Class 05 - UART and the OT World

Class 05 - UART and the OT World

This class marks the transition point from consumer hardware exploitation into the industrial OT domain. The instructor explains how UART is embedded not only in small devices but also in PLCs, controllers, and other industrial systems, often forming the backbone of RS232, RS422, and RS485 communication. Students learn how UART access on OT devices can expose process logic, control flows, and critical system logs, with the potential to impact production lines and safety mechanisms.

This session also serves as the entry point to Classes 05–11, a continuous track where students progressively build the capabilities required to execute a full real-world ICS/OT (industrial control systems / Operational Technology) penetration test. From here onward, each class layers new exploitation techniques on top of the last, taking students from reconnaissance on OT lines all the way to active manipulation and command injection in live control systems.

Learning Objective
Understand UART’s role in OT environments and its exploitation potential.

Training Outcomes

  • Identify UART presence in OT devices.

  • Understand how UART maps to OT protocols.

  • Recognize the risks of UART exploitation in ICS.

Hands-On Experience

  • Inspect PLCs or OT hardware for UART headers.

  • Capture UART messages from industrial devices.

  • Document connections between UART and process control.

Hardware Hacking Expert - Level 2 - Module 1: UART Hacking

Buy nowLearn more
  • Links to tools & materials you should purchase:

About Module 01 – UART Hacking

  • Syllabus Module 01 – UART Hacking - Module 01.pdf

Class 01 - Why Hack UART?

  • Class 01 - Why Hack UART?

Class 02 - Identify UART pins

  • Class 02 - Identify UART pins

Class 03 - Sniffing Log

  • Class 03 - Sniffing Log

Class 04 - Bypassing Simple Login

  • Class 04 - Bypassing Simple Login
  • CrackLoginHash.py
  • rockyou.txt

Class 05 - UART and the OT World

  • Class 05 - UART and the OT World

Class 06 - Connecting to OT Comm Line

  • Class 06 - Connecting to OT Comm Line

Class 07 - Identifying the right wires

  • Class 07 - Identifying the right wires
  • ModBusEmulator-Client.py
  • ModbusEmulator-Server.py
  • OT_Sniffer.py

Class 08 - From OT to UART

  • Class 08a - From OT to UART
  • Class 08b - RS485 to UART Adaptors DIY - part 1
  • Class 08c - RS485 to UART Adaptors DIY - part 2

Class 09 - Sniffing OT Network

  • Class 09 - Sniffing OT Network

Class 10 - Reversing OT traffic

  • Class 10a - Reversing OT traffic - part 1
  • Class 10b - Reversing OT traffic - part 2
  • Class 10c - Reversing OT traffic - part 3
  • CRC-Brute.py
  • OT-Parser.py

Class 11 - true MITM on OT

  • Class 11a - true MITM on OT - part 1
  • Class 11b - true MITM on OT - part 2
  • Class 11c - true MITM on OT - part 3
  • Class 11d - true MITM on OT - part 4
  • Class 11e - true MITM on OT - part 5
  • OT_MITM.py
  • ThhMITMxface_Schematics.pdf
  • ThhWireBug_Rider.STL
  • MITM_Test.py
  • ThhWireBug_Schematics.pdf
  • ThhWireBug_PCB.STL
  • ThhWireBug_House.STL

Class 12 - Fault Injection in UART Attacks

  • Class 12 - Fault Injection in UART Attacks
  • GlitcherTest.py

Class 13 - Bypassing Kill Switch Protection

  • Class 13 - Bypassing Kill Switch Protection - part 1
  • Class 13 - Bypassing Kill Switch Protection - part 2
  • BrutPassword.py
  • PasswordUARTmaster.elf
  • rockyou.txt

Class 14 - Bypassing Secure Boot

  • Class 14a1 - Bypassing Secure Boot - Intro 1
  • Class 14a2 - Bypassing Secure Boot - Intro 2
  • Class 14b - Bypassing Secure Boot by Fault Injection
  • Class 14c - Bypassing Secure Boot by Imposing Single User Login
  • Class 14d - Bypassing Secure Boot by Firmware Manipulations
  • JetsonUart0FullLog01.log

Class 15 - Firmware Extraction the UART way

  • Class 15a - Firmware Extraction the UART way - Intro
  • Class 15b - Firmware Extraction the UART way - Bootloader Backdoors
  • Class 15c - Firmware Extraction the UART way - Logfile Resurrection
  • hex2bin.py