ot-ics

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

OT / ICS Security

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: 读取
```
../field-journal/precedent-pentest.md
```
— 工控环境误操作可致物理危害
```
NOW
```
: 书面授权必须写清：站点、网段、是否允许主动扫描/写寄存器
```
NOW
```
: case-init；默认 passive-first；
```
ready_for_act
```
前禁止对 PLC 写操作
```
NEXT
```
: tool-index；多数工控工具需手动与隔离实验网
```
ACT
```
: 资产与分区识别 → 暴露面 → 只读验证

```
NOW
```
: Read
```
../field-journal/precedent-pentest.md
```
— Misoperations in industrial control environments can cause physical harm
```
NOW
```
: Written authorization must clearly specify: site, network segment, whether active scanning/writing to registers is permitted
```
NOW
```
: case-init; default to passive-first; writing operations to PLCs are prohibited before
```
ready_for_act
```
```
NEXT
```
: tool-index; most industrial control tools require manual setup and isolation from the test network
```
ACT
```
: Asset and zone identification → Exposure surface → Read-only verification

适用场景

Applicable Scenarios

工控/SCADA/DCS 安全评估（授权）
Purdue 模型分区与跨区通道
Modbus/DNP3/S7/EtherNet/IP 等协议暴露
工程师站、HMI、历史库、跳板主机
IT/OT 融合边界（防火墙规则、单向闸）

Authorized industrial control/SCADA/DCS security assessments
Purdue model zoning and cross-zone channels
Exposure of protocols such as Modbus/DNP3/S7/EtherNet/IP
Engineer workstations, HMIs, historical databases, jump hosts
IT/OT convergence boundaries (firewall rules, one-way gateways)

安全铁律（MUST）

Non-Negotiable Security Rules (MUST)

text

MUST NOT 在未明确允许时：
- 对 PLC 写线圈/寄存器
- 全网高速率扫描生产 OT
- 中断安全仪表系统（SIS）相关路径
优先：只读识别、流量镜像、离线固件/配置分析

text

MUST NOT perform the following without explicit permission:
- Write coils/registers to PLCs
- High-rate scanning of the entire production OT network
- Interrupt paths related to Safety Instrumented Systems (SIS)
Prioritize: read-only identification, traffic mirroring, offline firmware/configuration analysis

工作流

Workflow

Phase 1 — 分区与资产

Phase 1 — Zoning and Assets

text

□ Purdue L0–L5 草图：现场设备 → 控制 → 监督 → 站点 DMZ → 企业
□ 资产清单：PLC/RTU/HMI/工程师站/历史库/Jump host
□ 协议与端口基线（仅授权网段）

text

□ Sketch of Purdue L0–L5: Field devices → Control → Supervision → Site DMZ → Enterprise
□ Asset inventory: PLC/RTU/HMI/Engineer workstations/Historical databases/Jump hosts
□ Protocol and port baseline (authorized network segments only)

Phase 2 — 被动与只读

Phase 2 — Passive and Read-only

text

□ SPAN/镜像 PCAP → protocol-reverse / Wireshark 工控解析器
□ 配置与工程文件离线审计（TIA/RSLogix 导出等）
□ 默认口令与明文协议（Modbus 无认证）记录为 Finding，不写盘改值

text

□ SPAN/mirrored PCAP → protocol-reverse / Wireshark industrial control dissectors
□ Offline audit of configuration and engineering files (e.g., exports from TIA/RSLogix)
□ Record default passwords and plaintext protocols (e.g., unauthenticated Modbus) as Findings; do not write or modify values

Phase 3 — 受限主动（仅授权）

Phase 3 — Restricted Active (Authorized Only)

text

□ 低速识别，维护窗口
□ 只读功能码优先
□ 每步 Evidence；异常立即停止并通报

text

□ Low-speed identification, maintenance window only
□ Prioritize read-only function codes
□ Document evidence for each step; stop immediately and report any anomalies

Phase 4 — 固件/补丁面

Phase 4 — Firmware/Patch Surface

text

□ 控制器固件版本 → CVE 映射（不盲刷固件）
□ 联合 firmware-pentest 做离线镜像分析

text

□ Controller firmware version → CVE mapping (do not blindly flash firmware)
□ Conduct offline image analysis in conjunction with firmware-pentest

工具链

Toolchain

工具	用途	注意
Wireshark 工控 dissectors	被动解析	镜像流量
Nmap NSE（受限）	识别	速率与时间窗
Claroty/Nozomi 等	资产发现	商业/现场
PLC 厂商工程软件	配置审计	离线优先
binwalk / Ghidra	固件	离线

Tool	Purpose	Notes
Wireshark industrial control dissectors	Passive parsing	Mirrored traffic only
Nmap NSE (restricted)	Identification	Rate and time window restrictions
Claroty/Nozomi, etc.	Asset discovery	Commercial/on-site tools
PLC vendor engineering software	Configuration audit	Prioritize offline use
binwalk / Ghidra	Firmware analysis	Offline only

参考

References

```
references/ot-safe-assessment.md
```

../firmware-pentest/

../protocol-reverse/

../network

via pentest-tools

```
references/ot-safe-assessment.md
```

../firmware-pentest/

../protocol-reverse/

../network

via pentest-tools

路由上下文

Routing Context

上游: MASTER R28
下游: 固件深挖

firmware-pentest

；协议

protocol-reverse

；IT 横向

windows-ad

attack-chain

同级: 不要用普通 Web 扫默认参数打 OT

Upstream: MASTER R28
Downstream: Firmware deep dive

firmware-pentest

; Protocol analysis

protocol-reverse

; IT lateral movement

windows-ad

attack-chain

Peer: Do not use regular Web scanners with default parameters against OT systems

任务完成自检

Task Completion Self-Check

是否默认被动/只读并记录授权边界？
是否避免对控制回路写操作（除非明确允许）？
Finding 是否含物理/过程影响说明？
Checklist / journal？

Is passive/read-only mode enabled by default and authorization boundaries documented?
Are write operations to control loops avoided (unless explicitly permitted)?
Do Findings include descriptions of physical/process impacts?
Have the checklist and journal been completed?