Listen to this Post
Introduction:
Operational Technology (OT) and Industrial Control Systems (ICS) security testing has long been hampered by the high cost, complexity, and time required to build physical lab environments with real Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and intrusion detection systems. Thanks to containerization platforms like Docker and innovative training approaches such as those demonstrated by Labshock Security, security professionals can now deploy fully functional, realistic OT/ICS honeypots, engineering workstations, and SIEM integrations in minutes rather than days, enabling rapid purple team exercises and vulnerability research.
Learning Objectives:
- Deploy a containerized PLC simulator and SCADA HMI using Docker and open-source tools like OpenPLC and Node-RED.
- Integrate a Security Information and Event Management (SIEM) system, such as Wazuh, to monitor OT protocol traffic (Modbus/TCP) and generate alerts.
- Execute basic attack simulations against a virtual ICS environment using Nmap and Metasploit, then apply mitigation techniques like network segmentation and allowlisting.
You Should Know:
- Containerizing OT: Spinning Up a Virtual PLC with OpenPLC
Traditional PLC setup requires proprietary hardware and software. With Docker, you can emulate a Modbus-enabled PLC in seconds. Start by installing Docker on your Linux distribution (or Docker Desktop for Windows 10/11 Pro). Then pull and run the OpenPLC container:
Linux (Ubuntu/Debian) sudo apt update && sudo apt install docker.io -y sudo systemctl start docker sudo docker pull openplc/openplc sudo docker run -d --name openplc_lab -p 502:502 -p 8080:8080 openplc/openplc
For Windows (PowerShell as Administrator):
Install Docker Desktop via WSL2 first, then: docker pull openplc/openplc docker run -d --name openplc_lab -p 502:502 -p 8080:8080 openplc/openplc
Verify the PLC is reachable on Modbus port 502 using nmap:
nmap -p 502 --script modbus-discover localhost
The OpenPLC web interface will be available at `http://localhost:8080`. This containerized PLC responds to standard Modbus read/write requests, allowing you to test security tools without any physical hardware.
- Simulating SCADA and HMI with Node-RED and Grafana
A modern OT lab needs a realistic SCADA dashboard. Use Docker Compose to define a stack that includes Node-RED (for logic and HMI) and Grafana (for visualization). Create a file nameddocker-compose.yml:
version: '3.8' services: nodered: image: nodered/node-red:latest ports: - "1880:1880" volumes: - nodered_data:/data grafana: image: grafana/grafana:latest ports: - "3000:3000" environment: - GF_SECURITY_ADMIN_PASSWORD=otlab123 volumes: - grafana_data:/var/lib/grafana volumes: nodered_data: grafana_data:
Run the stack:
docker-compose up -d
Access Node-RED at `http://localhost:1880` and import a Modbus TCP node to read coils from the OpenPLC container (use `openplc_lab` as host). For Grafana, log in with `admin/otlab123` and add an InfluxDB or Prometheus data source to create real-time OT dashboards. This setup mirrors production SCADA environments and lets you practice injecting malicious packets or monitoring anomalous trends.
- SIEM Integration for OT: Wazuh as Containerized IDS
To detect attacks on your virtual PLC, deploy Wazuh – an open-source SIEM with built-in Modbus and DNP3 decoders. Use the official all-in-one Docker image:
docker pull wazuh/wazuh:latest docker run -d --name wazuh_ot_siem -p 55000:55000 -p 1514:1514/udp -p 1515:1515 wazuh/wazuh
Configure Wazuh to monitor Modbus traffic by editing `/var/ossec/etc/ossec.conf` inside the container:
<localfile> <log_format>json</log_format> <location>/var/log/modbus.log</location> </localfile>
Now, from your host, simulate a suspicious Modbus command using nmap:
nmap -p 502 --script modbus-discover --script-args='modbus.function_code=15' localhost
Check Wazuh alerts via the dashboard at https://localhost:55000` (default credentials:wazuh/wazuh`). You will see events flagged for write-coil operations, which could indicate an attacker attempting to override physical processes.
- Attacking Your Own Lab: Modbus Fuzzing with Metasploit and Nmap Scripts
Purple teaming requires safe exploitation techniques. Use a Kali Linux container to attack your OpenPLC without affecting production networks:
docker pull kalilinux/kali-rolling docker run -it --network host kalilinux/kali-rolling bash apt update && apt install metasploit-framework nmap -y
Inside the Kali container, run the Metasploit Modbus scanner:
msfconsole msf6 > use auxiliary/scanner/scada/modbus_findunitid msf6 > set RHOSTS 127.0.0.1 msf6 > set RPORT 502 msf6 > run
To fuzz the PLC, use a simple Python script (run from your host):
import socket
for i in range(1, 100):
payload = b'\x00\x01\x00\x00\x00\x06\x01' + i.to_bytes(1,'big') + b'\x03\x00\x00\x00\x01'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('localhost', 502))
s.send(payload)
print(s.recv(1024))
s.close()
Mitigate such attacks by implementing Modbus/TCP allowlisting via `iptables` on the Docker host:
sudo iptables -A DOCKER -p tcp --dport 502 -s 192.168.1.0/24 -j ACCEPT sudo iptables -A DOCKER -p tcp --dport 502 -j DROP
5. Cloud Hardening for Remote OT Labs
Deploying your Labshock-style environment to the cloud (AWS, Azure, or GCP) enables team collaboration but requires strict security controls. Use Terraform to provision an EC2 instance with Docker, but restrict access via Security Groups:
resource "aws_security_group" "ot_lab_sg" {
name = "ot_lab_sg"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["YOUR_HOME_IP/32"]
}
ingress {
from_port = 502
to_port = 502
protocol = "tcp"
cidr_blocks = ["10.0.0.0/16"] Only internal VPC
}
}
Add a VPN (WireGuard or OpenVPN) container to the stack for encrypted remote access. Never expose OT protocol ports directly to the internet. Use `docker network create –subnet=10.10.0.0/16 ot_net` to isolate containers and avoid cross‑container attacks.
6. Windows-Based OT Lab Management
For organizations running Windows Server, you can manage the entire OT lab using PowerShell. Enable Hyper-V and install WSL2 to run Docker properly:
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All wsl --set-default-version 2 Then install Docker Desktop for Windows
After pulling the containers, create a PowerShell script to start all services:
$containers = @("openplc_lab", "nodered", "grafana", "wazuh_ot_siem")
foreach ($c in $containers) {
if (-not (docker ps -q -f name=$c)) {
docker start $c
}
}
Use Windows Firewall to restrict inbound Modbus traffic to specific IPs:
New-NetFirewallRule -DisplayName "Block Modbus" -Direction Inbound -Protocol TCP -LocalPort 502 -Action Block
- API Security in Modern SCADA: Protecting RESTful Interfaces
Many next‑generation SCADA systems expose REST APIs for remote monitoring. In your lab, deploy a mock SCADA API using a simple Flask container:
app.py
from flask import Flask, request
app = Flask(<strong>name</strong>)
@app.route('/api/valve', methods=['POST'])
def control_valve():
api_key = request.headers.get('X-API-Key')
if api_key != 'supersecret':
return 'Unauthorized', 401
control logic here
return 'OK', 200
Build and run:
FROM python:3.9-slim RUN pip install flask COPY app.py /app.py CMD ["python", "app.py"]
docker build -t scada_api . docker run -d -p 5000:5000 scada_api
Test API security using OWASP ZAP in a container:
docker pull owasp/zap2docker-stable docker run -t owasp/zap2docker-stable zap-api-scan.py -t http://host.docker.internal:5000/openapi.json -f openapi
Findings often include missing rate limiting or weak authentication. Implement API gateway hardening with NGINX sidecar containers enforcing JWT validation.
What Undercode Say:
- Key Takeaway 1: Containerization eliminates hardware barriers to OT security training, enabling any cybersecurity professional to build realistic ICS labs on a standard laptop.
- Key Takeaway 2: Integrating open-source SIEMs like Wazuh with virtual PLCs provides hands-on detection engineering experience for Modbus/DNP3 anomalies without expensive industrial licenses.
The rapid shift toward containerized OT labs, as popularized by Labshock Security, democratizes industrial control security. However, analysts must remember that container escape vulnerabilities and misconfigured Docker networks could expose simulated environments to real‑world compromise. By embedding security controls (firewalls, VPNs, API keys) from the start, practitioners learn both attack and defense in a safe, reproducible manner. This approach is ideal for purple team exercises, certification preparation (e.g., GICSP, GRID), and even classroom teaching.
Prediction:
Within two years, most industrial cybersecurity training programs will replace physical PLC trainers with containerized and orchestrated (Kubernetes-based) OT labs. This shift will dramatically lower costs and enable continuous integration of threat intelligence into lab scenarios. However, as adoption grows, attackers will develop container escape exploits specifically targeting OT emulation environments, leading to a new class of “lab‑napping” attacks. Organizations that fail to isolate their training labs from corporate networks will face increased risk of lateral movement. The future of OT security education is virtual, but only if hardened with cloud‑native security best practices.
▶️ Related Video (66% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
