Script modbus-discover

Script types: portrule
Categories: discovery, intrusive
Download: https://svn.nmap.org/nmap/scripts/modbus-discover.nse

Script Summary

Enumerates SCADA Modbus slave ids (sids) and collects their device information.

Modbus is one of the popular SCADA protocols. This script does Modbus device information disclosure. It tries to find legal sids (slave ids) of Modbus devices and to get additional information about the vendor and firmware. This script is improvement of modscan python utility written by Mark Bristow.

Information about MODBUS protocol and security issues:

• MODBUS application protocol specification: http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf
• Defcon 16 Modscan presentation: https://www.defcon.org/images/defcon-16/dc16-presentations/defcon-16-bristow.pdf
• Modscan utility is hosted at google code: http://code.google.com/p/modscan/

Script Arguments

aggressive

- boolean value defines find all or just first sid

Example Usage

nmap --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' -p 502 <host>

Script Output

PORT    STATE SERVICE
502/tcp open  modbus
| modbus-discover:
|   sid 0x64:
|     Slave ID data: \xFA\xFFPM710PowerMeter
|     Device identification: Schneider Electric PM710 v03.110
|   sid 0x96:
|_    error: GATEWAY TARGET DEVICE FAILED TO RESPONSE

Requires

• comm
• nmap
• shortport
• stdnse
• string
• table

---

Author:

• Alexander Rudakov

License: Same as Nmap--See https://nmap.org/book/man-legal.html