← Back to Labs

SCADA & Smart City Industrial Control

Step through Modbus TCP function codes, PLC register manipulation, unauthenticated OT command injection, and data diode air-gaps

LEVEL 2: IT / HMI ZONEBOUNDARYLEVEL 1 / 0: OT FIELD PLANTHMI SCADA192.168.1.50!ROGUE OTFC 06 INJECTFWPORT 502FIREWALLPLC 502MODICON PLCR100: NORMALR101: 50%TANK60%PUMP1450 RPMVALVE50%42 PSIMODBUS TCP FRAME INSPECTOR (PORT 502)IDLE / SYSTEM READYMBAP HEADER (7 Bytes):00 01 00 00 00 06 01[TxID | Proto 0x0000 | Len 6 | Unit 1]PDU PAYLOAD (Function Code & Data):03 00 64 00 02PLC HOLDING REGISTERSR100 [0x0064] Pump Cmd:1 (ON)R101 [0x0065] Valve Pos:50%R103 [0x0067] Tank Level:60%R105 [0x0069] Pressure:42 PSI
STEP 1 OF 6

Purdue Model IT/OT Network Topology

Industrial control systems organize equipment into strict Purdue Model security levels (Level 0-3). Enterprise Level 3 servers and Level 2 HMIs communicate downward to Level 1 PLCs and RTUs, which govern Level 0 physical pumps, valves, and water sensors.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →