# Network Services Pentesting Modbus

> How to enumerate and pentest Modbus protocol services (port 502). Use this skill whenever the user mentions Modbus, SCADA systems, industrial control systems (ICS), port 502, or needs to assess Modbus-enabled devices. Trigger for any Modbus enumeration, vulnerability assessment, or penetration testing tasks involving industrial protocols.

- Skill: `abelrguezr/network-services-pentesting-modbus` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/network-services-pentesting-modbus`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/network-services-pentesting-modbus/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/network-services-pentesting-modbus

---


# Modbus Protocol Pentesting

A skill for enumerating and testing Modbus protocol services commonly found in industrial control systems (ICS) and SCADA environments.

## Overview

Modbus is a messaging protocol developed in 1979 by Modicon for communication between intelligent devices. It operates under a master-slave/client-server model and is widely used in industrial automation.

**Key characteristics:**
- **Default port:** 502/tcp
- **Architecture:** Master-slave (client-server)
- **Common in:** SCADA systems, PLCs, industrial sensors, building automation

## When to Use This Skill

Use this skill when:
- You discover port 502 open during network reconnaissance
- You need to enumerate Modbus devices on a network
- You're assessing industrial control system security
- You're performing authorized penetration testing on SCADA infrastructure
- You need to identify Modbus unit IDs and available registers

## Enumeration

### Nmap Discovery

Use Nmap's Modbus discovery script to identify Modbus services and gather initial information:

```bash
# Basic Modbus discovery
nmap --script modbus-discover -p 502 <target-ip>

# With verbose output
nmap --script modbus-discover -p 502 -v <target-ip>

# Scan multiple targets
nmap --script modbus-discover -p 502 <target-range>
```

### Metasploit Framework

Metasploit provides several modules for Modbus enumeration:

```bash
# Start Metasploit
msfconsole

# Detect Modbus services
use auxiliary/scanner/scada/modbusdetect
set RHOSTS <target-ip>
run

# Find valid unit IDs
use auxiliary/scanner/scada/modbus_findunitid
set RHOSTS <target-ip>
run
```

## Testing Workflow

### Step 1: Initial Reconnaissance

1. Confirm port 502 is open and accessible
2. Run Modbus discovery to identify the service
3. Document the target system and scope authorization

### Step 2: Unit ID Enumeration

Modbus uses unit IDs to address individual devices on a network. Enumerate valid unit IDs:

- Use `modbus_findunitid` from Metasploit
- Try common unit IDs (1-247 are valid)
- Document which unit IDs respond

### Step 3: Register Discovery

Once you have valid unit IDs, enumerate available registers:

- Read holding registers (function code 3)
- Read input registers (function code 4)
- Read coils (function code 1)
- Read discrete inputs (function code 2)

### Step 4: Vulnerability Assessment

Check for common Modbus vulnerabilities:

- **No authentication:** Modbus typically has no built-in authentication
- **Write access:** Test if write operations are permitted
- **Information disclosure:** Check what data is exposed in registers
- **Firmware version:** Some devices expose version information

## Safety Considerations

⚠️ **Critical warnings for Modbus pentesting:**

1. **Authorization required:** Only test systems you have explicit permission to assess
2. **Physical safety:** Modbus controls industrial equipment - unauthorized writes could cause physical damage or safety hazards
3. **Read-only first:** Start with read operations only to understand the system
4. **Document everything:** Keep detailed logs of all testing activities
5. **Coordinate with operators:** Ensure industrial operations are aware of testing

## Common Modbus Function Codes

| Function Code | Description | Read/Write |
|--------------|-------------|------------|
| 1 | Read Coils | Read |
| 2 | Read Discrete Inputs | Read |
| 3 | Read Holding Registers | Read |
| 4 | Read Input Registers | Read |
| 5 | Write Single Coil | Write |
| 6 | Write Single Register | Write |
| 15 | Write Multiple Coils | Write |
| 16 | Write Multiple Registers | Write |

## Tools Reference

| Tool | Purpose | Command |
|------|---------|--------|
| Nmap | Service discovery | `nmap --script modbus-discover -p 502 <ip>` |
| Metasploit | Enumeration & exploitation | `msfconsole` |
| modbus-tk | Python library | `pip install modbus-tk` |
| Colasoft Modbus Poll | GUI testing | Commercial tool |

## Next Steps

After enumeration:

1. **Document findings:** Create a report of discovered devices and capabilities
2. **Assess risk:** Evaluate the security implications of findings
3. **Recommend mitigations:** Suggest network segmentation, authentication, monitoring
4. **Coordinate remediation:** Work with industrial operations team on fixes

## Related Skills

- Network service enumeration
- SCADA security assessment
- Industrial control system hardening
- Network segmentation strategies