Analyze ICS/SCADA Modbus/TCP, IEC 104, and DNP3 traffic using Ettercap ARP spoofing and Scapy scripts.
npx skills add https://github.com/G36maid/ctf-arsenal --skill ics-traffic
Please help me install this Agent Skill. Skill: ics-traffic Source: https://github.com/G36maid/ctf-arsenal/tree/main/.agents/skills/ics-traffic Command: npx skills add https://github.com/G36maid/ctf-arsenal --skill ics-traffic
Analyze ICS/SCADA network traffic and perform MITM experiments using Ettercap and Scapy for Modbus/TCP, IEC 104, and DNP3.
Launch the ICS MITM workflow in a lab by enabling IP forwarding, starting Ettercap with appropriate filters, and running the Scapy scripts to sniff, inject, and replay ICS traffic.
High-intent search queries and answers about installing and using this skill.
To perform ICS/SCADA MITM attacks on Modbus/TCP and IEC 104 traffic, use Ettercap for ARP spoofing to intercept packets, then apply Scapy scripts to sniff and inject traffic within a controlled lab environment.
Crafting and injecting DNP3 packets for security testing is done using Scapy-based scripts, which allow you to manipulate protocol traffic directly and test defensive responses during hands-on ICS research.
Yes, you can use Scapy and Ettercap together for ICS protocol analysis by enabling IP forwarding, starting Ettercap with appropriate filters for ARP spoofing, and running Scapy to sniff, craft, and replay ICS traffic.
This approach supports rapid incident response for SCADA systems by providing protocol references and filters that help analyze Modbus/TCP, IEC 104, and DNP3 traffic during security incidents and defensive testing.
To set up an ICS traffic interception lab, you need to enable IP forwarding, configure Ettercap with appropriate filters for ARP spoofing, and prepare Scapy scripts to handle packet sniffing and injection.
ARP spoofing works with SCADA protocols by using Ettercap to redirect network traffic through a MITM position, allowing you to intercept and analyze Modbus/TCP and DNP3 packets for defensive testing and vulnerability research.
plurigridCoordinates ssh, curl, nmap and Tailscale for remote Linux administration and diagnostics.
alicangnllAnalyze industrial control systems for protocol and PLC logic vulnerabilities.
nonputtipongCapture and analyze network traffic to document custom protocols.
wgpsecDetect Kubernetes Pods with sidecar containers and capture traffic in shared network namespaces.
