This document discusses using the search engine Shodan to find exposed devices and systems online. It provides example search queries that can be used on Shodan to find devices by port, banner contents, or country. It also discusses how information can be gathered from devices using SNMP and how Nmap can be used with Shodan search results to take screenshots of websites with no authentication. The document suggests some potentially concerning searches related to SCADA systems and critical infrastructure.

1. Country d0m1nat10n
balgan@ptcoresec.eu

2. Who Am I ?
Team Leader of these guise
• Tiago Henriques
• @balgan
• 24
• BSc
• MSc
• CEH
• CHFI file:///C:/Users/balga
n/Downloads/11545_
• CISSP
192585389754_51359
• MCSA
9754_3020198_33334
• CISA
9_n.jpg
• CISM
Currently employed
• CPT
by these guise
• CCNA

3. What will we talk about today?

4. I AM NOT
RESPONSIBLE FOR ANY ILLEGAL
ACTS OR ACTIONS THAT YOU
PRACTICE OR ANYONE THAT
LEARNS SOMETHING FROM
TODAY’S PRESENTATION.

5. Causing Chaos.
If you guys were an attacker that
This is what I would do, control as
was out to cause am gonna talk
machines real damage or
manythat’s whatin that country,
And
get profit, critical systems andon
penetrate how would you go get
about today.
about it ?
as much info as possible.

6. Business
When a client asks for a pentest
We present them with these

7. Business

8. Business

9. Business

10. Business
And that’s all really neat and pretty,
however there are 2 problems with
that! These guys don’t give a f***.
Management Blackhats

11. Management
Cares about:
• Money
• Money
• Money
Does:
• Will lie for PCI DSS
This shit gives us,
• Approves every single thing even if it
security peeps,
doesn’t match security department goals headaches!
but gets them moneys.

12. Blackhats
I managed to acquire video
footage that shows these guys in
action and their vision of the
world, lets have a sneek peek!

13. Video - Blackhats

14. Tonight only, I ask one thing of u
Leave your whitehats and CISSPs at
home, and embark on a journey
with me to make the world…

15. SHODAN
SHODAN is a search engine that lets you find specific computers (routers,
servers, etc.) using a variety of filters. Some have also described it as a public
port scan directory or a search engine of banners.
Another way of putting it would be:

16. Is the
Of these

17. Now combine this:
With these:

18. And you get a lot of these

19. Also if you do anything ilegal and
get caught, you’ll get one of these:

20. SHODAN
Now its when u ask

21. Shodan
http://www.shodanhq.com/

22. SHODAN
Accessing that website will give u a bar, where you can type queries
and obtain results.
Your queries, can ask for PORTS, Countries, strings contained in the
banners, and all sorts of other things
Following is a sample set of queries that can lead to some interesting
results:

23. SHODAN QUERIES
• http://www.shodanhq.com/?q=cisco-IOS
• http://www.shodanhq.com/?q=IIS+4.0
• http://www.shodanhq.com/?q=Xerver
• http://www.shodanhq.com/?q=Fuji+xerox
• http://www.shodanhq.com/?q=JetDirect
• http://www.shodanhq.com/?q=Netgear
• http://www.shodanhq.com/?q=%22Anonymous+access+allowed%22
• http://www.shodanhq.com/?q=Golden+FTP+Server

24. SHODAN QUERIES + combined country?
Awesome!
Saturday, 9th
of June 2012

25. SHODAN QUERIES + combined country
Port: 3306 country:PT

26. SHODAN QUERIES + combined country?
Awesome!
Wednesday,
6th of June
2012

27. SHODAN QUERIES + combined country
BigIP country:PT

28. SHODAN QUERIES + combined country?
Awesome!
Tuesday,
March 13,
2012

29. SHODAN QUERIES + combined country
port:3389 -allowed country:PT

30. SHODAN QUERIES + combined country?
Awesome!

31. SHODAN QUERIES OF AWESOMENESS
SAP Web Application Server (ICM)
Worldwide
Portugal

32. SHODAN QUERIES OF AWESOMENESS
SAP NetWeaver Application Server
Worldwide
Portugal

33. SHODAN QUERIES OF AWESOMENESS
SAP Web Application Server
Worldwide
Portugal

34. SHODAN QUERIES OF AWESOMENESS
SAP J2EE Engine
Worldwide
Portugal

35. SHODAN QUERIES OF AWESOMENESS

36. SHODAN QUERIES OF AWESOMENESS
port:23 country:PT
Worldwide
Portugal

37. SHODAN QUERIES OF AWESOMENESS
port:23 country:PT
Username:admin
Password:smcadmin

38. SHODAN QUERIES OF AWESOMENESS
port:23 list of built-in commands
Worldwide
Not a big number, however just telnet in and you get shell…

39. SHODAN QUERIES OF AWESOMENESS
port:161 country:PT
Worldwide
Portugal

40. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Windows RUNNING PROCESSES 1.3.6.1.2.1.25.4.2.1.2
• Windows INSTALLED SOFTWARE 1.3.6.1.2.1.25.6.3.1.2
• Windows SYSTEM INFO 1.3.6.1.2.1.1.1
• Windows HOSTNAME 1.3.6.1.2.1.1.5
• Windows DOMAIN 1.3.6.1.4.1.77.1.4.1
• Windows UPTIME 1.3.6.1.2.1.1.3
• Windows USERS 1.3.6.1.4.1.77.1.2.25
• Windows SHARES 1.3.6.1.4.1.77.1.2.27
• Windows DISKS 1.3.6.1.2.1.25.2.3.1.3
• Windows SERVICES 1.3.6.1.4.1.77.1.2.3.1.1
• Windows LISTENING TCP PORTS 1.3.6.1.2.1.6.13.1.3.0.0.0.0
• Windows LISTENING UDP PORTS 1.3.6.1.2.1.7.5.1.2.0.0.0.0

41. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Linux RUNNING PROCESSES 1.3.6.1.2.1.25.4.2.1.2
• Linux SYSTEM INFO 1.3.6.1.2.1.1.1
• Linux HOSTNAME 1.3.6.1.2.1.1.5
• Linux UPTIME 1.3.6.1.2.1.1.3
• Linux MOUNTPOINTS 1.3.6.1.2.1.25.2.3.1.3
• Linux RUNNING SOFTWARE PATHS 1.3.6.1.2.1.25.4.2.1.4
• Linux LISTENING UDP PORTS 1.3.6.1.2.1.7.5.1.2.0.0.0.0
• Linux LISTENING TCP PORTS 1.3.6.1.2.1.6.13.1.3.0.0.0.0

42. SHODAN QUERIES OF AWESOMENESS
What sort of info do I get with SNMP ?
• Cisco LAST TERMINAL USERS 1.3.6.1.4.1.9.9.43.1.1.6.1.8
• Cisco INTERFACES 1.3.6.1.2.1.2.2.1.2
• Cisco SYSTEM INFO 1.3.6.1.2.1.1.1
• Cisco HOSTNAME 1.3.6.1.2.1.1.5
• Cisco SNMPcommunities 1.3.6.1.6.3.12.1.3.1.4
• Cisco UPTIME 1.3.6.1.2.1.1.3
• Cisco IP ADDRESSES 1.3.6.1.2.1.4.20.1.1
• Cisco INTERFACE DESCRIPTIONS 1.3.6.1.2.1.31.1.1.1.18
• Cisco HARDWARE 1.3.6.1.2.1.47.1.1.1.1.2
• Cisco TACACS SERVER 1.3.6.1.4.1.9.2.1.5
• Cisco LOGMESSAGES 1.3.6.1.4.1.9.9.41.1.2.3.1.5
• Cisco PROCESSES 1.3.6.1.4.1.9.9.109.1.2.1.1.2
• Cisco SNMP TRAP SERVER 1.3.6.1.6.3.12.1.2.1.7

43. SHODAN QUERIES OF AWESOMENESS

44. SHODAN QUERIES OF AWESOMENESS
cisco country:PT
Worldwide
Portugal

45. SHODAN QUERIES OF AWESOMENESS
cisco country:PT

46. Cisco

47. Cisco – GRE TUNNELING

48. SHODAN QUERIES OF AWESOMENESS
port:1900 country:PT
Worldwide
Portugal

49. SHODAN QUERIES OF AWESOMENESS
So, What is UPNP?

50. SHODAN QUERIES OF AWESOMENESS
So, What uses UPNP?

51. SHODAN QUERIES OF AWESOMENESS
Hackz

52. SHODAN QUERIES OF AWESOMENESS
Hackz

53. SHODAN QUERIES OF AWESOMENESS
UPNP zomg time

54. SHODAN QUERIES OF AWESOMENESS
UPNP Remote command execution

55. SHODAN QUERIES OF AWESOMENESS
Oh and by the way…

56. SHODAN QUERIES OF AWESOMENESS
Another funny thing about UPNP, is
that you can get the MAC ADDR and
SSID its using
And then….

57. SHODAN (MORE INTERESTING) QUERIES
SCADA
• http://www.shodanhq.com/?q=PLC
• http://www.shodanhq.com/?q=allen+bradley
• http://www.shodanhq.com/?q=fanuc
• http://www.shodanhq.com/?q=Rockwell
• http://www.shodanhq.com/?q=Cimplicity
• http://www.shodanhq.com/?q=Omron
• http://www.shodanhq.com/?q=Novatech
• http://www.shodanhq.com/?q=Citect
• http://www.shodanhq.com/?q=RTU
• http://www.shodanhq.com/?q=Modbus+Bridge
• http://www.shodanhq.com/?q=modicon
• http://www.shodanhq.com/?q=bacnet
• http://www.shodanhq.com/?q=telemetry+gateway
• http://www.shodanhq.com/?q=SIMATIC
• http://www.shodanhq.com/?q=hmi
• http://www.shodanhq.com/?q=siemens+-...er+-Subscriber
• http://www.shodanhq.com/?q=scada+RTS
• http://www.shodanhq.com/?q=SCHNEIDER

58. SHODAN (MORE INTERESTING) QUERIES
SCADA
PORTUGAL?

59. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

60. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

61. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

62. SHODAN (MORE INTERESTING) QUERIES
SCADA Portugal

63. A little tip…
If you want to quickly check for
stuff (web related) that has no
authentication, use NMAP!

64. A little tip…
First, let’s get wkhtmltoimage:
wget http://wkhtmltopdf.googlecode.com/files/wkhtmltoimage-0.11.0_rc1-static-
i386.tar.bz2
tar -jxvf wkhtmltoimage-0.11.0_rc1-static-i386.tar.bz2
cp wkhtmltoimage-i386 /usr/local/bin/
Next, let’s get and install the Nmap module:
git clone git://github.com/SpiderLabs/Nmap-Tools.git
cd Nmap-Tools/NSE/
cp http-screenshot.nse /usr/local/share/nmap/scripts/
nmap --script-updatedb

65. A little tip…
Then, do your shodan search and use:
This automatically exports a list of ips
u can import into nmap

66. A little tip…
Then…

67. A little tip…
And nmap, will automatically take
screen shots of the first pages that
appear and store them, then u just
need to look at those!

68. To end…

69. SCARY SHIT!
DEFACE 1 SCARY?
NO!

70. SCARY SHIT!
DEFACE 2 SCARY?
Well… disturbing, scary? Not so much!

71. SCARY SHIT!

72. SCARY SHIT!

73. SCARY SHIT!

74. Shodan – the bad part
• Imports nmap scans from their
servers, so its not always 100%
updated! Confirmed this by
correlating some of the shodan
results with our personal results!
• For example on mysql servers,
Shodan would find 785, where our
results showed 3000+

75. Shodan – the good part
• Good querying system
• If port scanning is illegal in your
country, you’re out of trouble if
u use shodan, because ur just
querying data acquired by them.

76. Kudos
GF
Aaron @f1nux
Luis Grangeia

77. Resources
http://secanalysis.com/interesting-shodan-searches/
blog.spiderlabs.com/2012/06/using-nmap-to-screenshot-web-
services.html
http://www.youtube.com/watch?v=LPgZU7ZNIjQ - Defcon 18 2010
SHODAN for Penetration Testers Michael Schearer

78. 50% discount for
students and AP2SI
peeps