                                   network info




               DeltaV and DeltaV
               Workstations/DeltaV
Emerson        ProEssentials Scientific Graph                                                      tcp/udp/111 (by vuln info)



               DeltaV Service Information
               System Ver3.3



   vendor                  product                                google dork                                   network info

Allen-Bradley
Rockwell Automation



               ControlLogix                                                                        tcp/udp/44818 , http
               CompactLogix                     intitle:"Rockwell Automation" "Device Name" "Uptime"
PLC5                                                                http, snmp




                                            inurl:dtm.html intitle:1747-L552
                 SLC-5                      inurl:dtm.html intitle:1747-L551         http, snmp

                 Micrologix                 inurl:home.htm intitle:1766              http, snmp




   vendor                     product                         shodanhq dork                       network info
Schneider Electric



                 PM820SD                    Schneider Electric - PM820SD port:161




                 PM870SD                    Schneider Electric - PM870SD port:161
                 ECC21                      Schneider Electric - ECC21 port:161
                 EGX100MG                   Schneider Electric - EGX100MG port:161



                 PowerLogic PM800           PowerLogic PM800 port:80

                 PowerLogic ION8650 A/B/C   ION8650
PowerLogic ION8650 A/B/C)   8650 ION




PowerLogic ION8600          8600 ION



PowerLogic ION7650/7550     ION 7550


PowerLogic ION7650/7550     ION 7650

PowerLogic ION7300          ION 7300

PowerLogic ION6200          ION6200

PowerLogic PM1200           PM1200

PowerLogic DM6200           DM6200

Powerlogic Enercept

Powerlogic Energy Meter

PowerLogic Branch Current
Monitor                     BCM42

PowerLogic EM4800
PowerLogic E5600

                 PowerLogic Ethernet Gateway
                 (EGX)                         EGX100

                 PowerLogic EGX300             EGX300

                 PowerLogic ION7550RTU         ION 7550RTU
                                               schneider electric




   vendor                     product                               google dork          network info
Schneider Electric
                 Modicon                       intitle:"Quantum CPU Web Server"
                 Quantum/Premiun/Micro         intitle:"Premium CPU Web Server"

                                               intitle:"Citect Web" inurl:scada
                 CitectSCADA                   filetype:htm
                 CitectFacilities




                                               shodanhq: ClearSCADA
                                               "ViewXCtrl is not supported in this web
                                               browser."
                 ClearSCADA                    intitle:"ClearSCADA Home"


                 UnitelWay Device Driver
Vijeo Historian Web Server   several products




             Modicon M340                                                                snmp: "Modicon M340"




    vendor                product                             google dork                           network info
General
Electric

             Cimplicity                   intitle:"CIMPLICITY WebView" inurl:main.html   http




             Proficy                      inurl:ProficyPortal/default.asp                http

More Related Content

What's hot

Hacking_SharePoint_FINAL
Hacking_SharePoint_FINALHacking_SharePoint_FINAL
Hacking_SharePoint_FINAL
Ian Naumenko, CISSP, CRISC
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
Will Schroeder
 
Attacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAttacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVE
Aleksandr Timorin
 
Become A Security Master
Become A Security MasterBecome A Security Master
Become A Security Master
Chong-Kuan Chen
 
How to Test for The OWASP Top Ten
 How to Test for The OWASP Top Ten How to Test for The OWASP Top Ten
How to Test for The OWASP Top Ten
Security Innovation
 
SBOM, Is It 42?
SBOM, Is It 42?SBOM, Is It 42?
SBOM, Is It 42?
Bill Bensing
 
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptxAxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
Jan Galinski
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itAbusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get it
Benjamin Delpy
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Jared Greenhill
 
Serverless, The Middy Way - Workshop
Serverless, The Middy Way - WorkshopServerless, The Middy Way - Workshop
Serverless, The Middy Way - Workshop
Luciano Mammino
 
What should a hacker know about WebDav?
What should a hacker know about WebDav?What should a hacker know about WebDav?
What should a hacker know about WebDav?
Mikhail Egorov
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...
MITRE ATT&CK
 
SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?
Cigital
 
Web Uygulama Güvenliği
Web Uygulama GüvenliğiWeb Uygulama Güvenliği
Web Uygulama Güvenliği
Mesut Güngör
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
n|u - The Open Security Community
 
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesiAndroid Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
BTRisk Bilgi Güvenliği ve BT Yönetişim Hizmetleri
 
Continuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's ReachContinuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's Reach
Matt Tesauro
 
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
Christian Schneider
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
Teymur Kheirkhabarov
 
[Container Plumbing Days 2023] Why was nerdctl made?
[Container Plumbing Days 2023] Why was nerdctl made?[Container Plumbing Days 2023] Why was nerdctl made?
[Container Plumbing Days 2023] Why was nerdctl made?
Akihiro Suda
 

What's hot (20)

Hacking_SharePoint_FINAL
Hacking_SharePoint_FINALHacking_SharePoint_FINAL
Hacking_SharePoint_FINAL
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
 
Attacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVEAttacking SCADA systems: Story Of SCADASTRANGELOVE
Attacking SCADA systems: Story Of SCADASTRANGELOVE
 
Become A Security Master
Become A Security MasterBecome A Security Master
Become A Security Master
 
How to Test for The OWASP Top Ten
 How to Test for The OWASP Top Ten How to Test for The OWASP Top Ten
How to Test for The OWASP Top Ten
 
SBOM, Is It 42?
SBOM, Is It 42?SBOM, Is It 42?
SBOM, Is It 42?
 
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptxAxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
AxonIQCon22 - Beyond DDD 101 - Zambrovski-Galinski.pptx
 
Abusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get itAbusing Microsoft Kerberos - Sorry you guys don't get it
Abusing Microsoft Kerberos - Sorry you guys don't get it
 
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced ActorsMemory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
Memory Forensics for IR - Leveraging Volatility to Hunt Advanced Actors
 
Serverless, The Middy Way - Workshop
Serverless, The Middy Way - WorkshopServerless, The Middy Way - Workshop
Serverless, The Middy Way - Workshop
 
What should a hacker know about WebDav?
What should a hacker know about WebDav?What should a hacker know about WebDav?
What should a hacker know about WebDav?
 
It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...
 
SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?SAST vs. DAST: What’s the Best Method For Application Security Testing?
SAST vs. DAST: What’s the Best Method For Application Security Testing?
 
Web Uygulama Güvenliği
Web Uygulama GüvenliğiWeb Uygulama Güvenliği
Web Uygulama Güvenliği
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
 
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesiAndroid Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
Android Uygulamaların Tersine Mühendislik Yöntemi ile İncelenmesi
 
Continuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's ReachContinuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's Reach
 
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
Security DevOps - Free pentesters' time to focus on high-hanging fruits // Ha...
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
 
[Container Plumbing Days 2023] Why was nerdctl made?
[Container Plumbing Days 2023] Why was nerdctl made?[Container Plumbing Days 2023] Why was nerdctl made?
[Container Plumbing Days 2023] Why was nerdctl made?
 

Similar to ICS/SCADA/PLC Google/Shodanhq Cheat Sheet

ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
qqlan
 
Technical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series SwitchesTechnical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series Switches
Robb Boyd
 
ScilabTEC 2015 - Xilinx
ScilabTEC 2015 - XilinxScilabTEC 2015 - Xilinx
ScilabTEC 2015 - Xilinx
Scilab
 
SCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the NameSCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the Name
Positive Hack Days
 
SCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имяSCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имя
Ekaterina Melnik
 
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
Michael Smith
 
Mohamed Zakaria 01-2017
Mohamed Zakaria 01-2017Mohamed Zakaria 01-2017
Mohamed Zakaria 01-2017
Mohamed Zakaria
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
arnaudsoullie
 
FE_Technologies_PLC.ppt
FE_Technologies_PLC.pptFE_Technologies_PLC.ppt
FE_Technologies_PLC.ppt
Dilupa Herath
 
FE_Technologies_PLC.ppt
FE_Technologies_PLC.pptFE_Technologies_PLC.ppt
FE_Technologies_PLC.ppt
luisvillanueva16463
 
CHM_Technologies_PLC.ppt
CHM_Technologies_PLC.pptCHM_Technologies_PLC.ppt
CHM_Technologies_PLC.ppt
VinothInst
 
SELTA Energy Automation Portfolio 2018
SELTA Energy Automation Portfolio 2018SELTA Energy Automation Portfolio 2018
SELTA Energy Automation Portfolio 2018
SELTA
 
practical-guide-to-opcua.pdf
practical-guide-to-opcua.pdfpractical-guide-to-opcua.pdf
practical-guide-to-opcua.pdf
ssuser357595
 
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
ROMSAT
 
26.1.7 lab snort and firewall rules
26.1.7 lab   snort and firewall rules26.1.7 lab   snort and firewall rules
26.1.7 lab snort and firewall rules
Freddy Buenaño
 
S7 bas-16
S7 bas-16S7 bas-16
S7 bas-16
confidencial
 
Overview of RTaW SysML-Companion
Overview of RTaW SysML-Companion Overview of RTaW SysML-Companion
Overview of RTaW SysML-Companion
RealTime-at-Work (RTaW)
 
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVERPARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
Shaheem TM
 
BRKRST-3068 Troubleshooting Catalyst 2K and 3K.pdf
BRKRST-3068  Troubleshooting Catalyst 2K and 3K.pdfBRKRST-3068  Troubleshooting Catalyst 2K and 3K.pdf
BRKRST-3068 Troubleshooting Catalyst 2K and 3K.pdf
ssusercbaa33
 
2 s120 commissioning
2 s120 commissioning2 s120 commissioning
2 s120 commissioning
confidencial
 

Similar to ICS/SCADA/PLC Google/Shodanhq Cheat Sheet (20)

ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
ICS/SCADA/PLC Google/Shodanhq Cheat Sheet v2
 
Technical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series SwitchesTechnical Overview of Cisco Catalyst 9200 Series Switches
Technical Overview of Cisco Catalyst 9200 Series Switches
 
ScilabTEC 2015 - Xilinx
ScilabTEC 2015 - XilinxScilabTEC 2015 - Xilinx
ScilabTEC 2015 - Xilinx
 
SCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the NameSCADA Strangelove: Hacking in the Name
SCADA Strangelove: Hacking in the Name
 
SCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имяSCADA Strangelove: взлом во имя
SCADA Strangelove: взлом во имя
 
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
BlackHat 2011 - Exploiting Siemens Simatic S7 PLCs (slides)
 
Mohamed Zakaria 01-2017
Mohamed Zakaria 01-2017Mohamed Zakaria 01-2017
Mohamed Zakaria 01-2017
 
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
Introduction to Industrial Control Systems : Pentesting PLCs 101 (BlackHat Eu...
 
FE_Technologies_PLC.ppt
FE_Technologies_PLC.pptFE_Technologies_PLC.ppt
FE_Technologies_PLC.ppt
 
FE_Technologies_PLC.ppt
FE_Technologies_PLC.pptFE_Technologies_PLC.ppt
FE_Technologies_PLC.ppt
 
CHM_Technologies_PLC.ppt
CHM_Technologies_PLC.pptCHM_Technologies_PLC.ppt
CHM_Technologies_PLC.ppt
 
SELTA Energy Automation Portfolio 2018
SELTA Energy Automation Portfolio 2018SELTA Energy Automation Portfolio 2018
SELTA Energy Automation Portfolio 2018
 
practical-guide-to-opcua.pdf
practical-guide-to-opcua.pdfpractical-guide-to-opcua.pdf
practical-guide-to-opcua.pdf
 
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
Edge-Core - экономия без потери качества | Семинар для интеграторов 15.06.17
 
26.1.7 lab snort and firewall rules
26.1.7 lab   snort and firewall rules26.1.7 lab   snort and firewall rules
26.1.7 lab snort and firewall rules
 
S7 bas-16
S7 bas-16S7 bas-16
S7 bas-16
 
Overview of RTaW SysML-Companion
Overview of RTaW SysML-Companion Overview of RTaW SysML-Companion
Overview of RTaW SysML-Companion
 
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVERPARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
PARAMETER SENSING REMOTE OPERATED VIDEO ENHANCED RECEIVER
 
BRKRST-3068 Troubleshooting Catalyst 2K and 3K.pdf
BRKRST-3068  Troubleshooting Catalyst 2K and 3K.pdfBRKRST-3068  Troubleshooting Catalyst 2K and 3K.pdf
BRKRST-3068 Troubleshooting Catalyst 2K and 3K.pdf
 
2 s120 commissioning
2 s120 commissioning2 s120 commissioning
2 s120 commissioning
 

More from qqlan

D1 t1 t. yunusov k. nesterov - bootkit via sms
D1 t1   t. yunusov k. nesterov - bootkit via smsD1 t1   t. yunusov k. nesterov - bootkit via sms
D1 t1 t. yunusov k. nesterov - bootkit via sms
qqlan
 
Kaspersky SAS SCADA in the Cloud
Kaspersky SAS SCADA in the CloudKaspersky SAS SCADA in the Cloud
Kaspersky SAS SCADA in the Cloud
qqlan
 
Миссиоцентрический подход к кибербезопасности АСУ ТП
Миссиоцентрический подход к кибербезопасности АСУ ТПМиссиоцентрический подход к кибербезопасности АСУ ТП
Миссиоцентрический подход к кибербезопасности АСУ ТП
qqlan
 
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
qqlan
 
Best of Positive Research 2013
Best of Positive Research 2013Best of Positive Research 2013
Best of Positive Research 2013
qqlan
 
Web-style Wireless IDS attacks, Sergey Gordeychik
Web-style Wireless IDS attacks, Sergey GordeychikWeb-style Wireless IDS attacks, Sergey Gordeychik
Web-style Wireless IDS attacks, Sergey Gordeychik
qqlan
 
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
qqlan
 
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
qqlan
 
Pt infosec - 2014 - импортозамещение
Pt   infosec - 2014 - импортозамещениеPt   infosec - 2014 - импортозамещение
Pt infosec - 2014 - импортозамещениеqqlan
 
SCADA StrangeLove Kaspersky SAS 2014 - LHC
SCADA StrangeLove Kaspersky SAS 2014 - LHCSCADA StrangeLove Kaspersky SAS 2014 - LHC
SCADA StrangeLove Kaspersky SAS 2014 - LHC
qqlan
 
Firebird Interbase Database engine hacks or rtfm
Firebird Interbase Database engine hacks or rtfmFirebird Interbase Database engine hacks or rtfm
Firebird Interbase Database engine hacks or rtfm
qqlan
 
SCADA StrangeLove 2: We already know
SCADA StrangeLove 2:  We already knowSCADA StrangeLove 2:  We already know
SCADA StrangeLove 2: We already know
qqlan
 
Internet connected ICS/SCADA/PLC
Internet connected ICS/SCADA/PLCInternet connected ICS/SCADA/PLC
Internet connected ICS/SCADA/PLC
qqlan
 
SCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architectureSCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architecture
qqlan
 
Techniques of attacking ICS systems
Techniques of attacking ICS systems Techniques of attacking ICS systems
Techniques of attacking ICS systems
qqlan
 
Positive Technologies Application Inspector
Positive Technologies Application InspectorPositive Technologies Application Inspector
Positive Technologies Application Inspector
qqlan
 
Database honeypot by design
Database honeypot by designDatabase honeypot by design
Database honeypot by design
qqlan
 
Positive Technologies Application Inspector
Positive Technologies Application InspectorPositive Technologies Application Inspector
Positive Technologies Application Inspector
qqlan
 
Black Hat: XML Out-Of-Band Data Retrieval
Black Hat: XML Out-Of-Band Data RetrievalBlack Hat: XML Out-Of-Band Data Retrieval
Black Hat: XML Out-Of-Band Data Retrieval
qqlan
 
Positive Technologies - S4 - Scada under x-rays
Positive Technologies - S4 - Scada under x-raysPositive Technologies - S4 - Scada under x-rays
Positive Technologies - S4 - Scada under x-rays
qqlan
 

More from qqlan (20)

D1 t1 t. yunusov k. nesterov - bootkit via sms
D1 t1   t. yunusov k. nesterov - bootkit via smsD1 t1   t. yunusov k. nesterov - bootkit via sms
D1 t1 t. yunusov k. nesterov - bootkit via sms
 
Kaspersky SAS SCADA in the Cloud
Kaspersky SAS SCADA in the CloudKaspersky SAS SCADA in the Cloud
Kaspersky SAS SCADA in the Cloud
 
Миссиоцентрический подход к кибербезопасности АСУ ТП
Миссиоцентрический подход к кибербезопасности АСУ ТПМиссиоцентрический подход к кибербезопасности АСУ ТП
Миссиоцентрический подход к кибербезопасности АСУ ТП
 
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
ABUSE THEIR CLOUDS. ОБЛАЧНЫЕ ВЫЧИСЛЕНИЯ ГЛАЗАМИ ПЕНТЕСТЕРА, ЮРИЙ ГОЛЬЦЕВ, СЕ...
 
Best of Positive Research 2013
Best of Positive Research 2013Best of Positive Research 2013
Best of Positive Research 2013
 
Web-style Wireless IDS attacks, Sergey Gordeychik
Web-style Wireless IDS attacks, Sergey GordeychikWeb-style Wireless IDS attacks, Sergey Gordeychik
Web-style Wireless IDS attacks, Sergey Gordeychik
 
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
G. Gritsai, A. Timorin, Y. Goltsev, R. Ilin, S. Gordeychik, and A. Karpin, “S...
 
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
SCADA StrangeLove: Too Smart Grid in da Cloud [31c3]
 
Pt infosec - 2014 - импортозамещение
Pt   infosec - 2014 - импортозамещениеPt   infosec - 2014 - импортозамещение
Pt infosec - 2014 - импортозамещение
 
SCADA StrangeLove Kaspersky SAS 2014 - LHC
SCADA StrangeLove Kaspersky SAS 2014 - LHCSCADA StrangeLove Kaspersky SAS 2014 - LHC
SCADA StrangeLove Kaspersky SAS 2014 - LHC
 
Firebird Interbase Database engine hacks or rtfm
Firebird Interbase Database engine hacks or rtfmFirebird Interbase Database engine hacks or rtfm
Firebird Interbase Database engine hacks or rtfm
 
SCADA StrangeLove 2: We already know
SCADA StrangeLove 2:  We already knowSCADA StrangeLove 2:  We already know
SCADA StrangeLove 2: We already know
 
Internet connected ICS/SCADA/PLC
Internet connected ICS/SCADA/PLCInternet connected ICS/SCADA/PLC
Internet connected ICS/SCADA/PLC
 
SCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architectureSCADA deep inside:protocols and software architecture
SCADA deep inside:protocols and software architecture
 
Techniques of attacking ICS systems
Techniques of attacking ICS systems Techniques of attacking ICS systems
Techniques of attacking ICS systems
 
Positive Technologies Application Inspector
Positive Technologies Application InspectorPositive Technologies Application Inspector
Positive Technologies Application Inspector
 
Database honeypot by design
Database honeypot by designDatabase honeypot by design
Database honeypot by design
 
Positive Technologies Application Inspector
Positive Technologies Application InspectorPositive Technologies Application Inspector
Positive Technologies Application Inspector
 
Black Hat: XML Out-Of-Band Data Retrieval
Black Hat: XML Out-Of-Band Data RetrievalBlack Hat: XML Out-Of-Band Data Retrieval
Black Hat: XML Out-Of-Band Data Retrieval
 
Positive Technologies - S4 - Scada under x-rays
Positive Technologies - S4 - Scada under x-raysPositive Technologies - S4 - Scada under x-rays
Positive Technologies - S4 - Scada under x-rays
 

Recently uploaded

WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
Postman
 
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024
Jason Packer
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides
DanBrown980551
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
ssuserfac0301
 
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
Data Hops
 
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
Jason Yip
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
Public CyberSecurity Awareness Presentation 2024.pptx
Public CyberSecurity Awareness Presentation 2024.pptxPublic CyberSecurity Awareness Presentation 2024.pptx
Public CyberSecurity Awareness Presentation 2024.pptx
marufrahmanstratejm
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
Fwdays
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Alpen-Adria-Universität
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Alex Pruden
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
Tatiana Kojar
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
Zilliz
 

Recently uploaded (20)

WeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation TechniquesWeTestAthens: Postman's AI & Automation Techniques
WeTestAthens: Postman's AI & Automation Techniques
 
Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024Columbus Data & Analytics Wednesdays - June 2024
Columbus Data & Analytics Wednesdays - June 2024
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides5th LF Energy Power Grid Model Meet-up Slides
5th LF Energy Power Grid Model Meet-up Slides
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 
Taking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdfTaking AI to the Next Level in Manufacturing.pdf
Taking AI to the Next Level in Manufacturing.pdf
 
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3FREE A4 Cyber Security Awareness  Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
 
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
Public CyberSecurity Awareness Presentation 2024.pptx
Public CyberSecurity Awareness Presentation 2024.pptxPublic CyberSecurity Awareness Presentation 2024.pptx
Public CyberSecurity Awareness Presentation 2024.pptx
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing InstancesEnergy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
 
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
 
Skybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoptionSkybuffer SAM4U tool for SAP license adoption
Skybuffer SAM4U tool for SAP license adoption
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 
Fueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte WebinarFueling AI with Great Data with Airbyte Webinar
Fueling AI with Great Data with Airbyte Webinar
 

ICS/SCADA/PLC Google/Shodanhq Cheat Sheet

  • 1. ICS/SCADA/PLC Google/Shodanhq Cheat Sheet Gleb Gritsai, Alexander Timorin, Yuri Goltsev, Roman Ilin http://scadastrangelove.org/
  • 2. vendor product google dork network info Siemens S7-200 all models: tcp/udp/102 (by vuln info) S7-300 snmp: Siemens, SIMATIC, S7 S7-3** , PCS7 inurl:/Portal0000.htm http: /S7Web.css Simatic S7 snmp: Siemens, SIMATIC S7, CPU-1200 Siemens, SIMATIC S7, CPU317-2 PN/DP Siemens, SIMATIC S7, CPU315-2 PN/DP
  • 3. Siemens, SIMATIC S7 *** inurl:"Portal/Portal.mwsl" http: /S7Web.css Automation License Manager tcp/4410 (by vuln info) Scalance S,X Security Module firewall telnet: Simatic, Scalance snmp: Scalance S*, Scalance W*, Scalance X* DCP protocol (by vuln info) tcp/80 netbios: WINCC_SRV21 <0x0> SIEMENS <0x0> Wincc flexible WINCC_SRV21 <0x20> Wincc flexible runtime / TIA Portal tcp/2308 (by vuln info) tcp/50523 (by vuln info)
  • 4. Synco OZW (Web server) http SIMATIC HMI Miniweb intitle:"Miniweb Start Page" | "/CSS/Miniweb.css" http: /CSS/Miniweb.css Simatic HMI snmp: Siemens, SIMATIC HMI, *** telnet:Welcome to the Windows CE Telnet Service on HMI_Panel
  • 5. vendor product google dork network info DeltaV and DeltaV Workstations/DeltaV Emerson ProEssentials Scientific Graph tcp/udp/111 (by vuln info) DeltaV Service Information System Ver3.3 vendor product google dork network info Allen-Bradley Rockwell Automation ControlLogix tcp/udp/44818 , http CompactLogix intitle:"Rockwell Automation" "Device Name" "Uptime"
  • 6. PLC5 http, snmp inurl:dtm.html intitle:1747-L552 SLC-5 inurl:dtm.html intitle:1747-L551 http, snmp Micrologix inurl:home.htm intitle:1766 http, snmp vendor product shodanhq dork network info Schneider Electric PM820SD Schneider Electric - PM820SD port:161 PM870SD Schneider Electric - PM870SD port:161 ECC21 Schneider Electric - ECC21 port:161 EGX100MG Schneider Electric - EGX100MG port:161 PowerLogic PM800 PowerLogic PM800 port:80 PowerLogic ION8650 A/B/C ION8650
  • 7. PowerLogic ION8650 A/B/C) 8650 ION PowerLogic ION8600 8600 ION PowerLogic ION7650/7550 ION 7550 PowerLogic ION7650/7550 ION 7650 PowerLogic ION7300 ION 7300 PowerLogic ION6200 ION6200 PowerLogic PM1200 PM1200 PowerLogic DM6200 DM6200 Powerlogic Enercept Powerlogic Energy Meter PowerLogic Branch Current Monitor BCM42 PowerLogic EM4800
  • 8. PowerLogic E5600 PowerLogic Ethernet Gateway (EGX) EGX100 PowerLogic EGX300 EGX300 PowerLogic ION7550RTU ION 7550RTU schneider electric vendor product google dork network info Schneider Electric Modicon intitle:"Quantum CPU Web Server" Quantum/Premiun/Micro intitle:"Premium CPU Web Server" intitle:"Citect Web" inurl:scada CitectSCADA filetype:htm CitectFacilities shodanhq: ClearSCADA "ViewXCtrl is not supported in this web browser." ClearSCADA intitle:"ClearSCADA Home" UnitelWay Device Driver
  • 9. Vijeo Historian Web Server several products Modicon M340 snmp: "Modicon M340" vendor product google dork network info General Electric Cimplicity intitle:"CIMPLICITY WebView" inurl:main.html http Proficy inurl:ProficyPortal/default.asp http