-
Section 1: Introduction
10 Lessons-
Start1 Welcome to the Training
-
Start2 Contrasting IT and OT
-
Start3 Attack Surface and Common Security Challenges
-
Start4 Evolution of Industrial Devices
-
Start5 Evolution of Industrial Communication
-
Start6 Default Credentials and Exposed Controllers
-
Start7 Framework for OT Resilience Testing and Risk Evaluation in Security Scenarios
-
Start8 Classification of Penetration Testing in this Training
-
Start9 Recap of IPv4 Addresses and Subnetting
-
Start10 Section 1 Summary and Community Q&A
-
-
Section 2: Offensive OSINT
6 Lessons-
Start11 Welcome to Offensive OSINT
-
Start12 Default Credentials in Industrial Devices
-
Start13 Google Dorking for Finding Industrial Controllers and Human Machine Interfaces
-
Start14 Using Shodan, ICSRank and Ipinfo.io
-
Start15 Finding Vulnerabilities with CISA-s ICS Advisories
-
Start16 Section 2 Summary and Community Q&A
-
-
Section 3: Setting Up Your Virtual Lab
8 Lessons-
Start17 Welcome to Setting Up Your Virtual Lab
-
Start18 Understanding Virtualization and Virtual Machines
-
Start19 Installation of Oracle VirtualBox
-
Start20 Installation the Kali Linux VM and Running the Installation Script
-
Start21 Installing the Ubuntu Desktop VM
-
Start22 Running the Installation Script
-
Start23 Setting Up the Virtual HostOnly Network
-
Start24 Section 3 Summary and Community Q&A
-
-
Section 4: Introduction to Kali Linux and Penetration Testing Tools
12 Lessons-
Start25 Welcome to Kali Linux Penetration Testing Tools
-
Start26 Netdiscover
-
Start27 Nmap Essentials
-
Start28 Snmp-Check for Device Enumeration
-
Start29 Dirb for Industrial Webserver Directory Traversal
-
Start30 Nmap Scripting Engine
-
Start31 Metasploit Framework
-
Start32 Exploit Database (Exploit-DB)
-
Start33 Wireshark
-
Start34 Other Tools for Industrial Penetration Testing
-
StartSection 4 Quiz
-
Start35 Section 4 Summary and Community Q&A
-
-
Section 5: Siemens Simatic S7 Controller Penetration Testing
26 Lessons-
Start36 Welcome to Siemens Simatic S7 Controller Penetration Testing
-
Start37 Introduction to Programmable Logic Controllers
-
Start38 Introduction to Simatic S7 Controllers
-
Start39 S7Comm Protocol Stack
-
Start40 NSE Script s7-info
-
Start41 Siemens_scanner and CPU Command (ExploitDB) in Metasploit
-
Start42 SiemensScan Python Script
-
Start43 Dissecting S7Comm with Wireshark
-
Start44 OSINT Task Exposed S7 Devices on Shodan
-
Start45 OSINT Solution Exposed S7 Devices on Shodan
-
Start46 OSINT Task Google Dorks for S7 Webservers
-
Start47 OSINT Solution Google Dorks for S7 Webservers
-
Start48 OSINT Task Default Credentials for Siemens Devices
-
Start49 OSINT Solution Default Credentials for Siemens Devices
-
Start50 Pentesting a Real Siemens Simatic S7-1200 PLC
-
Start51 Pentesting a Real Siemens Simatic S7-1500 PLC
-
Preview52 S7-1500 Penetration Testing Assignment
-
StartSection 5: Mid-Section Quiz
-
Preview53 Hint Video Methodology and Steps for S7-1500 Penetration Testing
-
Preview54 Step 1 Host Discovery
-
Preview55 Step 2 Scanning for Open Ports
-
Preview56 Step 3.1 + 3.2 Visiting the Webserver and NSE Script Scan
-
Preview57 Step 4 ExploitDB CPU Command Module in Metasploit
-
Start58 Findings and Mitigation Strategies
-
Start59 Penetration Testing Report with ChatGPT
-
Start60 Section 5 Summary and Community Q&A
-
-
Section 6: MQTT Penetration Testing
23 Lessons-
Start61 Welcome to MQTT Penetration Testing
-
Start62 Smart Factories
-
Start63 IIoT Communication with MQTT
-
Start64 Industrial Edge Devices Simatic IOT20xx and RevPi
-
Start65 Moxie
-
Start66 Mosquitto Client
-
Start67 NSE Script mqtt-subscribe
-
Start68 Dissecting MQTT with Wireshark
-
Start69 OSINT Task Exposed MQTT Brokers on Shodan
-
Start70 OSINT Solution Finding Exposed MQTT Brokers on Shodan
-
Start71 Pentesting a Real Siemens Simatic IOT2000 Industrial MQTT Broker
-
Start72 Smart Factory IIoT Penetration Testing Assignment
-
StartSection 6: Mid-Section Quiz
-
Start73 Hint Video Methodology and Steps for IIoT Penetration Testing (No Spoilers)
-
Start74 Step 1 Host Discovery
-
Start75 Step 2 Scanning for Open Ports
-
Start76 Step 3 Service Detection and NSE Script Scan
-
Start77 Step 4.1 MQTT Detection and Listening with Moxie
-
Start78 Step 4.2 MQTT Listening with mosquitto_sub
-
Start79 Step 5 FloodingDoS-ing the MQTT Broker
-
Start80 Findings and Mitigation Strategies
-
Start81 Penetration Testing Report with ChatGPT
-
Start82 Section 6 Summary and Community Q&A
-
-
Section 7: Rockwell Allen Bradley Controller Penetration Testing
21 Lessons-
Start83 Welcome to Rockwell Allen Bradley Controller Penetration Testing
-
Start84 Introduction to Rockwell Allen Bradley 1756-L61B LOGIX5561 Controller
-
Start85 EnIP & CIP Protocol Stack
-
Start86 EnIP & CIP Exploit Modules in Metasploit
-
Start87 NSE Script enip-info
-
Start88 Dissecting EnIP & CIP with Wireshark
-
Start89 OSINT Rockwell Allen Bradley Default Credentials
-
Start90 OSINT Task Exposed Rockwell Allen Bradley Controllers on Shodan
-
Start91 OSINT Solution Finding Exposed Rockwell Allen Bradley Controllers on Shodan
-
Start92 Penetration Testing Assignment
-
StartSection 7: Mid-Section Quiz
-
Start93 Hint Video Methodology and Steps for EnIPCIP Penetration Testing (No Spoilers)
-
Start94 Step 1 Host Discovery
-
Start95 Step 2 Scanning for Open Ports
-
Start96 Step 3.1 Directory Traversal of the PLC Webserver
-
Start97 Step 3.2 Service Detection and NSE Script Scan
-
Start98 Step 4.1 Metasploit Module 1
-
Start99 Step 4.2 Metasploit Module 2
-
Start100 Findings and Mitigation Strategies
-
Start101 Penetration Testing Report with ChatGPT
-
Start102 Section 7 Summary and Community Q&A
-
-
Section 8: Fuel Station Controller Penetration Testing
19 Lessons-
Start103 Welcome to Fuel Station Controller Penetration Testing
-
Start104 Introduction to Veeder Root TLS-350 Automated Tank Gauge (ATG) Controller
-
Start105 Configuration of the ATG with Function Codes using the Telnet Console
-
Start106 NSE Script atg-info
-
Start107 Metasploit Module atg_client
-
Start108 Dissecting ATG Communication with Wireshark
-
Start109 OSINT Task Exposed ATG Controllers on Shodan
-
Start110 OSINT Solution Exposed ATG Controllers on Shodan
-
Start111 Penetration Testing Assignment
-
StartSection 8: Mid-Section Quiz
-
Start112 Hint Video Methodology and Steps for ATG Penetration Testing (No Spoilers)
-
Start113 Step 1 Host Discovery
-
Start114 Step 2 Scanning for Open Ports
-
Start115 Step 3 NSE Script Scan
-
Start116 Step 4 Information Disclosure
-
Start117 Step 5 Setting Tampering
-
Start118 Findings and Mitigation Strategies
-
Start119 Penetration Testing Report with ChatGPT
-
Start120 Section 8 Summary and Community Q&A
-
-
Section 9: Human Machine Interface Penetration Testing
22 Lessons-
Start121 Welcome to Human Machine Interface Penetration Testing
-
Start122 Introduction to Human Machine Interfaces
-
Start123 HMI Panel Devices , Remote Access and HMI Screen Design
-
Start124 NSE Scripts vnc-brute, vnc-info, vnc-title
-
Start125 Introduction to Metasploit Modules vnc_none_auth and vnc_login
-
Start126 Hydra
-
Start127 Vncviewer
-
Start128 Exposed HMI on Shodan
-
Start129 Pentesting a Real Siemens Simatic HMI KTP 400 Panel
-
Start130 Penetration Testing Assignment 1
-
StartSection 9: Mid-Section Quiz
-
Start131 Hint Video 1 Methodology and Steps for HMI Penetration Testing (No Spoilers)
-
Start132 Step 1.1 Combined Discovery
-
Start133 Step 1.2 NSE Script Scan
-
Start134 Step 1.3 Accessing the HMI
-
Start135 Penetration Testing Assignment 2
-
Start136 Hint Video 2 Methodology and Steps for HMI Penetration Testing (No Spoilers)
-
Start137 Step 2.1 NSE Script Scan
-
Start138 Step 2.2 Brute-Force Attack with Hydra and Access to the HMI
-
Start139 Findings and Mitigation Strategies
-
Start140 Penetration Testing Report with ChatGPT
-
Start141 Section 9 Summary and Community Q&A
-
-
Section 10: Modbus Controller Penetration Testing
25 Lessons-
Start142 Welcome to Modbus Controller Penetration Testing
-
Start143 Introduction to Modicon Industrial Controllers and Modbus
-
Start144 Modbus TCP Protocol Stack
-
Start145 NSE Scripts modicon-info, modbus-discover
-
Start146 Metasploit Modbus Modules detect, banner_grabbing, findunitid, modicon_command
-
Start147 Memory of an Industrial Controller
-
Start148 Modbus Commandline Interface
-
Start149 Dissecting Modbus Communication with Wireshark
-
Start150 OSINT Task Exposed Modbus Controllers on Shodan
-
Start151 OSINT Solution Exposed Modbus Controllers on Shodan
-
Start152 OSINT Task Google Dorks for Exposed Schneider Electric Webservers
-
Start153 OSINT Solution Google Dorks for Exposed Schneider Electric Webservers
-
Start154 OSINT Task Default Credentials for Schneider Electric Devices
-
Start155 OSINT Solution Default Credentials for Schneider Electric Devices
-
Start156 Pentesting a Real Schneider Electric Modicon M221 PLC
-
Start157 Penetration Testing Assignment
-
StartSection 10: Mid-Section Quiz
-
Start158 Hint Video Methodology and Steps for Modbus Penetration Testing (No Spoilers)
-
Start159 Step 1 Combined Discovery
-
Start160 Step 2 Enumeration with Metasploit
-
Start161 Step 3 Memory Access
-
Start162 Step 4 Memory Manipulation
-
Start163 Findings and Mitigation Strategies
-
Start164 Penetration Testing Report with ChatGPT
-
Start165 Section 10 Summary and Community Q&A
-
-
Section 11: IEC-104 Substation Penetration Testing
16 Lessons-
Start166 Welcome to IEC-104 Substation Penetration Testing
-
Start167 Introduction to IEC-104
-
Start168 IEC-104 Protocol Stack Frames, ASDU-s and Commands
-
Start169 NSE Script iec-identify
-
Start170 Metasploit Module iec104
-
Start171 Dissecting IEC-104 Communication with Wireshark
-
Start172 Penetration Testing Assignment
-
StartSection 11: Mid-Section Quiz
-
Start173 Hint Video Methodology and Steps for IEC-104 Penetration Testing (No Spoilers)
-
Start174 Step 1 Combined Discovery
-
Start175 Step 2 Exposed Webservices and NSE Script Scan
-
Start176 Step 3 Dumping the ASDU
-
Start177 Step 4 Manipulating Information Objects
-
Start178 Findings and Mitigation Strategies
-
Start179 Penetration Testing Report with ChatGPT
-
Start180 Section 11 Summary and Community Q&A
-
-
Section 12: OT Network Security Assessment
9 Lessons-
Start181 Welcome to OT Network Security Assessment
-
Start182 Introduction to Historically Evolved Shop Floors, OT Networks, and VPN Access
-
Start183 Asset Inventory
-
Start184 Security Assessment Assignment
-
StartSection 12: Mid-Section Quiz
-
Start185 Hint Video
-
Start186 OT Network Assessment Host Discovery, Asset Inventory Matching
-
Start187 Findings and Mitigation Strategies
-
Start188 Section 12 Summary and Community Q&A
-
-
Section 13: Understanding Security Challenges
7 Lessons-
Start189 Welcome to Understanding Security Challenges
-
Start190 Common Security Challenges
-
Start191 Flat OT Network Architecture
-
Start192 Internet Access Gateways
-
Start193 Adversary Maturity Levels in IEC/ISA 62443
-
Start194 Understanding Attacks with the Mitre ICS ATT&CK Framework
-
Start195 Section 13 Summary and Community Q&A
-
-
Section 14: Mitigation and Protection
7 Lessons-
Start196 Welcome to Mitigation and Protection
-
Start197 Defense in Depth
-
Start198 System Hardening of a Siemens Simatic PLC
-
Start199 System Hardening of a Siemens Simatic HMI
-
Start200 Secure OT Network Design with Segmentation and DMZ
-
Start201 Securing Remote Access Services
-
Start202 Section 14 Summary and Community Q&A
-







