Best GitHub Repos to Learn OT/ICS Cybersecurity for FREE!

By /

Listen to this Post

Virtual Lab Environments

  1. GRFICS (Graphical Realism Framework for Industrial Control Simulation) – Simulate an industrial plant while practicing cybersecurity.
  2. Virtual OT/ICS Environment – Defensive and offensive cybersecurity learning platform.

Packet Captures

  1. OT Protocol Packet Captures – Learn Modbus, Profinet, and other OT protocols.
  2. More OT/ICS Packet Captures – Additional datasets for analysis.

Penetration Testing Tools

  1. OT/ICS Pentesting Tools Collection – Extensive list of offensive security tools.
  2. OT/ICS Security Tools & Resources – Another curated list for red/blue teams.

Honeypots

  1. Conpot ICS Honeypot – Popular open-source honeypot for OT security.
  2. T-Mobile’s OT Honeypot – Designed for ICS threat detection.

Additional Resources

You Should Know:

Setting Up Conpot Honeypot (Linux)

 Install dependencies 
sudo apt update && sudo apt install -y python3 git python3-pip

Clone & install Conpot 
git clone https://github.com/mushorg/conpot.git 
cd conpot 
pip3 install -r requirements.txt

Run Conpot (default config) 
python3 conpot.py --template default

Analyzing Modbus Traffic with Wireshark

1. Capture Modbus Traffic:

sudo tcpdump -i eth0 -w modbus.pcap port 502

2. Filter Modbus in Wireshark:

modbus || tcp.port == 502

MITRE Caldera for OT

git clone https://github.com/mitre/caldera-ot.git 
cd caldera-ot 
docker-compose up

MiniCPS Virtual Lab

git clone https://github.com/scy-phy/minicps.git 
cd minicps 
pip3 install -e .

What Undercode Say:

OT/ICS security requires hands-on practice. Use these repos to:
– Simulate attacks with GRFICS.
– Analyze real Modbus/Profinet captures.
– Deploy honeypots (Conpot) to detect threats.
– Leverage Caldera-OT for automated adversary emulation.

Key Commands:

– `nmap -sV –script modbus-discover.nse ` – Scan for Modbus devices.
– `python3 plcsim.py` – Simulate PLC logic (DHALSIM).
– `zeek -r ics_traffic.pcap` – Parse OT traffic with CISA’s Zeek scripts.

Expected Output:

A structured lab report with:

1. Attack vectors tested.

2. Traffic analysis (Wireshark/Zeek).

3. Honeypot logs (Conpot/T-Mobile).

4. Mitigation steps (firewall rules, IDS alerts).

Further Reading:

Expected Output: A detailed lab report with screenshots, command outputs, and security recommendations.

References:

Reported By: Mikeholcomb 8 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 TelegramFeatured Image

Related Posts: