Listen to this Post
Introduction:
Industrial control systems (ICS) and supervisory control and data acquisition (SCADA) environments form the backbone of critical infrastructure—power grids, water treatment plants, and manufacturing lines. Yet, training cybersecurity professionals to defend these systems has historically been prohibitively expensive, with a single programmable logic controller (PLC) costing several thousand euros and requiring a dozen more for meaningful attack-surface practice. Conpot, an open-source ICS honeypot, shatters this barrier by emulating a Siemens S7-200 PLC on a standard Linux VM, speaking real industrial protocols like Modbus, S7Comm, HTTP, and SNMP. This transforms the learning paradigm: students can now scan, recon, and exploit a virtual industrial target without ever touching a live critical infrastructure—and without the fear of causing a blackout or a million-euro production halt.
Learning Objectives:
- Deploy and configure Conpot, an open-source ICS/SCADA honeypot, on a Linux environment using both manual installation and Docker containers.
- Perform reconnaissance and vulnerability scanning against emulated industrial protocols using Nmap, SNMP enumeration, and custom scripts.
- Analyze attacker behavior, detect honeypot fingerprints, and implement customizations to increase deception and evade Shodan-based detection.
1. Deploying Conpot: Your Free Virtual PLC Lab
The fastest way to get a virtual PLC running is via Docker, which eliminates dependency hell and provides a clean, isolated environment. Start by preparing your Linux VM or VPS:
sudo apt update && sudo apt upgrade -y sudo apt install -y docker.io nmap ufw sudo systemctl enable --1ow docker
Configure the firewall to expose only the necessary industrial ports while keeping SSH accessible for management:
sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow 22/tcp SSH management sudo ufw allow 80/tcp HTTP web interface sudo ufw allow 502/tcp Modbus sudo ufw allow 102/tcp S7Comm (Siemens) sudo ufw allow 161/udp SNMP sudo ufw enable
Pull the official Conpot image and run it with port mappings that translate host-standard ports to container-internal ports (the default template often binds to 5020 and 10201 internally):
sudo docker pull honeynet/conpot:latest sudo docker run -it \ -p 80:80 \ -p 102:10201 \ -p 502:5020 \ -p 161:161/udp \ --1ame conpot_lab \ --1etwork bridge \ honeynet/conpot:latest /bin/sh
Inside the container, start Conpot with the default Siemens S7-200 template:
~/.local/bin/conpot -f --template default
You should see confirmation logs indicating that the Modbus, S7Comm, and HTTP servers have started. To verify from the host, run:
sudo docker logs -f conpot_lab
For Windows users, the equivalent Docker commands work identically within PowerShell or WSL2 after installing Docker Desktop. Alternatively, Conpot can be installed directly via pip:
pip install conpot conpot --template default
This deploys a low-interaction honeypot that emulates a Siemens S7-200 CPU with expansion modules. The entire setup costs nothing but a few minutes and a VM—a stark contrast to the thousands of euros required for physical PLC hardware.
2. Scanning the Virtual PLC: Nmap Reconnaissance
With Conpot running, the next step is to perform reconnaissance just as an attacker would. Nmap is the Swiss Army knife for network discovery, and it speaks industrial protocols natively through its NSE scripts.
First, verify that the ports are open and correctly mapped:
sudo nmap -sT -p 502,102 127.0.0.1
Expected output shows `502/tcp open` and 102/tcp open. Next, perform Modbus-specific discovery to enumerate slave IDs and device identification strings:
sudo nmap -sT -p 502 --script modbus-discover.nse <target-ip>
For a more aggressive scan that probes multiple unit IDs:
sudo nmap -sT -p 502 --script modbus-discover.nse --script-args='modbus-discover.aggressive=true' <target-ip>
The S7Comm protocol, used by Siemens PLCs, can also be interrogated. While Nmap lacks a dedicated S7 script, tools like `s7comm-scan` from the metasploit framework or custom Python scripts using the `pyS7` library can enumerate CPU types, module states, and operating modes.
For a full port scan across all 65,535 ports:
sudo nmap -sS -p- -T4 <target-ip>
This reveals not only the expected industrial ports but also the HTTP server (port 80) and SNMP (UDP 161), providing a comprehensive attack surface map. The key learning here is that industrial devices, even when emulated, respond to the same probes as real hardware—making Conpot an authentic training ground.
3. SNMP Enumeration: Extracting the Digital Breadcrumbs
SNMP (Simple Network Management Protocol) is ubiquitous in industrial environments for monitoring and diagnostics. Misconfigured SNMP with default community strings (e.g., “public”, “private”) can expose a treasure trove of system information. Conpot emulates an SNMP agent that responds to queries, allowing students to practice extraction without risking a real device.
Use `snmpwalk` to enumerate the entire Management Information Base (MIB):
snmpwalk -v 2c -c public <target-ip> 1.3.6.1.2.1.1
This retrieves system description, uptime, contact details, and more. To extract the device description specifically:
snmpget -v 2c -c public <target-ip> 1.3.6.1.2.1.1.1.0
The default response from Conpot is “Siemens, SIMATIC, S7-200”. More advanced enumeration can target interface tables and routing information:
snmpwalk -v 2c -c public <target-ip> 1.3.6.1.2.1.2.2.1.2
On Windows, the same commands work using the `snmpwalk` binary from the Windows SNMP tools or via PowerShell with the `Get-Snmp` module. This exercise teaches students that SNMP, often overlooked, is a potent reconnaissance vector that can reveal hardware models, firmware versions, and network topology—information invaluable for planning deeper attacks.
4. The Industrial Web Server: Exploiting Misconfigurations
Conpot’s default template includes an HTTP server that emulates a poorly configured industrial web interface. Navigating to `http://
Common misconfigurations to test include:
- Directory traversal: Attempt to access `http://
/../../etc/passwd` to check for path traversal vulnerabilities. - Default credentials: Many industrial web interfaces ship with hardcoded credentials like `admin:admin` or
administrator:blank. Students can attempt basic authentication brute-forcing using tools like Hydra:
hydra -l admin -P /usr/share/wordlists/rockyou.txt <target-ip> http-get /
- Information disclosure: Inspect the HTML source, response headers, and cookie values for exposed version numbers, internal IPs, or comments left by developers.
For a more structured approach, use `nikto` for automated web server scanning:
nikto -h http://<target-ip>
This highlights the importance of securing not just the industrial protocols but also the ancillary services that often accompany PLCs. In real-world incidents, attackers have gained initial access through vulnerable web interfaces before pivoting to the control network.
5. Customizing Conpot: Evading Shodan and Increasing Realism
A default Conpot deployment is easily detectable by Shodan and other internet-scale scanners due to predictable fingerprints. Advanced training involves customizing the honeypot to appear more legitimate, forcing students to think like both Red (evading detection) and Blue (making the lure credible).
The configuration resides in the `default.xml` profile within the templates directory. Key customization areas include:
- Modbus device info: Modify the `
` section to return different vendor strings, model numbers, and firmware versions. - SNMP MIB values: Change the `sysDescr` symbol to mimic a different PLC model, e.g., “Rockwell Automation, Allen-Bradley, ControlLogix”. This can be extended by importing custom MIB files:
wget http://www.iana.org/assignments/ianaiftype-mib/ianaiftype-mib wget ftp://ftp.cisco.com/pub/mibs/v2/IF-MIB.my sudo conpot -t my_custom_template.xml -a /opt/mymibs
- HTTP response customization: Modify the HTML served on port 80 to include realistic branding, version numbers, and even fake login portals.
- Protocol behavior tuning: Adjust the response times, error messages, and register values to mimic specific PLC models more accurately.
Research has shown that default Conpot implementations are easily fingerprinted by Shodan, but sophisticated customization—including format encryption for serial numbers and identifiers—can significantly enhance deceptiveness. This cat-and-mouse game of detection and evasion is precisely what makes Conpot an exceptional pedagogical tool.
6. Log Analysis and Threat Hunting
Conpot logs every interaction, providing a rich dataset for blue-team training. Logs can be viewed in real-time from the host:
sudo docker logs -f conpot_lab
For persistent storage and analysis, integrate Conpot with a SIEM (e.g., ELK stack, Splunk) by forwarding logs via syslog or the hpfeeds protocol. The hpfeeds feature, when enabled, automatically transmits attack data to The Honeynet Project, contributing to global threat intelligence.
Sample log entries include:
Modbus request: Function Code 3 (Read Holding Registers), Address 0, Quantity 10 S7Comm request: Read Var, Area DB, DB Number 1, Start 0, Length 100 HTTP GET / from 192.168.1.100 SNMP GET request for 1.3.6.1.2.1.1.1.0
Students can practice writing detection rules—for example, in Suricata or Snort—to flag anomalous S7Comm write requests or Modbus function code 5 (write single coil) that could indicate an attempt to manipulate physical processes. This bridges the gap between theoretical knowledge and practical defense, all within a safe, cost-effective sandbox.
7. Red vs. Blue: The Honeypot Detection Challenge
The ultimate training exercise with Conpot is a Red-vs-Blue scenario where one team deploys and customizes the honeypot while the other attempts to detect it. Detection techniques include:
- Timing analysis: Honeypots often respond faster than real PLCs due to the absence of physical I/O processing.
- Protocol fuzzing: Sending malformed packets that a real device would handle differently can reveal emulation artifacts.
- Fingerprinting tools: Use Shodan’s API or custom scripts to query for known Conpot signatures.
- Behavioral analysis: Real PLCs have stateful behavior (e.g., counters that increment, timers that expire); Conpot’s state machine is finite and predictable.
Conversely, the Blue team can counter these detection methods by:
- Introducing random delays in responses.
- Implementing stateful behavior with Python scripts that modify register values over time.
- Customizing the TCP/IP stack parameters (TTL, window size, etc.) to match real hardware.
As one security researcher put it: “A honeypot is an NP problem made P — it transforms an unbounded, complex environment into a controlled, solvable simulation”. This boundedness is both a strength (for training) and a weakness (for deception), and mastering this duality is the essence of advanced OT security.
What Undercode Say:
- Key Takeaway 1: Conpot democratizes OT security training by eliminating the financial barrier of physical PLCs. A single €10,000 PLC is replaced by a free Docker container, enabling hands-on learning at scale.
- Key Takeaway 2: The true educational value lies not in the emulation itself, but in the adversarial mindset it cultivates—learning to detect honeypots (Red) and to make them more convincing (Blue) sharpens skills that translate directly to defending real industrial infrastructure.
- Key Takeaway 3: Never scan a real industrial system exposed on Shodan. The lesson is about ethics and consequence: using Conpot as a sandbox ensures that mistakes remain educational rather than catastrophic.
- Key Takeaway 4: The combination of Nmap, SNMP, and custom scripting provides a complete reconnaissance toolkit that works identically against both honeypots and real devices, making the transition from lab to production seamless.
- Key Takeaway 5: Customization is not optional—it is essential. Default configurations are easily fingerprinted, and advanced training must include modifying XML profiles, MIBs, and HTTP responses to evade detection.
Analysis: The shift from hardware-dependent to software-defined training represents a paradigm change in cybersecurity education. Conpot exemplifies how open-source tools can lower barriers while raising the ceiling on what students can achieve. The challenge now is to ensure that customization and detection techniques keep pace with each other, fostering an ecosystem where both attackers and defenders continuously evolve. The ethical imperative—never targeting live infrastructure—remains the bedrock upon which this training is built.
Prediction:
- +1 Conpot and similar ICS honeypots will become standard components in university curricula and corporate training programs, drastically reducing the cost of OT security education and increasing the pool of qualified professionals.
- +1 The open-source nature of Conpot will drive community-contributed templates for a wider range of PLC models and protocols, making the honeypot ecosystem more diverse and realistic over time.
- -1 As Conpot deployments proliferate, adversaries will develop more sophisticated fingerprinting techniques, potentially rendering default configurations useless within 12–18 months unless continuous customization efforts are maintained.
- -1 The ease of deployment may lead to complacency, with some practitioners mistakenly treating honeypot findings as representative of real-world threats, overlooking the bounded nature of emulated systems.
- +1 Integration with AI/ML for dynamic response generation could transform Conpot into a high-interaction honeypot that learns and adapts, blurring the line between emulation and reality and providing unparalleled training value.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Laurent Biagiotti – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
