Labshock Wiki Update: Configuration and Control of ICS/OT Security Lab

Labshock, an OT Security Lab for ICS networks, has expanded its documentation to help users configure and manage its services effectively. The new guides cover setup, monitoring, and control of critical components like PLC, SCADA, IDS, and Collector services.

Key Documentation Links

• Home: About Labshock
• Quickstart Guide: Install Labshock in <10 Minutes
• Configuration Guide: Labshock Setup
• PLC Service: PLC Setup & Monitoring
• SCADA Service: Interface Creation & Tag Linking
• EWS Service: Engineering Workstation Management
• Pentest Service: Controlled Security Testing
• IDS Service: Network Detection Configuration
• Collector Service: Log Collection & Processing

You Should Know: Practical Commands & Steps

1. Quick Installation (Linux)

git clone https://github.com/zakharb/labshock.git 
cd labshock 
sudo ./install.sh 

2. Starting PLC Service

sudo systemctl start labshock-plc 
sudo systemctl enable labshock-plc 

3. Configuring SCADA Tags

Modify `scada_config.yml` to link PLC tags:

tags: 
- name: "Pressure_Sensor" 
address: "PLC1:MW100" 
data_type: "INT" 

4. Monitoring IDS Alerts

tail -f /var/log/labshock/ids/alerts.log 

5. Log Collection with Collector

sudo labshock-collector --config /etc/labshock/collector.conf 

6. Pentesting ICS Networks

Use Metasploit for controlled exploits:

msfconsole 
use exploit/ics/modbus_write_register 
set RHOSTS <target_IP> 
run 

7. Network Detection with IDS

Suricata rules for OT traffic:

sudo suricata -c /etc/labshock/ids/suricata.yaml -i eth0 

What Undercode Say

Labshock provides a structured approach to ICS/OT security testing. Key takeaways:
– Use `systemctl` to manage Labshock services.
– Customize SCADA tags for realistic simulations.
– Monitor IDS logs for anomaly detection.
– Automate log collection with labshock-collector.
– Test exploits safely in the pentest environment.

For deeper ICS security analysis, explore:

• Wireshark OT Traffic Analysis:

  wireshark -k -i eth0 -Y "modbus || dnp3" 
  

• Nmap ICS Device Scanning:

  nmap -sU -p 161,502 <target_IP> --script modbus-discover 
  

Expected Output:

A fully configured Labshock environment with active PLC, SCADA, and IDS services, ready for ICS security testing.

For updates, contribute on GitHub.

References:

Reported By: Zakharb Github – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram