HVACScanner

Locates Honeywell/Tridium/Niagara HVAC JACEs/Controllers via HTTP fingerprint/strings. Very handy for vulnerability/pentesting.
This project was coded for Windows but could easily be adjusted to work on cygwin/linux environments

The path for nmap is hardcoded so you will need to update that in the python and .bat scripts to reflect your path to nmap