Protocol Guides

Research-focused field guides for fuzzing and vulnerability researchers — wire format, the fuzz surface, published bug classes, and how to build a test harness. Defensive framing; no weaponized exploit code. Indexed by vendor / ecosystem.

Cross-vendor

• A Researcher's Guide to BACnet/IP (ASHRAE 135)
  BACnet/IP · bacnet-udp
• A Researcher's Guide to DNP3 (IEEE 1815)
  DNP3 · dnp3-tcp
• A Researcher's Guide to EtherCAT (and SOEM)
  EtherCAT, SoE, CoE, EoE, FoE · ethernet, eoe
• A Researcher's Guide to IEC 60870-5-104
  IEC 60870-5-104 · iec104-tcp
• A Researcher's Guide to IEC 61850 MMS
  IEC 61850 MMS · iso-on-tcp
• A Researcher's Guide to LwM2M & CoAP
  LwM2M, CoAP · coap
• A Researcher's Guide to Modbus/TCP
  Modbus/TCP · modbus-tcp
• A Researcher's Guide to OPC-UA (Binary / UA-TCP)
  OPC-UA · ua-tcp
• A Researcher's Guide to SCPI & LXI Test Instruments
  SCPI, VXI-11, HiSLIP, GPIB · raw-socket, vxi-11, hislip

Rockwell / Allen-Bradley

• A Researcher's Guide to EtherNet/IP & CIP
  EtherNet/IP, CIP · ethernet-ip
• A Researcher's Guide to FactoryTalk Linx RNA
  RNA · rna

GE / Emerson

• A Researcher's Guide to GE SRTP
  GE SRTP · srtp

Omron

• A Researcher's Guide to Omron FINS
  FINS · fins-udp

Siemens

• A Researcher's Guide to PROFINET (DCP + PNIO-CM)
  PROFINET · dce-rpc, raw-ethernet
• A Researcher's Guide to S7comm (Siemens S7)
  S7comm · iso-on-tcp

Schneider Electric

• A Researcher's Guide to Schneider UMAS (Modbus fn 0x5A)
  UMAS, Modbus · modbus-tcp

CODESYS (OEM runtime)

• A Researcher's Guide to the CODESYS V3 Name Service
  CODESYS V3 · codesys-udp