ics::portscan — concurrent TCP connect-scan of a curated OT/ICS +
insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS
11740, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
deep-probed 502/4840/44818 → ics-service-exposed per open port.
probe_target now runs Modbus + OPC UA + EtherNet/IP deep probes + the service scan.
Unit-tested against in-process mock servers + a bound-port scan. Full suites green;
clippy + -D warnings test build clean. The OpenPLC/QEMU harnesses are scaffolded
in orca-infra for the infra pass.
Rounds out the ICS probe (#148, tracker #167) — this completes the dynamic ICS
probing scope.
- **`ics::ethernetip`** — read-only EtherNet/IP (CIP) reachability probe
(ListIdentity on 44818) → `ics-ethernetip-exposed` (High, CWE-306).
- **`ics::portscan`** — concurrent TCP connect-scan of a curated OT/ICS +
insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, **CODESYS
11740**, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
deep-probed 502/4840/44818 → `ics-service-exposed` per open port.
- `probe_target` now runs Modbus + OPC UA + EtherNet/IP deep probes + the service scan.
Unit-tested against in-process mock servers + a bound-port scan. Full suites green;
clippy + `-D warnings` test build clean. The OpenPLC/QEMU harnesses are scaffolded
in orca-infra for the infra pass.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Rounds out the ICS probe's protocol coverage and adds recon.
- pipeline::ics::ethernetip — read-only EtherNet/IP (CIP) reachability probe: a
ListIdentity encapsulation request on 44818; emits `ics-ethernetip-exposed`
(High, CWE-306).
- pipeline::ics::portscan — concurrent TCP connect-scan of a curated OT/ICS +
insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS
11740, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
deep-probed 502/4840/44818. Emits `ics-service-exposed` per open port (ICS →
High/CWE-306, cleartext mgmt → Medium/CWE-319).
- probe_target now runs Modbus + OPC UA + EtherNet/IP deep probes plus the service
scan.
Unit-tested against in-process mock servers + a bound-port scan. This completes the
dynamic ICS probing scope of #148; the OpenPLC/QEMU harnesses are scaffolded in
orca-infra for the infra pass. Tracker #167.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang
merged commit 7932f60ab9 into main2026-07-16 16:48:23 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Rounds out the ICS probe (#148, tracker #167) — this completes the dynamic ICS
probing scope.
ics::ethernetip— read-only EtherNet/IP (CIP) reachability probe(ListIdentity on 44818) →
ics-ethernetip-exposed(High, CWE-306).ics::portscan— concurrent TCP connect-scan of a curated OT/ICS +insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS
11740, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
deep-probed 502/4840/44818 →
ics-service-exposedper open port.probe_targetnow runs Modbus + OPC UA + EtherNet/IP deep probes + the service scan.Unit-tested against in-process mock servers + a bound-port scan. Full suites green;
clippy +
-D warningstest build clean. The OpenPLC/QEMU harnesses are scaffoldedin orca-infra for the infra pass.
🤖 Generated with Claude Code