⚙

OT/SCADA Industrial Security Sandbox

ICS / IEC 62443 training range · simulation only

Attack Scenario Generator

red team · adversary emulation

SCENARIO AFC16 · Unauthorized Force Write

Modbus TCP Command Injection

Attacker sends an unauthenticated Modbus FC16 (Preset Multiple Registers) directly to PLC 192.168.1.10, driving pump register 40001 to 100 RPM while forcing the float sensor to 0 — catastrophic tank overflow.

10.0.0.99 → 192.168.1.10:502
SCENARIO BPLC firmware / ladder logic overwrite

Engineering Workstation Compromise

Stuxnet-style unauthorized ladder logic upload from the engineering workstation deletes the high-water safety interlock rung inside the PLC.

192.168.3.50 → 192.168.1.10
SCENARIO CCompromised jump server

IT-to-OT Lateral Movement

Attacker pivots from the IT network through a misconfigured IT/OT DMZ rule to land an interactive session on the Level 2 SCADA HMI.

10.0.0.99 → 192.168.2.100

Level 0 — Live Process Visualizer

normal operating zone
HH 90%
52.0%
PUMP-101: RUNNING
○ overflow alarm clear
Temperature TT-204
41.2°C
Pressure PT-108
2.4bar
Pump speed
45.0RPM
Valve position
40.0%
Tank safety gauge
100%process health

PLC Modbus Register Map

unit id 1 · tcp/502
AddrTypeDescriptionValue
40001Holding RegisterPump Speed Control (0–100 RPM)45
40002Holding RegisterValve Target Position (%)40
10001Discrete InputHigh-Water Emergency Float (0=OK, 1=Alarm)0

Inspection Log & Alert Feed

0 events
awaiting traffic…

OT Defense & Deep Packet Inspection

blue team · IEC 62443 controls

IT/OT Industrial DMZ Firewall — Purdue Level 3.5. Enforces the conduit between the corporate network and the OT cell.

active rule set
permit ip any any (legacy flat network)
no logging configured

Purdue Model Network Topology

ISA-95 / IEC 62443 zoning
External10.0.0.99
IT Network / Attacker Node
Jump server, corporate LAN
Level 3.5
Industrial DMZ Firewall
Permissive rule set — broad IT→OT any/any
Level 3192.168.3.50
OT Operations
Engineering Workstation & Historian
Level 2192.168.2.100
Control Room — SCADA HMI / OPC UA Gateway
Nominal — polling PLC @ 500 ms
Level 1192.168.1.10
Field Control — PLC (OpenPLC)
Ladder logic verified · interlocks armed
Level 0
Physical Process
Water storage tank · level sensor · pump actuator · temperature gauge