// the take
A university final-degree project covering pentesting of industrial protocols: Modbus (packet replay), Profinet/Profibus (device discovery, LED flash), and Siemens S7Comm/S7Comm+ (read/write PLC variables, DoS via request overflow). Includes a toy SCADA UI that talks to both Modbus and S7 simultaneously so you can attack while watching state change. Aimed at students or ICS security newcomers who want working scripts and pcaps rather than theory.
The pcap captures are the most useful artifact here — real traffic from an actual lab S7-1500 and HMI gives you ground truth for building your own dissectors or replays. The SCADA_LAB.py dual-protocol demo is genuinely useful for understanding how an attacker can pivot between protocols in one session. The S7Comm+ denial script (continuous request overflow causing a few-second PLC outage) is a concrete, runnable PoC that most ICS security writeups only describe in the abstract. The terminal GUI package bundles everything into a single entry point, which lowers the friction of exploring the different attack categories.
Abandoned since October 2022 and the Profinet scripts require you to manually hardcode hex streams with your own MAC address — there is no helper, you edit raw bytes. The repo ships a vendored scapy-2.4.4 directory including compiled .pyc files committed to version control, which is both stale (scapy is at 2.5+) and avoidable with a requirements.txt pin. Without access to real Siemens hardware (S7-1500 or similar), most of the S7Comm scripts are untestable; there is no software PLC or simulation option documented. The S7Comm+ DoS is just a tight loop of connection requests — it works, but it is not a particularly interesting or instructive technique compared to what you would need for actual ICS security research.
We read the README, the directory tree and a key source file in July 2026. Nobody pays to be listed. How we judge →