Conpot — published UHBS lab reports¶
Proof label: mushorg/conpot
Class / protocol: ICS-SCADA · Modbus TCP · container port 5020 (host map 502→5020)
UHBS: v4.0.1 · evaluation proof only (not an endorsement)
Conpot is an ICS/SCADA honeypot (default template also enables HTTP, S7, SNMP, BACnet, ENIP, FTP, TFTP, IPMI). This published grade evaluates the Modbus listener only — the primary ICS protocol plugin UHBS ships — so results stay comparable to other single-protocol lab reports.
Results at a glance¶
| Mode | UHQS | Grade | δ_C | Safety Gate | Folder |
|---|---|---|---|---|---|
| Quick | 44.55 | F | 0.5625 | not cleared (C=75) | quick/ |
| Full | 55.4 | D | 0.81 | not cleared (C=90) | full/ |
Sanitized fixture (full): ../../fixtures/conpot-ics-scada.scorecard.json
Contents¶
| Document | Purpose |
|---|---|
| TUTORIAL.md | Step-by-step replication (Docker) |
| METHODOLOGY.md | Digests, plugin limits, verification |
quick/SCORECARD.txt |
Human scorecard (quick) |
full/SCORECARD.txt |
Human scorecard (full) |
full/static/semgrep-report.json |
Module F Semgrep |
full/static/bandit-report.json |
Module F Bandit |
Module snapshot (full)¶
| Module | Score | Highlight |
|---|---|---|
| A Protocol | 79.0 | Modbus plugin; FC03 holding-register read returns exception 0x02 (default map is coils/inputs); n=1000 timing on 0–100 CheckResult scale |
| B Behavior | 42.5 | FC 0x06 write step failed/unacknowledged on default template; binary fuzz survived |
| C Telemetry | 55.0 | conpot.log text — no STIX/OTel/ECS (capped) |
| D Containment | 90.0 | No ports.ssh; airgap + gateway; gate not cleared |
| E Scale | 100.0 | P95 ~1.7 ms at concurrency 5 / 50 requests (moderated — see methodology) |
| F Static | 70.0 | Template SSL keys + Bandit HIGH findings → SAST gate cap |
Start here¶
Back to the reports index.