v1.7.2 - Modbus TCP detection + CLI/TUI/web parity

What's new since v1.5.4

Modbus TCP detection (all interfaces)

• CIDR sweep now probes port 502 directly after autodetect — Modbus TCP devices were silently dropped before
• TUI single-IP scan falls back to TCP 502 + FC3 when probe_all finds nothing
• TUI broadcast scan has a dedicated Modbus TCP /24 sweep menu entry (32-host batches)
• Web broadcast scan routes vendor=modbus to a TCP /24 sweep instead of Schneider UDP

CLI/TUI/web parity

• get tags --protocol modbus/bacnet/dnp3/opcua now works in CLI (previously bailed)
• get tags --protocol modbus reads FC1 coils, FC3 holding regs, FC4 input regs
• get tag --protocol iec104/ewon/mqtt/modbus all implemented in CLI (were unimplemented)
• get discrete-input [start] [count] new CLI subcommand for Modbus FC2
• Web POST /api/exploit/modbus/map-quick and modbus/map-common added
• Web POST /api/device/tags with vendor=s7 now works (s7 alias for siemens)

Credentials support (v1.7.0)

• get tags/tag --username/--password for Siemens S7, eWON, MQTT
• Web /api/device/tags and /api/device/write accept username/password fields

Web and exploit additions (v1.6.0)

• BACnet, DNP3, OPC-UA exploit routes reachable via POST /api/exploit/:id
• GET /api/info works for EnIP, Schneider, Mitsubishi, SNMP
• TUI Phoenix list/read tags now populate the tag browser for [W] writes
• Modbus write with no hr:/coil: prefix gives a clear format hint

Fixes

• eWON tag lookup type mismatch fixed (Vec<(String,String)> not a HashMap)
• All 16 Protocol variants handled in CLI get tags — no more unreachable bail
• Modbus write format hint shown before generic fallback

scadaver v1.5.4

Fixed

• --timeout flag now propagates to all S7Comm call sites (get_io, get state, get db,
  set output, set merkers, set db) instead of being hardcoded to 5 seconds
• --timeout propagates to Beckhoff ADS discovery in get state and get tags (was hardcoded to 3)
• get tags --protocol mqtt subscribe window now respects --timeout instead of always waiting 2 s

Added

• db list subcommand: prints all stored devices with id, IP, vendor, and last-seen age

Fixed (CSV)

• export --format csv now strips embedded newlines and carriage returns from JSON field blobs
  so rows are never split across multiple CSV lines

scadaver v1.5.1

Fixed

• MQTT was absent from the TUI vendor picker — it now appears alongside all other vendors
• MQTT exploit entries ("Publish", "List Topics") were missing capability keys, causing them to always appear disabled; added MqttTcp capability key with port and field-based detection
• Added MqttTcp to check_capability and capability_missing_reason to complete the gating logic

scadaver v1.5.0

Changed

• All ICS/OT protocol implementations moved to casket, a standalone library published on crates.io; scadaver now depends on casket = "0.1" instead of compiling vendor code directly
• Network interface selection kept in scadaver as CLI-specific tooling in src/net.rs
• scadaver-macros workspace crate removed; the IntoDeviceInfo derive macro now lives in casket-macros

Added

• capture feature flag to opt into pcap-based capture via casket/capture

Removed

• src/core/, src/vendors/, src/prelude.rs, src/references.rs — all protocol logic is now in casket
• scadaver-macros/ workspace crate

scadaver v1.4.0

Added

• Write and read support for IEC-104, Siemens S7, MQTT, and eWON devices (set tag, get tag)
• Beckhoff get tag via ADS; Rockwell set tag --type flag for typed CIP writes
• EIP sender context watermark for traffic fingerprinting; Snort and YARA detection rules
• TUI: persistent struct members, auto-display on device select, access labels, legend

Fixed

• TUI panic guard on empty device list
• Web API auth gaps in ephemeral key validation

Changed

• Pre-commit strict clippy gate; Rust 1.87 pinned as minimum version

scadaver v1.3.0

Added

• PCAP passive discovery (capture feature flag): listen on a network interface and fingerprint ICS devices from traffic without sending probes
• Regression test suite covering all protocol parsers

Fixed

• 7 security and correctness fixes across MQTT, EIP, and Modbus parsers
• Reader thread lock starvation in MQTT persistent session
• CI: replaced Python-based simulators with in-process UDP/TCP loopbacks for reliable test runs

scadaver v1.2.1

Added

• Integration tests for all 10 remaining ICS protocol scanners (BACnet, DNP3, OPC-UA, SNMP, IEC-104, SLMP, FINS, EIP, Modbus, Beckhoff)

Fixed

• MQTT shell ConnectOptions missing tls and protocol_version fields
• musl CI build: vendor native-tls OpenSSL so the static Linux binary links cleanly

scadaver v1.2.0

Added

• CIDR network sweep: scadaver --network 192.168.1.0/24 scan probes every host in a range
• Nmap XML import: scadaver import --nmap scan.xml seeds the database from existing scans
• Config file support (~/.config/scadaver/config.toml): persist default timeout, interface, and stealth settings
• BACnet/IP, DNP3 TCP, and OPC-UA protocol support (scan, read, exploits)
• MQTT TLS and MQTT v5 in the interactive shell
• Web UI: live device push over WebSocket
• MQTT: ACL enumeration, session persistence attack, retain flooding
• Sparkplug B fuzzer with safety hardening
• TUI: live MQTT topic browser panel (press m)

scadaver v1.1.3

Added

• Siemens and SNMP device info enrichment: CPU state, firmware, and hardware fields now populate the device record
• IntoDeviceInfo derive macro wired into all vendor structs so autodetect results are fully typed

scadaver v1.1.2

Added

• MQTT broker scanner: anonymous detection, $SYS/# recon, Sparkplug B passive detection, credential spraying
• MqttSession: persistent MQTT connection with background reader thread (subscribe, publish, drain, disconnect)
• scadaver mqtt interactive shell: 3-level client (configure → connect → pub/sub/attack)

Fixed

• Renamed FinsDevice to OmronDevice to match prelude re-export
• Renamed LogixDevice and PhoenixDeviceInfo to match prelude export names