feat(ics): EtherNet/IP probe + OT service-discovery port scan [#148] #175

Merged
sharang merged 1 commits from feat/ics-portscan-enip into main 2026-07-16 16:48:23 +00:00
Owner

Rounds out the ICS probe (#148, tracker #167) — this completes the dynamic ICS
probing scope.

  • ics::ethernetip — read-only EtherNet/IP (CIP) reachability probe
    (ListIdentity on 44818) → ics-ethernetip-exposed (High, CWE-306).
  • ics::portscan — concurrent TCP connect-scan of a curated OT/ICS +
    insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS
    11740
    , PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
    deep-probed 502/4840/44818 → ics-service-exposed per open port.
  • probe_target now runs Modbus + OPC UA + EtherNet/IP deep probes + the service scan.

Unit-tested against in-process mock servers + a bound-port scan. Full suites green;
clippy + -D warnings test build clean. The OpenPLC/QEMU harnesses are scaffolded
in orca-infra for the infra pass.

🤖 Generated with Claude Code

Rounds out the ICS probe (#148, tracker #167) — this completes the dynamic ICS probing scope. - **`ics::ethernetip`** — read-only EtherNet/IP (CIP) reachability probe (ListIdentity on 44818) → `ics-ethernetip-exposed` (High, CWE-306). - **`ics::portscan`** — concurrent TCP connect-scan of a curated OT/ICS + insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, **CODESYS 11740**, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the deep-probed 502/4840/44818 → `ics-service-exposed` per open port. - `probe_target` now runs Modbus + OPC UA + EtherNet/IP deep probes + the service scan. Unit-tested against in-process mock servers + a bound-port scan. Full suites green; clippy + `-D warnings` test build clean. The OpenPLC/QEMU harnesses are scaffolded in orca-infra for the infra pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
sharang added 1 commit 2026-07-16 16:41:11 +00:00
feat(ics): EtherNet/IP probe + OT/IT service-discovery port scan (#148)
CI / Deploy Docs (pull_request) Has been skipped
CI / Check (pull_request) Successful in 5m16s
CI / Detect Changes (pull_request) Has been skipped
CI / Deploy Agent (pull_request) Has been skipped
CI / Deploy Dashboard (pull_request) Has been skipped
CI / Deploy MCP (pull_request) Has been skipped
a959e86194
Rounds out the ICS probe's protocol coverage and adds recon.

- pipeline::ics::ethernetip — read-only EtherNet/IP (CIP) reachability probe: a
  ListIdentity encapsulation request on 44818; emits `ics-ethernetip-exposed`
  (High, CWE-306).
- pipeline::ics::portscan — concurrent TCP connect-scan of a curated OT/ICS +
  insecure-management port set (S7 102, DNP3 20000, Niagara Fox 1911, CODESYS
  11740, PCWorx, OMRON FINS, Red Lion, Telnet 23, FTP 21), excluding the
  deep-probed 502/4840/44818. Emits `ics-service-exposed` per open port (ICS →
  High/CWE-306, cleartext mgmt → Medium/CWE-319).
- probe_target now runs Modbus + OPC UA + EtherNet/IP deep probes plus the service
  scan.

Unit-tested against in-process mock servers + a bound-port scan. This completes the
dynamic ICS probing scope of #148; the OpenPLC/QEMU harnesses are scaffolded in
orca-infra for the infra pass. Tracker #167.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
sharang merged commit 7932f60ab9 into main 2026-07-16 16:48:23 +00:00
sharang deleted branch feat/ics-portscan-enip 2026-07-16 16:48:23 +00:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#175