icsFuzzer
icsFuzzer sends malformed and boundary-case packets to industrial devices to find crashes and spec-violations. It is a generator-based fuzzer: every case is a deterministic, auditable payload built in pure Python, exportable without a live target, and calibrated against a software responder before any hardware run.
Each protocol module ships with a software responder (for calibration) and a test suite. The per-protocol field guides under Protocol Guides document the wire format and fuzz surface of each.
Findings have been coordinated with maintainers across the full spectrum of responses — from same-day fixes to vendor-declined — always honestly scoped.
Protocol guides
- A Researcher's Guide to BACnet/IP (ASHRAE 135)
- A Researcher's Guide to the CODESYS V3 Name Service
- A Researcher's Guide to DNP3 (IEEE 1815)
- A Researcher's Guide to EtherNet/IP & CIP
- A Researcher's Guide to FactoryTalk Linx RNA
- A Researcher's Guide to Omron FINS
- A Researcher's Guide to GE SRTP
- A Researcher's Guide to IEC 60870-5-104
- A Researcher's Guide to IEC 61850 MMS
- A Researcher's Guide to LwM2M & CoAP
- A Researcher's Guide to Modbus/TCP
- A Researcher's Guide to OPC-UA (Binary / UA-TCP)
- A Researcher's Guide to PROFINET (DCP + PNIO-CM)
- A Researcher's Guide to S7comm (Siemens S7)
- A Researcher's Guide to Schneider UMAS (Modbus fn 0x5A)