Modbus

Protocol	Modbus
Name	Modbus
Aliases	Modbus TCP
Description	Widely used industrial communication protocol
Port(s)	502/tcp
Specifications	Modbus TCP Specification
Nmap script(s)	modbus-discover.nse, modicon-info.nse
Wireshark dissector	packet-mbtcp.c
Scapy layer	modbus.py
Example Pcap(s)	ICS-pcap Modbus, S4x15 ICS Village PCAP Files
Related CVE	CVE-2007-4827, CVE-2010-4709, CVE-2011-4861, CVE-2013-0662, CVE-2013-2784, CVE-2013-5741, CVE-2014-0777, CVE-2017-11401, CVE-2017-14462, CVE-2017-6032, CVE-2017-6034, CVE-2017-7575, CVE-2018-5400, CVE-2018-5401, CVE-2018-7794, CVE-2018-7842, CVE-2018-7843, CVE-2018-7844, CVE-2018-7845, CVE-2018-7846, CVE-2018-7847, CVE-2018-7848, CVE-2018-7849, CVE-2018-7851, CVE-2018-7852, CVE-2018-7853, CVE-2018-7854, CVE-2018-7855, CVE-2018-7856, CVE-2018-7857, CVE-2019-6806, CVE-2019-6807, CVE-2019-6808, CVE-2019-6816, CVE-2019-6819, CVE-2019-6828, CVE-2019-6829, CVE-2019-6845, CVE-2019-6856, CVE-2019-6857, CVE-2020-28212, CVE-2020-28213, CVE-2020-6970, CVE-2020-7477, CVE-2020-7537, CVE-2020-7538, CVE-2020-7542, CVE-2020-7543, CVE-2020-7559, CVE-2021-20589, CVE-2021-20592, CVE-2021-21002, CVE-2021-21964, CVE-2020-5675, CVE-2021-22642, CVE-2021-22648, CVE-2021-22659, CVE-2021-22779, CVE-2021-22786, CVE-2021-22816, CVE-2021-30065, CVE-2022-22724, CVE-2022-24322, CVE-2022-24323, CVE-2022-28613, CVE-2022-37300, CVE-2022-37301, CVE-2022-45789, CVE-2022-4856, CVE-2022-4857, CVE-2023-0027, CVE-2023-25619, CVE-2022-2081, CVE-2023-1285, CVE-2023-1150

Documentations

Modbus Mesulog Standard Functions Help - Description for Modbus standard functions

Articles about Modbus - Ozeki
Introduction to Modbus and Modbus Function Codes - Shawn Dietrich, Control Automation (2023)

Analyzing PIPEDREAM - Challenges in Testing an ICS Attack Toolkit - Jimmy Wylie @ DEF CON 30 (2022)
Common Flaws in ICS Network Protocols - Mars Cheng & Selmon Yang @ Hack In The Box (2020)
Fun with Modbus 0x5a Nothing New Still Relevant? - Arnaud Soullié @ DEF CON 25 ICS Village (2017)
Industrial Control Systems : Pentesting PLCs 101 (Part 1/2) - Arnaud Soullie @ Black Hat Europe (2014)
Industrial Control Systems : Pentesting PLCs 101 (Part 2/2) - Arnaud Soullie @ Black Hat Europe (2014)
Industrial Protocol Gateways Under Analysis - Marco Balduzzi @ Black Hat USA (2020)
Industrial Protocol Gateways: A Deep-Dive of Moxa MGate 5105-MB-EIP - Philippe Lin @ Hack In The Box (2020)
Modbus Enumeration | SANS ICS Concepts - @ SANS ICS Security (2021)
Modbus Man-In-The-Middle | SANS ICS Concepts - @ SANS ICS Security (2021)
Modbus Traffic Analysis | SANS ICS Concepts - @ SANS ICS Security (2021)
ModScan: A SCADA MODBUS Network Scanner - Mark Bristow @ DEF CON 16 (2013)
Out of Control: Demonstrating SCADA device exploitation - Eric Forner & Brian Meixell @ Black Hat USA (2013)
Stealing PLC Intellectual Property: A Red Teaming Story - Matteo Beccaro @ Hack In The Box (2017)
The SCADA That Didn't Cry Wolf- Who's Really Attacking Your ICS Devices - Kyle Wilhoit @ Black Hat USA (2013)
Understanding SCADA's Modbus Protocol - Justin Searle @ Black Hat Asia (2015)
Unraveling SCADA Protocols Using Sulley Fuzzer - Ganesh Devarajan @ DEF CON 15 (2014)