abelrguezr EtherNet/IP Pentesting
A skill for enumerating and testing EtherNet/IP industrial control system devices.
What is EtherNet/IP?
EtherNet/IP is an industrial Ethernet networking protocol used in industrial automation control systems. Developed by Rockwell Automation and managed by ODVA, it ensures multi-vendor interoperability in:
- Water processing plants
- Manufacturing facilities
- Utilities and power systems
- Factory automation networks
Default port: 44818 (TCP/UDP)
When to Use This Skill
Use this skill when:
- You need to enumerate industrial control system devices
- Port 44818 is open on a target
- You're testing ICS/SCADA security
- You encounter Rockwell Automation or Allen-Bradley devices
- You need to identify EtherNet/IP device information
- You're doing industrial network reconnaissance
Enumeration Workflow
Step 1: Identify EtherNet/IP Devices
First, confirm the target is running EtherNet/IP:
# Check if port 44818 is open
nmap -p 44818 <target-ip>
# Verify with service detection
nmap -n -sV -p 44818 <target-ip>
Step 2: Run Enumeration Scripts
Use the bundled enumeration script for comprehensive device discovery:
# Run the enumeration script
./scripts/enumerate_enip.sh <target-ip>
This script performs:
- Nmap service detection with enip-info script
- Cpppo-based identity listing
- UDP broadcast discovery (if applicable)
Step 3: Manual Enumeration (if needed)
If you need more control, run these commands manually:
# Nmap with EtherNet/IP script
nmap -n -sV --script enip-info -p 44818 <target-ip>
# Cpppo identity listing (TCP)
python3 -m cpppo.server.enip.list_services --list-identity -a <target-ip>
# Cpppo with UDP broadcast
python3 -m cpppo.server.enip.list_services --udp --broadcast --list-identity -a <target-ip>
Step 4: Shodan Reconnaissance
Search for similar devices or public exposure:
# Search for specific product names
shodan search "port:44818 \"<product-name>\""
# General EtherNet/IP search
shodan search "port:44818"
Required Tools
Ensure these are installed before running enumeration:
# Nmap with scripting engine
sudo apt install nmap
# Cpppo library for EtherNet/IP
pip3 install cpppo
# Shodan CLI (optional)
pip3 install shodan
shodan init <your-api-key>
Example Outputs
Nmap enip-info output:
PORT STATE SERVICE VERSION
44818/tcp open enip EtherNet/IP
| enip-info:
| Product Name: Allen-Bradley ControlLogix
| Vendor: Rockwell Automation
| Serial Number: 12345678
| Device Type: Controller
Cpppo list_services output:
Device: 192.168.1.100
Product Name: CompactLogix 5370
Vendor: Rockwell Automation
Serial Number: ABC123
Revision: 25.007
State: Run
Common EtherNet/IP Devices
| Device Type | Vendor | Typical Use |
|---|---|---|
| ControlLogix | Rockwell | Large-scale automation |
| CompactLogix | Rockwell | Compact control systems |
| MicroLogix | Rockwell | Small automation tasks |
| PowerFlex | Rockwell | Motor drives |
| PanelView | Rockwell | HMI interfaces |
Security Considerations
⚠️ Important: EtherNet/IP devices are often part of critical infrastructure. Always:
- Get explicit authorization before testing industrial systems
- Coordinate with operations teams to avoid disrupting production
- Test during maintenance windows when possible
- Document all findings for the security team
- Avoid aggressive scanning that could trigger device alarms or shutdowns
Troubleshooting
Port 44818 appears closed but device exists
- Try UDP scan:
nmap -sU -p 44818 <target-ip> - Check for firewalls between you and the device
- Verify the device is powered on and connected
Cpppo commands fail
- Ensure Python 3.7+ is installed
- Reinstall cpppo:
pip3 install --upgrade cpppo - Check network connectivity to the target
Nmap script not found
- Update Nmap:
sudo apt update && sudo apt upgrade nmap - Verify script path:
ls /usr/share/nmap/scripts/enip-info.nse
Next Steps After Enumeration
Once you've identified EtherNet/IP devices:
- Document device inventory - Record all discovered devices, vendors, and models
- Check for known vulnerabilities - Search CVE databases for the specific device models
- Review network segmentation - Ensure ICS networks are properly isolated
- Assess authentication - Many EtherNet/IP devices have no authentication by default
- Consider specialized ICS tools - Tools like Grapl, Nozomi, or Dragos for deeper analysis