Nmap provides multiple scripts, and its function also allows users to create multiple custom scripts to identify the SCADA systems that are present in a network. This allows an analyst to create specific test cases to test the SCADA systems. Some of the scripts that are available by default in the latest Nmap Script library are as follows:

• s7-info.nse: This is used to enumerate Siemens S7 PLC devices and collect information such as system name, version, module, and type. This script works similarly to that of the PLCScan utility.
• modbus-discover.nse: Enumerates SCADA Modbus slave ids (sids) and collects information such as sid number and slave ID data. Modbus is a protocol used by various PLC and SCADA systems.

We will see the syntax and the usage of these scripts in the following recipes.