ICS Penetration Testing Professional

• Briefing of ICS
• Difference between ICS and DCS
• Briefing of ISA99/IEC62443, NIST 800-82
• Briefing of PLC and RTU
• ICS architecture
• ICS Protocols Overview

Modbus
– Introduction and protocol Overview
– Reconnaissance (Active and Passive)
– Sniffing and Eavesdropping
– Baseline Response Replay
– Modbus Flooding
– Modifying Coil and register values of PLC

S7 Communication
– Introduction and protocol Overview
– Reconnaissance (Active and Passive)
– Sniffing and Eavesdropping
– Uploading and downloading PLC programmes
– Start and Stop plc CPU

AST protocol
– Introduction and protocol Overview
– Reconnaissance (Active and Passive)
– Retrieve data from controller.
– Modifying data over controller

DNP3
– Introduction and protocol Overview
– Reconnaissance (Active and Passive)
– Length Overflow attack
– Reset function attack

Canbus
– Introduction and protocol Overview
– Reconnaissance (Active and Passive)
– Sniffing and Eavesdropping
– Replay Attack
– Packet forging attack

Serial/Coupler servers
– Introduction
– Application attacks
– Hardware Attack

Industrial MQTT
– Introduction
– Protocols details
– Recon and Enumeration of Topics
– Reversing engineering of communication
– DOS attacks

Zigbee (802.15.4)
– Introduction and protocol Overview
– Reconnaissance
– Sniffing and Eavesdropping
– Replay attacks
– Packet forging attack
– Jamming Attacks
– Dissociation Attacks

Hardware Analysis 12C
– Introduction
– I2C Protocol
– Interfacing with I2C
– Manipulating Data via I2C
– Sniffing run-time I2C communication

SPI
– Introduction
– SPI Protocol
– Interfacing with SPI
– Manipulating data via SPI
– Sniffing run-time SPI communication

UART
– Introduction
– Identifying UART
– Automated Way
– Manually
– Debugging over UART

JTAG/SWD
– Introduction
– Identifying JTAG/SWD
– Automated Way
– Manually
– Debugging over JTAG/SWD
– Dumping data and manipulating memory address and data

Firmware Reversing
– Identifying compression and types
– Firmware Analysis
– Simulating Firmware

ARM
– Architecture
– Instruction set
– Procedure call convention
– System call convention
– Reversing techniques
– Buffer overflow attacks