Best GitHub Repos to Learn OT/ICS Cybersecurity for FREE

Virtual Lab Environments

1. GRFICS – Home of the Graphical Realism Framework for Industrial Control Simulation.
2. OTCyberRange – Virtual environment for learning defensive and offensive OT/ICS cybersecurity.

Packet Captures

1. OT-Packet-Captures – Collection of OT protocol captures (Modbus, Profinet, etc.).
2. ICS-PCAPs – Additional OT/ICS protocol packet captures.

Penetration Testing Tools

1. Awesome-Industrial-Control-System-Pentesting – Comprehensive list of OT/ICS pentesting tools.
2. OT-Security-Resources – Curated tools and learning resources.

Honeypots

1. Conpot – Popular ICS/OT honeypot.
2. T-Mobile TPot – T-Mobile’s OT/ICS honeypot.

Other Resources

• UtilSec – Additional OT/ICS cybersecurity insights.

You Should Know:

Setting Up Conpot Honeypot (Linux)

 Clone the repository 
git clone https://github.com/mushorg/conpot.git 
cd conpot

Install dependencies 
pip install -r requirements.txt

Start Conpot with default config 
python conpot.py --template default 

Analyzing OT Packet Captures with Wireshark

 Install Wireshark 
sudo apt install wireshark

Open a PCAP file 
wireshark /path/to/OT-Packet-Capture.pcap 

Scanning ICS Networks with Nmap

 Scan for open Modbus ports (502) 
nmap -p 502 --script modbus-discover <target_IP>

Detect PLC devices 
nmap -sV --script=s7-info <target_IP> 

Metasploit for ICS Exploitation

 Start Metasploit 
msfconsole

Search for ICS modules 
search scada 
search modbus 

Python Script for Modbus Communication

from pymodbus.client import ModbusTcpClient

client = ModbusTcpClient('192.168.1.100') 
client.connect() 
response = client.read_holding_registers(0, 10) 
print(response.registers) 
client.close() 

What Undercode Say:

OT/ICS cybersecurity is critical for industrial systems. Use these tools to practice in safe environments before real-world deployments. Always follow ethical guidelines.

Additional Commands & Tools:

• PLCScan (plcscan.py -i <target_IP>) – Identify PLC devices.
• Snort for ICS Traffic (snort -c /etc/snort/snort.conf -A console) – Monitor OT network traffic.
• S7comm Exploit Check (nmap --script s7-enumerate.nse <target_IP>).

Expected Output:

A structured guide to OT/ICS cybersecurity resources with hands-on commands for practical learning.

References:

Reported By: Muhammad Abdullah – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram