Modbus Attack Range Lab
Modbus has no authentication — any host that can reach port 502 can read and write every coil and register. In this safe, simulated range you attack a small Modbus network from a console: trip a breaker, stop a pump, mask a tank alarm, all with unauthenticated writes that simply take. Then you switch sides and add the compensating controls — segmentation, source allow-listing, a read-only gateway, write function-code DPI — and re-run the exact same attack to prove it now fails. Nothing here touches a real network.
The real job. More noise, a tighter clock.
Modbus console (from the business network)
Craft a request and send it to a slave. There is no login step — that is the point.
Register / coil map
Land at least one unauthenticated write first.
Objectives
The breaker is a coil: write it OFF to de-energise.
Disable the alarm-enable coil, or raise the alarm setpoint above the current level.
The run command is a coil: write it OFF.
Why this works
Modbus has no authentication, no integrity, no encryption. FC5/6/15/16 writes are accepted from anyone who can route to port 502.
You can't fix the protocol, so you compensate around it: segment, allow-list sources, gateway reads one-way, and DPI the write function codes.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based OT lab: a safe simulated Modbus/TCP network with four slaves (pump, valve, breaker, tank sensor) and a full coil/register map.
- As the attacker you craft Modbus requests from a console (read FC1–4, write FC5/6/15/16) to hit objectives like tripping the breaker or masking the tank alarm — and watch every write succeed with no authentication.
- Then you flip to the defender side and add compensating controls — network segmentation, source allow-listing, a read-only gateway, write function-code DPI — and re-run the exact recorded attack to prove it now fails.
- Scored on objectives achieved as attacker plus whether you picked the controls that actually block the writes (not detection-only ones), graded S–D, with Rookie / Pro / Elite tiers.
- The lesson: Modbus has no authentication, integrity or encryption, so you cannot fix the protocol — you compensate around it at the architecture layer.
Frequently asked questions
What is the Modbus Attack Range Lab?
A free, in-browser exercise built around a simulated Modbus/TCP network. You first play the attacker: from a console you issue Modbus function codes (read coils/inputs/registers with FC1–4, write with FC5/FC6/FC15/FC16) against four slave devices to achieve objectives — trip a breaker, stop a pump, over-drive a pump, force a valve, or mask a tank alarm. Every write is accepted with no login. You then switch to defender, enable compensating controls, and re-run your recorded attack to confirm it is now blocked. Nothing touches a real network.
Why does Modbus have no authentication?
Modbus was designed in 1979 for trusted serial links between a controller and its I/O, long before networked threats. The protocol has no concept of identity, passwords, message signing or encryption, and Modbus/TCP simply carried that trusting design onto port 502. Any host that can route to a slave is implicitly authorised to read and write it, which is exactly what the attacker phase of this lab demonstrates.
If I cannot add auth, how do I defend it?
With compensating controls around the protocol, not in it. The effective ones in this lab are network segmentation (isolate the OT segment so the business network cannot reach :502), source allow-listing (permit Modbus only from the engineering workstation), a read-only data gateway or diode (let historians read but drop write function codes), and protocol-aware DPI that blocks write function codes from unauthorised sources. The lab also includes controls that feel like security but block nothing — logging alone, rate-limiting a handful of writes, or requiring TLS on legacy slaves that cannot speak it — and the re-test proves they fail.
Is this a real Modbus network?
No. It is a teaching simulation that runs entirely in your browser — no real PLCs, no TCP connections, no port 502, nothing leaves the page. The devices, register map, objectives and controls are invented to make the attack and the compensating controls concrete and safe to practise.