Shodan Tutorial: Finding & Exploring Network Vulnerabilities

Shodan reveals worldwide device vulnerabilities, enabling users to identify and assess potential security risks.

### Shodan Search Engine: Unveiling Global Network Vulnerabilities
* 🗺️  The video introduces Shodan, a search engine revealing global network vulnerabilities.
* 👍  The presenter, having lifetime access to Shodan, demonstrates its functionality for ethical hacking purposes, emphasizing responsible use.
* 💻  Shodan's dashboard displays connected devices and their communication, highlighting network security and cyber risks, particularly concerning open ports.
* 🔎  A search for port **3389** (Remote Desktop Protocol) reveals **6796** results, showcasing potential vulnerabilities.
* 🇺🇸  Focusing on the United States, the search highlights numerous devices with open port 3389, including instances from major companies like Amazon and Google.
* ⚠️  Accessing detailed information on a vulnerable device reveals open ports (e.g., 22 and 3389) and associated **CVEs (Common Vulnerabilities and Exposures)**.
* 🔗  The video demonstrates using the CVE website (cve.mitre.org) to research specific vulnerabilities, providing details on attack types and affected systems, including an example of a vulnerable Windows XP machine.
* 💲  Shodan's pricing ranges from **$69/month** for individual use to over **$1000/month** for corporate plans; the presenter obtained lifetime access through a past promotion.

Hey guys, I know it's Cupcake here, bringing another video on information technology. I hope you're having a good

day, happy Saturday! And today I want to go over, um, a product called Shodan. Obviously, if you're new to my channel, you know

what to do: rate, comment, subscribe, give me a thumbs up—greatly appreciate it! So today I want to go over a product called

Shodan, and Shodan allows you to basically look at vulnerabilities around the world. Um, just to make it simple, in a nutshell,

um, I do want to go over this a little bit with you and show you how it works. I

actually got a member—a lifetime access—um, it was on special at some point, like I think last year, 2022, so I took

advantage of that and I have access to do whatever I want, pretty much, on it. But obviously, for

um, legal purposes, you know, ethical hacking—you know, don't do anything crazy. I don't want you getting in trouble. I

just want to show you how this product works, and that's it. Okay, let me share my screen. All right, so Shodan.

So here is the website, or here is, I guess, the dashboard. Shodan.io—dashboard. And you can see

there's this pricing right here. You can see what Shodan is. It tells you, in a nutshell, you click on it, it will

tell you what it is. Um, it's only like devices are connected. Um, you see the different devices here

are connected and stuff like that, and how they talk to each other. Network security, cyber risk—it just basically tells

you what things are open, when things are not open. This is what—this is where I talk about like ports and

understanding how ports work and stuff like that, because you need to make sure that your ports are protected. Right, at the end of the

One day you don't want someone getting into your system randomly, whether it's a surveillance camera, a computer, or a

laptop. If that makes sense, right? So I'm going to click on Maps, and literally you can see all the maps

right here. And um, what I did was, because I want to know which, which uh, um, I guess,

which PCs are vulnerable to 3389. So what I'm going to do is, just give me a second,

I'm going to do 3389. I'm going to go over here. I'm going to search 3389.

Like, what are you doing? I'm searching for 3389. So that is our Remote Desktop Protocol.

Uh, basically allows you to remote into PCs and it shows you more information. So it says here that we have a total of

6796 results. If you guys don't know what that means, it's Remote Desktop Protocol. What does that mean? Basically, you go in here, you

type "Remote Desktop Connection," and you can remote in with your IP address, right? And sometimes in a LAN, right, in a

LAN, if you want access to that, you've got to go to Computer Management, uh, you've got to go to local users, you've got to go to

groups and a system called Remote Desktop Users. You've got to add them in there. And obviously, there are other ways

to get into it, which is basically you go into your PC, you right-click uh, "This PC," you hit "Properties."

Um, and you go into uh, I mean, I renamed this PC. Advanced, uh, remote, and then right there's a

lot of remote connections as computer. You select the user and add them in there. Okay? So that's basically what it

is in a nutshell, so you guys aren't confused, or you're like, "Oh, what's he talking about?" So if you click on the

Blue icon right here; it will give you more information on this. And I want to go—I want to go based on the United States. See if you could break it down to different countries here, which is crazy. And I'm

gonna go back. Uh, I'm gonna hit the United States because that's where I live. I live in

the United States, and I want to know which ones have vulnerabilities with 3389. Obviously, you could go and look at

the other ones, but this is 3389 specifically. Three three eight nine. And for some reason, Amazon

Technology is coming up. I don't know why amazon.com is coming up. Google LLC is coming up. I'm gonna hit 'More'.

Uh, let's just see what's going on over here. There's a bunch of them. Oh my goodness! All right.

So this will give you a rough idea of the different IP addresses and the different computers that have

vulnerabilities, basically. Um, I went ahead—more over here—uh, is New York here? New York is not here.

Interested in there. Okay, I see one here. Okay, cool. So here you click on this little arrow key, and it'll give you more information.

It looks like it doesn't work. Click over here. Oh, here we go. There we go. So it tells you they have open ports now.

Open ports 22, 22 yeah, and 3389, um, which is not good. And it gives you more—more uh—

more information about the CVE—um, so cyber vulnerability exploitation expert. I can't

pronounce it, but I'll go look for CVE. CBE. So you guys know what that is: C-V-E.

Security. Um, yeah, sorry. It's Common Vulnerabilities and Exposures.  Me? I'm—uh—I need more coffee.

Today, but yeah, basically it's this website. So if you guys don't know about this website, it's called

cve.mitre.org, and basically you can go in here and basically you get information about different common

attacks. So you could put your, you could put CVE record right here, uh, all CVEs on the website, and it increases; there's a

different website, and it tells you information about the website. Um, and basically you have information here on things that have happened in the past,

is, and actually when I, when I actually did tryhackme, I actually went over this, like what is this, uh, like what, how

does this work and stuff like that. So it actually gives you, actually they moved from the website, which is kind of

interesting. Um, service now added a CVE number ring right here; uh, it tells you about that CVE issue that

they had. So here you enter the CVE, like into the CVE ID, so like I could go here and I should be able to copy and paste

this and put it in here and hit enter and then hit 'Find,' and it'll tell you what it

is. And it says, "Remotely observed behavior and authentication using open SSH through 7.8. Common remote

attacks detect existence of user on a target system with GSSAPI in use. No discovery." And that tells you here how to

how to, like what kind of attack it is, and you know, it says netmap.com, whatever. And basically what it is, so you

literally could go in here and and grab, and you just close out of that and grab um, information.

There are different types of CVE attacks if you see here, which is very interesting, and I'll go to this one, too.

I could copy this real quick, right, and I could put it in here and do 'Find,' and then just find right there, and it tells

You open SSH through 8.7, allowing remote attackers who have suspicion of certain combinations of usernames and public keys known to the SSH server. So yeah, that's basically what it is. It gives you a rough idea of what it is.

So this 3389 is an issue now. If you want to find, like, ones in our line right now, like which computers online right now have vulnerabilities, you click on images, and they'll give you a bunch

of computers that have logins that have issues with their computers, which is crazy, right, when you think

about it. Uh, there is uh, 2008 R2. I can head next, and obviously that one is

a server. That one is Server 2012 R2, which is crazy. Uh, and I could click on it. I

literally clicked on it by accident, like this one right here. There's a few other ones right here.

[Music] Um, it only has 29, 2019. Hit next. I'm trying to see if there's any... Oh, you

know what? Let's do uh, uh, Windows XP. Is there anyone who has any Windows XP machines? That'd be a very good thing to

test. Oh my goodness! Someone has Windows XP! Oh my goodness! And it looks like it's on the network. Okay, then

why are there so many people on this one? Oh my goodness, Larry! Let me see this one. So many people are logged into that one,

but I mean, go let me go to the XP one. Got me curious now as to why it's open

like that. All right, so it has 1, 2, 3, 3 and 9, 8, 8, 8, 8, 8 open

um, remote desks. Okay, Remote Desktop Protocol is open. Um, it does not give me any information; it looks like everything is blocked here.

because the information here actually, so I have some information right here. Uh, I'm gonna go here and I'm gonna... I'm

gonna use, um, uh, MXToolbox, right? And I'm gonna go here, I'm gonna do MXToolbox and I'm gonna do

a find lookup name, and it looks like there's no records here. Okay, all right, all right. So I'm gonna go back here and

this is the domain. It's just... only... I'm not gonna click on it. Um, interesting. It says "CVE: Remote code execution

probably exists, and remote desktops (formerly known as Terminal Services) connects to a target system using remote

desktop, sends a specified crafted request. Is remote desktop... yeah. So it says Terminal Services. So like if you go

into here, let me show you what the hell they're talking about. So their services here... um, obviously there's Remote Desktop

Services, um, and then there's dependencies on top of it and stuff like that. But basically, there's an issue right here, and if you

click on it, it actually gives you more information. Or if you... it's not working for some reason... let me go here then, and I'll just copy

this. All right, and I'm gonna put it in here and I'm gonna hit find. Uh, Remote Desktop. Now, those Terminal

Services were not indicator attacks. Gives you more information. Uh, it says it's affected by 7 for

32-bit, 7 64-bit. Um, the different versions are affected by it, uh, and some... some references on the

bottom. Interesting. And was this published? This was published in 2019, updated 2021. Interesting. Okay. Yeah, so I

just wanted to show you how this works. Um, if you're on a little pricing on it, and there's more information right here

obviously, but um... close out all this other stuff, right? Let me click on pricing because it's been very slow. So yeah, so $69 a month, $359

A month for small business corporate is over a thousand dollars a month. Um, I got lucky, I'll be honest with you, I got lucky

because I got the member-for-life, um, account, so I don't have to pay anything. So, and I could mess around with

this, and it's good for life for me. So I got lucky. Um, yeah, you click overview; it gives you an

overview of information. That's my email address; you guys know my email address already. Um, building, uh, just a little slow for some reason,

but this is pretty cool if you look at it and you play around. When you're like, 'I can go here and I could put like, uh,

d3a9 or 8080,' you know, check the map, and it gives you information about everything. So,

um, how's your information about this as well? Um, you can actually, you can actually do it if you have enterprise access; you

could do a bulk download. Uh, you could set up network monitoring for a specific area. Like if I click on

this, uh, I just set up networking. You put the name of it, um, you put the IP addresses that you're

looking at, instead of a monitoring system. But yeah, that's it for me. I'm gonna stop sharing.

Um, that is shown in a nutshell. I want to go over everything, but basically you could go and check

um, vulnerabilities on certain devices that are connected to the network. Uh, this is something that I, I got access to,

so like, let me just go over it real quick. Anyway, with that being said, I hope you have a good day. Take care. Peace. Bye.

IT: Getting Started With Shodan Search Engine

Kevtech IT Support

Introduction to Shodan and its capabilities

Video introduction and call to action (like, comment, subscribe).

Shodan is introduced as a tool to identify global vulnerabilities.

The presenter has lifetime access to Shodan.

Ethical hacking and legal considerations are emphasized.

The presenter shares their screen to demonstrate Shodan's interface.

Exploring Shodan's interface and features

Overview of Shodan's dashboard and pricing.

Explanation of how Shodan shows connected devices and network communication.

Demonstration of the map feature, focusing on vulnerabilities related to port 3389.

Explanation of Remote Desktop Protocol (RDP) and its security implications (port 3389).

Analysis of results showing vulnerable IP addresses and computers.

Understanding CVE (Common Vulnerabilities and Exposures)

Introduction to CVE and the website cve.mitre.org.

Explanation of how to use CVE information to understand vulnerabilities.

Connection to previous experience with tryhackme.

Example of a CVE search and interpretation of results.

Analyzing vulnerable systems using Shodan's image feature

Using Shodan's image feature to identify vulnerable computers with specific operating systems.

Observation of a system with multiple open RDP ports.

Using MXToolbox to investigate a domain name.

Presenter's experience with a lifetime membership.

Additional features such as bulk download and network monitoring are mentioned.

Concluding remarks summarizing Shodan's use for vulnerability detection.