Modbus is a widely used protocol in industrial control systems (ICS) and is often targeted by attackers. To effectively pentest Modbus, it is important to first enumerate the target system.
### Modbus TCP Enumeration
#### Nmap
Nmap can be used to scan for Modbus TCP services. The following command can be used:
```bash
nmap -p 502 --script modbus-discover <target>
```
#### Modscan
Modscan is a popular tool for Modbus enumeration. It can be used to scan for Modbus TCP services and gather information about the target system.
### Modbus RTU Enumeration
#### Serial Port Scanning
To enumerate Modbus RTU devices, serial port scanning can be performed. Tools like `modscan` and `mbpoll` can be used to scan for Modbus RTU devices connected to serial ports.
#### Physical Inspection
Physical inspection of the target system can also provide valuable information about Modbus RTU devices. Look for devices with RS-485 or RS-232 ports, as these are commonly used for Modbus RTU communication.
## Modbus Slave ID Enumeration
Modbus devices are identified by their slave IDs. Enumerating the slave IDs can provide insight into the target system's architecture and potential attack vectors.
### Modscan
Modscan can be used to enumerate Modbus slave IDs. The following command can be used:
```bash
modscan32.exe -m tcp -a <target> -p 502 -s 1-255
```
### Modbus Poll
Modbus Poll is another tool that can be used to enumerate Modbus slave IDs. The following command can be used:
```bash
modpoll -m tcp -a <target> -p 502 -s 1-255
```
## Modbus Function Code Enumeration
Modbus function codes define the type of operation to be performed on the target system. Enumerating the function codes can help identify potential vulnerabilities.
Modbus registers store data in Modbus devices. Enumerating the registers can provide valuable information about the target system's configuration and potential attack vectors.
### Modscan
Modscan can be used to enumerate Modbus registers. The following command can be used:
Enumeration is a crucial step in Modbus pentesting. By effectively enumerating the target system, you can gather valuable information that can be used to identify vulnerabilities and plan further attacks.
