  To address the increasing security demands of industrial deployments, OPC UA
is one of the first industrial protocols explicitly designed with security in
mind. However, deploying it securely requires a thorough configuration of a
wide range of options. Thus, assessing the security of OPC UA deployments and
their configuration is necessary to ensure secure operation, most importantly
confidentiality and integrity of industrial processes. In this work, we present
extensions to the popular Metasploit Framework to ease network-based security
assessments of OPC UA deployments. To this end, we discuss methods to discover
OPC UA servers, test their authentication, obtain their configuration, and
check for vulnerabilities. Ultimately, our work enables operators to verify the
(security) configuration of their systems and identify potential attack
vectors.
