쇼단 튜토리얼: 네트워크 취약점 찾기 및 탐색하기

### 쇼단 검색 엔진: 글로벌 네트워크 취약점 공개
* 🗺 ️ 이 동영상에서는 글로벌 네트워크 취약점을 밝혀내는 검색 엔진인 Shodan을 소개합니다.
* 👍 발표자는 쇼단을 평생 이용할 수 있는 권한을 가지고 있으며, 윤리적 해킹을 위한 쇼단의 기능을 시연하며 책임감 있는 사용을 강조합니다.
* 💻 쇼단의 대시보드에는 연결된 장치와 해당 장치의 통신이 표시되며, 특히 오픈 포트와 관련된 네트워크 보안 및 사이버 위험을 강조합니다.
* 🔎 포트 3389(원격 데스크톱 프로토콜)를 검색하면 6796개의 결과가 표시되어 잠재적인 취약점이 있음을 알 수 있습니다.
* 🇺🇸 미국에 초점을 맞춘 이 검색은 Amazon 및 Google과 같은 주요 기업의 사례를 포함하여 포트 3389가 열려 있는 수많은 장치를 강조 표시합니다.
* ⚠ 취약한 디바이스의 상세 정보에 액세스하면 열린 포트(예: 22 및 3389) 및 관련 CVE(공통 취약점 및 노출)를 확인할 수 있습니다.
* 🔗 이 비디오는 CVE 웹사이트(cve.mitre.org)를 사용하여 특정 취약점을 조사하는 방법을 시연하며, 취약한 Windows XP 컴퓨터의 예를 포함하여 공격 유형과 영향을 받는 시스템에 대한 세부 정보를 제공합니다.
* 💲 쇼단의 가격은 개인용 월 69달러부터 기업용 월 1,000달러 이상까지 다양하며, 발표자는 과거 프로모션을 통해 평생 이용권을 획득했습니다.

Shodan은 전 세계 디바이스의 취약점을 공개하여 사용자가 잠재적인 보안 위험을 식별하고 평가할 수 있도록 지원합니다.

Hey guys, I know it's Cupcake here, bringing another video on information technology. I hope you're having a good

day, happy Saturday! And today I want to go over, um, a product called Shodan. Obviously, if you're new to my channel, you know

what to do: rate, comment, subscribe, give me a thumbs up—greatly appreciate it! So today I want to go over a product called

Shodan, and Shodan allows you to basically look at vulnerabilities around the world. Um, just to make it simple, in a nutshell,

um, I do want to go over this a little bit with you and show you how it works. I

actually got a member—a lifetime access—um, it was on special at some point, like I think last year, 2022, so I took

advantage of that and I have access to do whatever I want, pretty much, on it. But obviously, for

um, legal purposes, you know, ethical hacking—you know, don't do anything crazy. I don't want you getting in trouble. I

just want to show you how this product works, and that's it. Okay, let me share my screen. All right, so Shodan.

So here is the website, or here is, I guess, the dashboard. Shodan.io—dashboard. And you can see

there's this pricing right here. You can see what Shodan is. It tells you, in a nutshell, you click on it, it will

tell you what it is. Um, it's only like devices are connected. Um, you see the different devices here

are connected and stuff like that, and how they talk to each other. Network security, cyber risk—it just basically tells

you what things are open, when things are not open. This is what—this is where I talk about like ports and

understanding how ports work and stuff like that, because you need to make sure that your ports are protected. Right, at the end of the

One day you don't want someone getting into your system randomly, whether it's a surveillance camera, a computer, or a

laptop. If that makes sense, right? So I'm going to click on Maps, and literally you can see all the maps

right here. And um, what I did was, because I want to know which, which uh, um, I guess,

which PCs are vulnerable to 3389. So what I'm going to do is, just give me a second,

I'm going to do 3389. I'm going to go over here. I'm going to search 3389.

Like, what are you doing? I'm searching for 3389. So that is our Remote Desktop Protocol.

Uh, basically allows you to remote into PCs and it shows you more information. So it says here that we have a total of

6796 results. If you guys don't know what that means, it's Remote Desktop Protocol. What does that mean? Basically, you go in here, you

type "Remote Desktop Connection," and you can remote in with your IP address, right? And sometimes in a LAN, right, in a

LAN, if you want access to that, you've got to go to Computer Management, uh, you've got to go to local users, you've got to go to

groups and a system called Remote Desktop Users. You've got to add them in there. And obviously, there are other ways

to get into it, which is basically you go into your PC, you right-click uh, "This PC," you hit "Properties."

Um, and you go into uh, I mean, I renamed this PC. Advanced, uh, remote, and then right there's a

lot of remote connections as computer. You select the user and add them in there. Okay? So that's basically what it

is in a nutshell, so you guys aren't confused, or you're like, "Oh, what's he talking about?" So if you click on the

Blue icon right here; it will give you more information on this. And I want to go—I want to go based on the United States. See if you could break it down to different countries here, which is crazy. And I'm

gonna go back. Uh, I'm gonna hit the United States because that's where I live. I live in

the United States, and I want to know which ones have vulnerabilities with 3389. Obviously, you could go and look at

the other ones, but this is 3389 specifically. Three three eight nine. And for some reason, Amazon

Technology is coming up. I don't know why amazon.com is coming up. Google LLC is coming up. I'm gonna hit 'More'.

Uh, let's just see what's going on over here. There's a bunch of them. Oh my goodness! All right.

So this will give you a rough idea of the different IP addresses and the different computers that have

vulnerabilities, basically. Um, I went ahead—more over here—uh, is New York here? New York is not here.

Interested in there. Okay, I see one here. Okay, cool. So here you click on this little arrow key, and it'll give you more information.

It looks like it doesn't work. Click over here. Oh, here we go. There we go. So it tells you they have open ports now.

Open ports 22, 22 yeah, and 3389, um, which is not good. And it gives you more—more uh—

more information about the CVE—um, so cyber vulnerability exploitation expert. I can't

pronounce it, but I'll go look for CVE. CBE. So you guys know what that is: C-V-E.

Security. Um, yeah, sorry. It's Common Vulnerabilities and Exposures.  Me? I'm—uh—I need more coffee.

Today, but yeah, basically it's this website. So if you guys don't know about this website, it's called

cve.mitre.org, and basically you can go in here and basically you get information about different common

attacks. So you could put your, you could put CVE record right here, uh, all CVEs on the website, and it increases; there's a

different website, and it tells you information about the website. Um, and basically you have information here on things that have happened in the past,

is, and actually when I, when I actually did tryhackme, I actually went over this, like what is this, uh, like what, how

does this work and stuff like that. So it actually gives you, actually they moved from the website, which is kind of

interesting. Um, service now added a CVE number ring right here; uh, it tells you about that CVE issue that

they had. So here you enter the CVE, like into the CVE ID, so like I could go here and I should be able to copy and paste

this and put it in here and hit enter and then hit 'Find,' and it'll tell you what it

is. And it says, "Remotely observed behavior and authentication using open SSH through 7.8. Common remote

attacks detect existence of user on a target system with GSSAPI in use. No discovery." And that tells you here how to

how to, like what kind of attack it is, and you know, it says netmap.com, whatever. And basically what it is, so you

literally could go in here and and grab, and you just close out of that and grab um, information.

There are different types of CVE attacks if you see here, which is very interesting, and I'll go to this one, too.

I could copy this real quick, right, and I could put it in here and do 'Find,' and then just find right there, and it tells

You open SSH through 8.7, allowing remote attackers who have suspicion of certain combinations of usernames and public keys known to the SSH server. So yeah, that's basically what it is. It gives you a rough idea of what it is.

So this 3389 is an issue now. If you want to find, like, ones in our line right now, like which computers online right now have vulnerabilities, you click on images, and they'll give you a bunch

of computers that have logins that have issues with their computers, which is crazy, right, when you think

about it. Uh, there is uh, 2008 R2. I can head next, and obviously that one is

a server. That one is Server 2012 R2, which is crazy. Uh, and I could click on it. I

literally clicked on it by accident, like this one right here. There's a few other ones right here.

[Music] Um, it only has 29, 2019. Hit next. I'm trying to see if there's any... Oh, you

know what? Let's do uh, uh, Windows XP. Is there anyone who has any Windows XP machines? That'd be a very good thing to

test. Oh my goodness! Someone has Windows XP! Oh my goodness! And it looks like it's on the network. Okay, then

why are there so many people on this one? Oh my goodness, Larry! Let me see this one. So many people are logged into that one,

but I mean, go let me go to the XP one. Got me curious now as to why it's open

like that. All right, so it has 1, 2, 3, 3 and 9, 8, 8, 8, 8, 8 open

um, remote desks. Okay, Remote Desktop Protocol is open. Um, it does not give me any information; it looks like everything is blocked here.

because the information here actually, so I have some information right here. Uh, I'm gonna go here and I'm gonna... I'm

gonna use, um, uh, MXToolbox, right? And I'm gonna go here, I'm gonna do MXToolbox and I'm gonna do

a find lookup name, and it looks like there's no records here. Okay, all right, all right. So I'm gonna go back here and

this is the domain. It's just... only... I'm not gonna click on it. Um, interesting. It says "CVE: Remote code execution

probably exists, and remote desktops (formerly known as Terminal Services) connects to a target system using remote

desktop, sends a specified crafted request. Is remote desktop... yeah. So it says Terminal Services. So like if you go

into here, let me show you what the hell they're talking about. So their services here... um, obviously there's Remote Desktop

Services, um, and then there's dependencies on top of it and stuff like that. But basically, there's an issue right here, and if you

click on it, it actually gives you more information. Or if you... it's not working for some reason... let me go here then, and I'll just copy

this. All right, and I'm gonna put it in here and I'm gonna hit find. Uh, Remote Desktop. Now, those Terminal

Services were not indicator attacks. Gives you more information. Uh, it says it's affected by 7 for

32-bit, 7 64-bit. Um, the different versions are affected by it, uh, and some... some references on the

bottom. Interesting. And was this published? This was published in 2019, updated 2021. Interesting. Okay. Yeah, so I

just wanted to show you how this works. Um, if you're on a little pricing on it, and there's more information right here

obviously, but um... close out all this other stuff, right? Let me click on pricing because it's been very slow. So yeah, so $69 a month, $359

A month for small business corporate is over a thousand dollars a month. Um, I got lucky, I'll be honest with you, I got lucky

because I got the member-for-life, um, account, so I don't have to pay anything. So, and I could mess around with

this, and it's good for life for me. So I got lucky. Um, yeah, you click overview; it gives you an

overview of information. That's my email address; you guys know my email address already. Um, building, uh, just a little slow for some reason,

but this is pretty cool if you look at it and you play around. When you're like, 'I can go here and I could put like, uh,

d3a9 or 8080,' you know, check the map, and it gives you information about everything. So,

um, how's your information about this as well? Um, you can actually, you can actually do it if you have enterprise access; you

could do a bulk download. Uh, you could set up network monitoring for a specific area. Like if I click on

this, uh, I just set up networking. You put the name of it, um, you put the IP addresses that you're

looking at, instead of a monitoring system. But yeah, that's it for me. I'm gonna stop sharing.

Um, that is shown in a nutshell. I want to go over everything, but basically you could go and check

um, vulnerabilities on certain devices that are connected to the network. Uh, this is something that I, I got access to,

so like, let me just go over it real quick. Anyway, with that being said, I hope you have a good day. Take care. Peace. Bye.

IT: Getting Started With Shodan Search Engine

Kevtech IT Support

동영상 소개 및 클릭 유도 문안(좋아요, 댓글, 구독).

쇼단은 글로벌 취약점을 식별하는 도구로 도입되었습니다.

발표자는 평생 쇼단에 액세스할 수 있습니다.

윤리적 해킹과 법적 고려 사항을 강조합니다.

발표자가 쇼단의 인터페이스를 시연하기 위해 화면을 공유합니다.

Shodan의 인터페이스 및 기능 살펴보기

쇼단의 대시보드 및 요금제 개요.

쇼단이 연결된 장치와 네트워크 통신을 표시하는 방법에 대한 설명입니다.

포트 3389와 관련된 취약점을 중심으로 지도 기능을 시연합니다.

원격 데스크톱 프로토콜(RDP)과 보안에 미치는 영향(포트 3389)에 대한 설명입니다.

취약한 IP 주소와 컴퓨터를 보여주는 결과 분석.

CVE(공통 취약점 및 노출) 이해하기

CVE 및 웹사이트 cve.mitre.org 소개.

CVE 정보를 사용하여 취약점을 파악하는 방법에 대한 설명입니다.

이전 시도핵미 사용 경험에 연결합니다.

CVE 검색 및 결과 해석의 예입니다.

Shodan의 이미지 기능을 사용하여 취약한 시스템 분석하기

Shodan의 이미지 기능을 사용하여 특정 운영 체제를 사용하는 취약한 컴퓨터를 식별합니다.

Windows XP를 실행하는 시스템을 검색합니다.

여러 개의 열린 RDP 포트가 있는 시스템을 관찰합니다.

MXToolbox를 사용하여 도메인 이름을 조사합니다.

쇼단의 가격 책정 계층에 대해 논의합니다.

발표자의 평생 멤버십 사용 경험.

대량 다운로드 및 네트워크 모니터링과 같은 추가 기능이 언급되어 있습니다.

취약점 탐지에 대한 쇼단의 사용을 요약한 마무리 발언입니다.