ICS-Ninja-Scanner - Multi-protocol ICS security scanner detecting vuln

项目说明

ICS Ninja Scanner

<p align="center">
<img src="images/logo.png" alt="ICS Ninja Scanner Logo" width="300px">
</p>

Multi-protocol Industrial Control System security assessment platform.

ICS Ninja Scanner is a comprehensi assessment tool purpose-built for industrial en. It discovers, fingerprints, and tests ICS/SCADA devices across 11 protocols, correlates findings against a built-in C, maps results to ICS compliance frameworks (IEC 62443, NIST 800-82, NERC CIP), and tracks your security posture over time with scan diffing and trend analysis.

Designed by penetration testers who actually assess OT en — not another IT scanner bolted onto port 502.

> ⚖️ Licensed under PolyForm Noncommercial 1.0.0 — free for research, education, and non-commercial use.

---

Why ICS Ninja?

Most security scanners treat ICS as an afterthought. ICS Ninja was built ICS-first:

---

Installation

Docker

From Source

---

Quick Start

Basic Scanning

Using Scan Profiles

Skip manual protocol selection — use industry-specific profiles:

A profiles: siemens-plant, rockwell-plant, substation, bms, water-treatment, oil-gas, quick, full

C

Cross-reference scan findings against the embedded ICS C:

The C includes entries for Siemens, Rockwell, Schneider, ABB, and other major ICS , with C and affected ranges.

Compliance Mapping

Map findings to ICS security frameworks:

Scan Diffing & Trend Analysis

Track your security posture over time:

Reporting

---

Supported Protocols

| Protocol | Port | What It Tests |
|----------|------|---------------|
| Modbus TCP | 502 | Device ID (FC 43/14), register read/write, Modbus/TLS, broadcast detection |
| Siemens S7 | 102 | CPU state, module in, C, protection levels, PLC clock, web server |
| IEC 60870-5-104 | 2404 | Multi-station testing, IEC 62351 security, 5 control command types, sequence tracking |
| MQTT | 1883/8883 | Broker auth, MQTT v5, WebSocket, QoS, retained messages, client ID impersonation |
| SNMP | 161 | Community strings, SNMPv3, BER-encoded walk, write testing |
| OPC-UA | 4840 | Security modes, anonymous access, certificate analysis, node browsing |
| BACnet | 47808 | WhoIs discovery, WriteProperty testing, ReinitializeDevice, device enumeration |
| EtherNet/IP | 44818 | CIP sessions, tag read/write, ForwardOpen, identity enumeration |
| DNP3 | 20000 | Secure Authentication, control commands, outstation enumeration |
| Profinet | 34964 | DCP discovery, security class detection, RPC testing |
| HART-IP | 5094 | Session management, command enumeration, sub-device discovery |

Scan Intensity Levels

| Level | What It Does | Safe for Production? |
|-------|-------------|---------------------|
| 🟢 Low | Passi — detection, banner grabbing, protocol fingerprinting | ✅ Yes |
| 🟡 Medium | Acti — read registers, check auth, enumerate security settings | ⚠️ Generally safe |
| 🔴 High | Write tests — unauthenticated control attempts, write with auto-restore | ❌ Maintenance window only |

High-intensity scans prompt for confirmation (bypass with --yes). Write tests automatically restore original and restoration.

---

Scan Profiles

Pre-built configurations for common ICS en:

| Profile | En | Protocols | Default Intensity |
|---------|------------|-----------|-------------------|
| siemens-plant | Siemens manufacturing | S7, Profinet, OPC-UA, Modbus, SNMP, MQTT | Medium |
| rockwell-plant | Rockwell/Allen-Bradley | EtherNet/IP, Modbus, SNMP, OPC-UA, MQTT | Medium |
| substation | Electrical substation | IEC 104, DNP3, Modbus, SNMP, MQTT | Low |
| bms | Building management | BACnet, Modbus, SNMP, MQTT, OPC-UA | Medium |
| water-treatment | Water/wastewater | DNP3, Modbus, SNMP, MQTT, OPC-UA | Low |
| oil-gas | Oil & gas / process | HART-IP, Modbus, OPC-UA, SNMP, MQTT, Profinet | Medium |
| quick | Any — fast recon | All | Low |
| full | Any — full assessment | All | High |

---

CLI Reference

---

Output Formats

| Format | Use Case |
|--------|----------|
| TXT | Terminal output, quick review |
| JSON | Integration with SIEM, ticketing, other tools |
| CSV | Spreadsheets, bulk analysis |
| HTML | Styled report with executi, se charts, and remediation priorities |

HTML reports include C (auto-calculated for all findings), se distribution charts, and compliance mapping when enabled.

---

Safety

This tool is for authorized security assessments only. Always:

1. 🔐 Get written authorization before scanning any ICS en
2. 🟢 Start with low intensity in production
3. ⏰ Use maintenance windows for high-intensity scans
4. 📊 Monitor target systems during scanning
5. 🐌 Use --rate-limit for sensiti devices

---

Contributing

We welcome contributions — especially new protocol scanners. See CONTRIBUTING.md for the de, scanner checklist, and PR process.

Security

Found a in ICS Ninja Scanner itself? See SECURITY.md for responsible disclosure.

License

PolyForm Noncommercial License 1.0.0 — free for research, education, non-commercial organizations, and personal use. Commercial use requires a separate license from MottaSec.

---

Built by MottaSec

项目信息

开发语言：Python

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Multi-protocol ICS security scanner detecting vulnerabilities in Modbus, S7, DNP3, BACnet, MQTT & SNMP. Features configurable scan intensities, safe-by-default operation & comprehensive reporting. Identifies misconfigurations & security flaws in industrial environments.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。