May 2017
Intermediate to advanced
416 pages
21h 33m
English
The script can be configured to attempt to enumerate all slave IDs by setting the script argument aggressive, as follows:
$nmap -sT -Pn -p502 --script modbus-discover --script-args modbus-discover.aggresive=true <target>
The aggressive mode will make the script attempt to retrieve information from the first 256 slave IDs:
PORT STATE SERVICE 502/tcp open modbus | modbus-discover: | sid0x0: | Slave ID data: \xB4\xFFLMB3.0.3 | sid0x1: | Slave ID data: \xFA\xFFPM710PowerMeter <edited for conciseness> | sid0x64: | Slave ID data: \xFA\xFFPM710PowerMeter |_ Device identification: Schneider Electric PM710v03.110
Read now
Unlock full access