So in my learning process I've been using the tool 'Grassmarlin' pretty often. I was discussing some tools used in discovery and enumeration with another person learning the , what we called, 'The gentle way of ICS pwning', and they had never heard of Grassmarlin before.
For those that do not know, Grassmarlin is a passive network discovery tool developed by the #nsa. If you aren't familiar with ICS/SCADA systems, they are very delicate and often legacy systems that support/control enormous very important industrial works. Why don't they just replace the legacy systems? because these systems, when offline means powergrids are offline, and to schedule patching and upgrade , if at all possible, could be months or years away.
When attempting discovery and enumeration aka 'Scanning', anything as common as #nmap could crash it. Since Nmap is our swissarmy knife for poking and prodding at systems, this leaves a lot of us in the lurch , trying to go through passively caught pcap files , tcpdump to #wireshark, to gain a bigger picture of what is happening on the system without moving that one jenga piece that would cripple a powergrid.
Then enters Grassmarlin *trumpets sounding*, this tool can not only take a passively caught pcap file but can capture packets itself for analyzation. The BEST part is visually connects them, similar to how Zenmap does for Nmap. Not only can the analyst see what system is where, but who is talking to who, and even display such things as PLC brands, and node connections.
It is gorsh darn brilliant! All without making a peep, passive recon never was so cool.
If you're interested on getting a little looky loo, I found a youtube series called 'Hack the airport' that has a demo
https://lnkd.in/eCR_mUQd
