File modbus-discover
Script types:
portrule
Categories:
discovery, intrusive
Download: http://nmap.org/svn/scripts/modbus-discover.nse
User Summary
Enumerates SCADA Modbus slave ids (sids) and collects their device information.
Modbus is one of the popular SCADA protocols. This script does Modbus device information disclosure. It tries to find legal sids (slave ids) of Modbus devices and to get additional information about the vendor and firmware. This script is improvement of modscan python utility written by Mark Bristow.
Information about MODBUS protocol and security issues:
- MODBUS application protocol specification: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
- Defcon 16 Modscan presentation: https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-bristow.pdf
- Modscan utility is hosted at google code: http://code.google.com/p/modscan/
Script Arguments
aggressive
- boolean value defines find all or just first sid
Example Usage
nmap --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' -p 502 <host>
Script Output
PORT STATE SERVICE 502/tcp open modbus | modbus-discover: | Positive response for sid = 0x64 | SLAVE ID DATA: \xFA\xFFPM710PowerMeter | DEVICE IDENTIFICATION: Schneider Electric PM710 v03.110 |_ Positive error response for sid = 0x96 (GATEWAY TARGET DEVICE FAILED TO RESPONSE)
Requires
Author: Alexander Rudakov
License: Same as Nmap--See http://nmap.org/book/man-legal.html