IndustrialXPL-Forge - The World's Largest OT/ICS/SCADA Security Assessme

项目说明

<p align="center">
<img src="docs/img/industrialxpl-forge-banner_16x9.png" alt="IndustrialXPL-Forge Banner" width="100%"/>
</p>

!Python
![XPL Suite]()
![Issues]()
![Last Commit]()

---

> Platform Note: This framework is designed and tested primarily on Linux (Debian/Ubuntu/Kali). Most hardware-dependent modules (wireless adapters, USB devices, raw socket access, firmware tools) require Linux. Running on Windows or macOS may cause errors or limited functionality in many modules. Linux is strongly recommended for maximum compatibility.

---

IndustrialXPL-Forge (IXF)

> The World's Largest OT/ICS/SCADA Security Assessment & Exploitation Framework
> Part of the XPL-Forge suite | Author: André Henrique () | União Geek

Python-First. Pure Python implementation — install and run with a single pip install.

> Legal notice: IXF publicly distributes malware and ICS-tool research corpora for
> cybersecurity education. You are solely responsible for authorized, lawful use.
> See TERMS_OF_USE.md · DISCLAIMER.md · SECURITY.md

---

Quick Start

Terminal output: use a modern terminal with ANSI support (Linux/macOS, Windows Terminal, PowerShell 7+). On legacy cmd.exe, pass --no-color to disable escape sequences.

REST API: ixf ser 127.0.0.1 --port 8443 — optional OpenAPI via pip install industrialxpl-forge[api].

Architecture: see docs/ARCHITECTURE.md for component diagram and data flow.

Or from source (includes full malware + ics-tools corpus, ~2 GB):

> PyPI note: pip install industrialxpl-forge ships the framework and nati.
> The complete trees live in the Git repository under
> industrialxpl/resources//submodules__malwares__* and submodules__ics-tools__*.

---

What is IXF?

IndustrialXPL-Forge is a modular, Python-nati assessment and exploitation framework for Operational Technology (OT), Industrial Control Systems (ICS), SCADA, HMI, PLC, RTU, DCS, and IIoT en.

It covers the complete attack lifecycle:

Key features:

---

Module Catalog

| Category | Modules | Description |
|----------|---------|-------------|
| exploits/protocols/ | ~50 | Modbus, S7, ENIP, DNP3, BACnet, Profinet, IEC104, OPC UA |
| exploits/plc/ | ~80 | Siemens, Schneider, Rockwell, GE, Beckhoff, Unitronics, ABB |
| exploits/scada/ | ~60 | IGSS, RealWin, Genesis32, CoDeSys, FUXA, CitectSCADA |
| exploits/mes/ | ~25 | Ignition, ThinManager, SIMATIC Historian, DELMIA Apriso |
| scanners/ics/ | ~50 | Protocol-specific discovery (Modbus, S7, BACnet, DNP3...) |
| scanners/osint/ | ~8 | Shodan queries, ELITEWOLF web dorks, OT Hunt |
| creds/ | ~71 | Default credentials for 50+ OT/ICS |
| cve/ | 3,300+ | All C levels (CVSS 0.1-10.0), 3 implementation tiers |
| cve/apt/ | ~10 | APT malware TTPs: FrostyGoop, Industroyer2, TRITON, INCONTROLLER |
| assessment/ | ~35 | IEC 62443, NIST 800-82r3, MITRE ICS, risk scoring, IR playbook |
| assessment/detection/ | ~8 | Modbus PCAP analyzer, Suricata/Zeek rule generators, Conpot detection |
| scanners/ot/ | ~10 | Nmap OT scanner with ICS-specific scripts and service detection |
| payloads/ | 42 | Multi-arch stagers (x86, x64, ARM, MIPS, PPC, SPARC, …) |
| encoders/ | 17 | Payload encoders (x86/shikata, alpha, xor, …) |
| c/ | 16+ | Nati TTP modules (12 families + TRITON TriStation) |
| scanners/malware_research/ | 4+ | Mirai telnet probe, botnet mapper, Shodan hunter, orchestrator |

See DISCLAIMER.md and SECURITY.md before using malware research modules.

---

Usage Examples

---

SafeMode / Destructi

Modules default to simulate=false — read probes and protocol checks may hit the wire on check() / run(). Enable SafeMode explicitly:

Global SafeMode: setg simulate true

Impact levels require proportional confirmation:

All destructi are logged to .log/destructi.log.

---

Noise Level in OT En

IXF is designed to be the least aggressi for OT/ICS assets. Unlike Nmap, which generates SYN packets, OS detection probes, and multiple script PDUs per port, IXF sends a single well-formed protocol PDU — identical to what a legitimate engineering workstation would send.

IXF global timing options map directly to Nmap -T flags:

| Nmap | IXF | Socket timeout | Delay | Use case |
|------|-----|---------------|-------|----------|
| -T0 | setg TIMING paranoid | 5s | 10s | Absolute stealth |
| -T1 | setg TIMING sneaky | 3s | 5s | Slow ICS en |
| -T2 | setg TIMING polite | 2s | 1s | Recommended for OT |
| -T3 | setg TIMING normal | 1s | 300ms | Default (safe for most OT) |
| -T4 | setg TIMING aggressive | 0.5s | 50ms | Lab / fast networks only |
| -T5 | setg TIMING insane | 0.2s | 0ms | Never use in production OT |

Other Nmap flags as IXF global options:

---

Python-First Policy

| Tier | Type | Examples | Required? |
|------|------|----------|-----------|
| 0 | Python stdlib | socket, struct, select | Always |
| 1 | pip install | pymodbus, scapy, rich, requests | Yes |
| 2 | pip extras | asyncua, cpppo, python-can | Optional |
| 3 | External runtimes | ruby, node, java, gcc, go | Optional — Python fallback always a |

All SCADA framework modules are implemented natively in Python — no additional tools required.

---

Documentation

Full documentation is a in both English and Brazilian Portuguese:

| Language | Link |
|----------|------|
| English (en-US) | docs/en-us/ |
| Português (pt-BR) | docs/pt-br/ |

Quick links:

| Topic | en-US | pt-BR |
|-------|-------|-------|
| Installation | 01-installation | 01-instalacao |
| Quick Start | 02-quick-start | 02-inicio-rapido |
| Shell Reference (35 commands) | 03-shell-reference | 03-referencia-shell |
| Module System & Option Types | 04-module-system | 04-sistema-modulos |
| SafeMode / Destructi | 05-safemode | 05-safemode |
| MITRE ATT&CK for ICS | 06-mitre | 06-mitre |
| SAST / LLM Analysis | 07-sast | 07-sast |
| Protocols & | 08-protocols | 08-protocolos |
| Module De | 09-dev | 09-desen |
| CLI Non-Interactive | 10-cli | 10-cli |
| PolyExploit Runner | 11-poly | 11-poly |
| Assessment & Compliance | 12-assessment | 12-assessment |

---

Attack Categories (v2.0.0)

> LEGAL WARNING: All modules in this section are for authorized security testing, research, and educational use only. Execution against systems without explicit written authorization is a federal crime under computer fraud statutes in most jurisdictions. Ransomware/wiper modules require triple confirmation. The authors and Uniao Geek assume no liability for misuse.

Ransomware (OT/ICS) - Educational Simulation Only

> WARNING: Ransomware modules are STRICTLY SIMULATE-ONLY by default.
> Triple confirmation required for li. Unauthorized use is a federal crime.

| Module | Path | Impact | Requires |
|--------|------|--------|----------|
| plc_project_locker | exploits/ransomware/ | CATASTROPHIC | Triple gate |
| hmi_display_ransomware | exploits/ransomware/ | CATASTROPHIC | Triple gate |

Persistence

> WARNING: Logic bomb modules simulate acti of pre-planted PLC routines. Unauthorized execution disrupts physical processes.

| Module | Path | Impact | Reference |
|--------|------|--------|-----------|
| plc_logic_bomb_inject | exploits/persistence/ | HIGH | CISA AA22-103A, Dragos CHERNOVITE |

Routing Table Poisoning

> WARNING: Routing injection attacks redirect network traffic and may disrupt production OT/IT services. Authorized lab use only.

| Module | Path | Impact | Reference |
|--------|------|--------|-----------|
| ospf_lsa_inject | exploits/routing/ | HIGH | DCmal-2025 OSPF spoofing (MDPI 2025), RFC 2328 |
| bgp_ | exploits/routing/ | HIGH | Stoeger et al., USENIX Security 2025 |

MiTM - Modbus TCP Inline

> WARNING: Inline proxy with value injection falsifies sensor readings delivered to operators. May cause process misjudgment with physical consequences. Authorized lab only.

| Module | Path | Impact | Prerequisites |
|--------|------|--------|---------------|
| modbus_mitm_inline | assessment/lateral/ | HIGH | ARP poisoning acti first) |

Credential Attacks

| Module | Path | Impact | Reference |
|--------|------|--------|-----------|
| ics_mqtt_bruteforce | creds/generic/ | MEDIUM | OASIS MQTT v3.1.1, MITRE T0806 |

CVE 2025

| Module | Path | CVE | Description |
|--------|------|-----|-------------|
| siemens_telecontrol_c | c/ | C | Siemens TeleControl Ser authentication bypass + path tra. CVSS 9.8. |

Co Summary

| Category | Modules | Default Mode |
|----------|---------|-------------|
| Ransomware / Impact | plc_project_locker, hmi_display_ransomware | simulate=True (triple gate for live) |
| Persistence | plc_logic_bomb_inject | simulate=True |
| Routing (RTP) | ospf_lsa_inject, bgp_ | simulate=True |
| MiTM | modbus_arp_mitm, modbus_mitm_inline | simulate=True |
| Credentials | ics_mqtt_bruteforce, + 30+ modules | simulate=True |
| CVE 2025 | siemens_telecontrol_c | simulate=True |

All destructi default to simulate=True. Ransomware/wiper modules require triple gate confirmation: simulate=False + destructive=True + explicit_confirm="I_UNDERSTAND_THIS_IS_DESTRUCTIVE".

---

Purple Team & Detection Modules

Modbus PCAP Analyzer

Analyzes captured Modbus/TCP traffic for unauthorized write operations and reconnaissance patterns.

Suricata OT Rules Generator

Generates Suricata IDS rules tailored for OT/ICS protocol anomaly detection.

Modbus Zeek Rule Generator

Generates Zeek/Bro scripts for Modbus/TCP traffic analysis and alerting.

CoAP Protocol Fuzzer

Sends malformed CoAP packets to test embedded IIoT device resilience against parser attacks.

Conpot Honeypot Detection

Identifies Conpot ICS honeypot deployments by fingerprinting characteristic response patterns.

Nmap OT Scanner

Runs Nmap with OT/ICS-specific NSE scripts for protocol discovery and service fingerprinting.

Lab En Setup (Docker)

Generates a complete Docker Compose ICS/OT lab with Conpot, FUXA SCADA, and OpenPLC.

---

Legal Disclaimer

This tool is intended for authorized security testing, research, and educational purposes only.

Using IndustrialXPL-Forge against systems you do not own or do not have explicit written authorization to test is illegal and may computer fraud laws in your jurisdiction.

OT/ICS systems control critical physical infrastructure. Unauthorized use may cause:

The authors and União Geek assume no liability for misuse. Users bear full legal and ethical responsibility for all actions performed with this tool.

---

Author & Credits

Author: André Henrique () | União Geek

Module sources: EmbedXPL-Forge (suite sibling), ISF/ICSSploit, ModBusSploit, n-days-poc-benchmark, InduGuard, ZeronTek OT Hunt research, CISA ICS-CERT ad, Labs OT:ICEFALL, ExploitDB ICS catalog, GitHub public PoCs.
---

Contact

Support / general inquiries:
Security issues: SECURITY.md

---

André Henrique

| | |
|---|---|
| GitHub | |
| X / Twitter | |
| LinkedIn | mrhenrike |

União Geek

| | |
|---|---|
| Website | uniaogeek.com.br |
| Blog | uniaogeek.com.br/blog |
| GitHub | Uniao-Geek |
| Instagram | |

---

License: BSD-3-Clause License - Copyright (c) 2026 União Geek
Created by: André Henrique () | União Geek

Leia em Português - Command co - Wiki

项目信息

开发语言：Python

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The World's Largest OT/ICS/SCADA Security Assessment Framework. Python-First. 976+ modules, 150+ vendors, 50 protocols, MITRE ATT&CK for ICS 82%, SAST/LLM, 26 ICS malware TTPs.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。