sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB · PLC/SPS dynamic testing — soft-PLC (OpenPLC) + industrial-protocol probing #148

New Issue
Open
opened 2026-07-12 21:56:19 +00:00 by sharang · 1 comment
sharang commented 2026-07-12 21:56:19 +00:00
Owner
Copy Link
Copy Source

Part of #118. Adds a dynamic dimension to PLC/SPS targets, beyond the static control-logic rules (CS-E epics).

Context

Today PlcSps targets are analyzed statically (Structured Text / PLCopen XML → control-logic security rules, CS-E1/E2/E3). For real OT/ICS coverage we also want to run the logic and probe it over industrial protocols — without needing physical hardware.

Approach (no hardware required)

  • Soft-PLC runtime: OpenPLC (IEC 61131-3 runtime; runs the compiled ST/LD and exposes Modbus / DNP3 / EtherNet-IP). Author from Beremiz (PLCopen XML) or OpenPLC editor.
  • Probe scanner: a dynamic scanner that speaks Modbus/OPC-UA/EtherNet-IP (pymodbus, nmap NSE ICS scripts, Metasploit ICS modules) → findings for unauthenticated writes, missing auth, unsafe register exposure, default creds.

Test targets (OSS)

GRFICS (full simulated ICS plant: OpenPLC + HMI + Modbus), Damn Vulnerable PLC, Conpot (ICS honeypot). Fixtures: OpenPLC / Beremiz example programs.

Hardware (optional, later)

Raspberry Pi + OpenPLC ($60) for physical I/O; Siemens S7-1200 ($200-400, Snap7/S7comm) for industry realism / demos. Not needed for this issue.

Depends

CS-E1/E2 (PLC parser + rules), onboarding PlcSps path, DAST/pentest infra.

Part of #118. Adds a **dynamic** dimension to PLC/SPS targets, beyond the static control-logic rules (CS-E epics). ## Context Today `PlcSps` targets are analyzed statically (Structured Text / PLCopen XML → control-logic security rules, CS-E1/E2/E3). For real OT/ICS coverage we also want to *run* the logic and probe it over industrial protocols — without needing physical hardware. ## Approach (no hardware required) - **Soft-PLC runtime:** OpenPLC (IEC 61131-3 runtime; runs the compiled ST/LD and exposes **Modbus / DNP3 / EtherNet-IP**). Author from Beremiz (PLCopen XML) or OpenPLC editor. - **Probe scanner:** a dynamic scanner that speaks Modbus/OPC-UA/EtherNet-IP (pymodbus, nmap NSE ICS scripts, Metasploit ICS modules) → findings for unauthenticated writes, missing auth, unsafe register exposure, default creds. ## Test targets (OSS) GRFICS (full simulated ICS plant: OpenPLC + HMI + Modbus), Damn Vulnerable PLC, Conpot (ICS honeypot). Fixtures: OpenPLC / Beremiz example programs. ## Hardware (optional, later) Raspberry Pi + OpenPLC (~$60) for physical I/O; Siemens S7-1200 (~$200-400, Snap7/S7comm) for industry realism / demos. Not needed for this issue. ## Depends CS-E1/E2 (PLC parser + rules), onboarding PlcSps path, DAST/pentest infra.
sharang added this to the Onboarding v1 milestone 2026-07-12 21:56:19 +00:00
sharang added the enhancementonboarding labels 2026-07-12 21:56:19 +00:00
sharang commented 2026-07-16 10:41:30 +00:00
Author
Owner
Copy Link
Copy Source

Customer context (tracker #167): the target device runs CODESYS control logic on a Yocto Linux OS — one physical device, two layers. This dynamic path must cover the CODESYS/ICS attack surface (programming protocol 11740/11741, OPC UA, Modbus TCP 502, WebVisu) converging with the Yocto Linux services (SSH/TLS/exposed daemons). Matrix enabler for a PlcSps device: #164.

Customer context (tracker #167): the target device runs **CODESYS control logic on a Yocto Linux OS** — one physical device, two layers. This dynamic path must cover the CODESYS/ICS attack surface (programming protocol 11740/11741, OPC UA, Modbus TCP 502, WebVisu) converging with the Yocto Linux services (SSH/TLS/exposed daemons). Matrix enabler for a PlcSps device: #164.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#148