In this work, we discuss the use of EPANET to simulate the effects of malicious cyber-physical attacks on water distribution systems. EPANET—a standard numerical modeling environment developed by the US Environmental Protection Agency—models hydraulic and water-quality behavior of pressurized pipe networks. EPANET promises to be well suited to show the effects of direct attacks on hydraulic actuators, such as pumps, or the effects of attacks on sensors. Using the C-Town benchmark network, we show that EPANET has some limitations when modeling these attacks, and we report the workarounds needed to overcome these limitations. In particular, we describe attacks that change the control strategies of pumps, and attacks that alter the tank water level reported by sensors.