Industrial Labs

Oilsprings

Flat OT network. No segmentation. Full exposure — with the monitoring stack of your choice.

Industry: Oil & Gas

Plan: Free

Protocols: Modbus TCP

Oilsprings Air is a pure OT-focused industrial lab that simulates a flat, air-gapped control network. Oilsprings Air represents a simplified industrial control system with no DMZ or external IT integration, closely resembling legacy or poorly segmented OT environments. The lab contains a modified OpenPLC, SCADA, Engineering Workstation, Pentest Fury, Network Swiftness IDS and Tidal Collector, all connected through a basic router. Users can program PLC logic, observe SCADA interactions, capture and analyze OT traffic, practice protocol-aware security testing and see how logs and network events are generated in real time. Oilsprings Air is designed to teach core ICS concepts such as protocol behavior, asset visibility, baseline traffic patterns and why lack of segmentation increases risk.

Gasflow Terminal

26 services. Turbine logic. Full gas processing topology.

Industry: Oil & Gas

Plan: Organizations

Protocols: Siemens S7comm, Syslog

Gasflow Terminal is a large-scale industrial gas transport station simulation built around multiple turbine-driven compressor units. The environment models a distributed control architecture where each turbine operates with its own local PLC and HMI layer, while a central SCADA system aggregates telemetry, coordinates load balancing, and maintains system-wide stability. Users interact with a complex industrial topology that includes process control loops for combustion, rotation, airflow regulation, lubrication systems, and startup sequencing. The lab reflects real-world constraints such as redundant sensing, safety interlocks, and deterministic control cycles. Gasflow Terminal is designed to simulate enterprise-level industrial complexity, where multiple subsystems interact continuously under strict operational constraints.

Utility Works I

First structured lab in Loginward. Where OT security begins.

Industry: Water & Utilities

Plan: Free

Zone: Loginward

Protocols: Modbus TCP

Utility Works I is the entry lab for the Loginward zone — the first structured industrial environment new operators encounter in the World of Labshock. Zone: Loginward. The lab models a small utility control station with a single PLC managing water flow regulation, a SCADA interface for monitoring, an Engineering Workstation for logic modification, and a network IDS capturing all traffic. No external connections. No IT network. Just the control system. Users complete guided objectives: read process values from the SCADA interface, identify active assets on the OT network, observe baseline Modbus traffic, and trigger a log event using the Engineering Workstation. Utility Works I establishes the vocabulary and observation skills required for every lab that follows.

Eastwater Facility

Water distribution control under active monitoring — baseline, Zeek, or Suricata.

Industry: Water & Utilities

Plan: Free

Zone: Signalspire

Protocols: Modbus TCP

Eastwater Facility is the primary lab for the Signalspire zone, modeling a water distribution control system with active network monitoring and SIEM integration. The environment introduces a basic industrial water system where a single PLC manages flow, pressure, and water quality. A simple HMI interface provides process visibility and control. Users are introduced to operational water infrastructure: starting and stopping processes, connecting to PLC systems via industrial protocols, and observing how sensor data is translated into control logic. Eastwater Facility marks the first step into water treatment systems, where every drop is governed by automation logic.

Utility Works II

Stop watching the process. Start writing the logic that runs it.

Industry: Water & Utilities

Plan: Pro

Zone: Thunderwatch

Protocols: Modbus TCP

Utility Works II is the anchor lab of the Thunderwatch zone and the point where World of Labshock moves from observing industrial processes to programming them. You return to the utility control site, but observation is no longer enough. The boiler room process has been expanded and the PLC no longer runs simple fixed logic. Inputs, outputs, timers, memory bits, and process states now decide how the system behaves. Users open the PLC project inside the Engineering Workstation, study the existing boiler room control logic, read the scan cycle and execution order, and modify ladder logic to change process behaviour. The lab works directly with timers, coils, contacts, and memory variables, then deploys updated logic to the PLC runtime and verifies the result through the HMI and live process feedback. Utility Works II is the practical foundation for OT detection work. Once you have written a correct condition yourself, an incorrect one written by somebody else becomes visible.

Electroshock

6 kV substation. DNP3 and IEC 104. Operate a breaker, then check what the IDS saw.

Industry: Power & Energy

Plan: Pro

Zone: Firegate

Protocols: DNP3, IEC 60870-5-104

Electroshock is the primary lab of the Firegate zone, built around an operable 6 kV substation running the two protocols used to control power, water, and infrastructure: DNP3 and IEC 60870-5-104. The environment contains RTUs, SCADA, feeders, breakers, disconnectors, and industrial routing, with network detection watching the traffic between them. Unlike a packet capture or a protocol diagram, every element is live: commands execute, breakers change state, and telemetry returns. The lab is organised around a single control chain that can be followed end to end. SCADA sends a command, the RTU processes it, the breaker changes state, telemetry returns, the IDS observes the traffic, and the operator sees the process impact. Each transition is a distinct security question. Users capture live protocol sessions, read protocol fields, map addresses and points, operate approved commands through Select-Before-Operate, test what happens when communication degrades, and validate whether detection fires against genuine activity rather than a replayed capture.

Rotorbay Assembly

Industrial protocol lab. Modbus at the register level.

Industry: Manufacturing

Plan: Pro

Zone: Netfields

Protocols: Modbus TCP

Rotorbay Assembly is the core protocol lab for the Netfields zone, built specifically for hands-on interaction with Modbus TCP and industrial control sequencing at scale. The environment runs a fully automated rotor production line where mechanical systems operate in tightly synchronized motion. A Modbus-enabled PLC coordinates machining, shaft insertion, balancing, inspection, and packaging stages. A centralized HMI provides visibility into every phase of production, while underlying control logic operates through registers, coils, and deterministic sequencing. Users explore how industrial systems coordinate multi-stage production flows, how PLC logic governs physical machinery, and how Modbus communication behaves under continuous operational load. Rotorbay Assembly represents advanced industrial coordination where every register directly influences physical outcome.

Spindlespeed

Siemens S7 protocol interaction and control logic analysis.

Industry: Manufacturing

Plan: Pro

Zone: Logicveil

Protocols: Siemens S7comm

Spindlespeed is a precision machining lab within the Logicveil zone, focused on Siemens S7 communication and industrial control behavior in modern manufacturing systems. The environment simulates a CNC machining workshop where a PLC manages spindle rotation, feed rate, and tool positioning. A Siemens S7-compatible communication layer enables interaction with control logic and process variables. An HMI interface provides real-time visibility into RPM, load, and machining status, allowing users to observe how mechanical performance is directly tied to PLC logic execution. Users analyze spindle control behavior, monitor industrial protocol traffic, and study how manufacturing systems differ from traditional IT environments in timing, determinism, and control sensitivity. Spindlespeed introduces the intersection of precision engineering and industrial communication protocols.

Railroad North

Master-slave PLC architecture. Distributed transportation control.

Industry: Rail & Transport

Plan: Organizations

Protocols: Modbus TCP

Railroad North is a specialized OT lab simulating a distributed railroad control environment with a master-slave PLC architecture. The lab features a realistic rail network where multiple PLCs coordinate track switching, signaling, and barrier control across distributed segments. Users can manipulate simulation switches to control track routing, observe signaling behavior, and analyze automation logic in real time. The environment includes integration with both OT and DMZ layers, enabling realistic segmentation between control systems and monitoring infrastructure. Data flows through collectors and DMZ components into centralized logging and observability systems. Railroad North supports hands-on exploration of multi-PLC coordination, industrial communication patterns, and distributed control logic across a transportation system.