Hey, what's up, everyone? Welcome back to another video. In this video, we're going to be going over some cool stuff that we

can do with Shodan. If you guys aren't familiar with Shodan, don't worry, watch till the end and you will learn

something new. Def Con is only two or three weeks away, so just like always, if you guys see me out there, say hello. I do

have some surprises up my sleeves, so come say hi. And if you guys are new to the channel, please like, subscribe, and

share. We did hit that 100K, so I'm super, super stoked! Many more to come. Thank you

so much, and let's jump into [Music] it. All right, everyone, so Shodan. If you go out to shodan.io, you can see so many

things here. You can explore, you can download, you can go to the pricing up here, all the way up here. You can see

Shodan maps, images, monitor. So what is Shodan? Let's just go out to Google really quick and see

what Shodan is. All right, so Shodan is a world's first search engine for the Internet of Things. It's pretty much all internet

connected devices, a search engine just for that. So as a penetration tester, or as a CISO, or as a security researcher, whatever you

want to call us, what we can do with this tool is see if there's exposures to our infrastructure. For an example, let's just

do something really quick and easy, right? If we just come up here and just put google.com—I can spell Google—google.com,

right? So quickly it will respond. If my VM likes to uh, hurry up tonight… What this will do, it will give us feedback

of what services, how many results. All right, so google.com. Right? So now let's go reverse that with an IP address, so

8.8.8.8. Okay, we can see here it's Google's DNS. 53 is obviously DNS's port.

443 is HTTPS, and 53 is UDP and TCP, etc. So you can see this is pretty

interesting.  So you can, for example, put in your own company to see if it's exposed out there, to see if

there's anything lingering. So if you want to talk about, like, an adversary or a bad actor, or things we can do, say, for an

example, we just want to see cameras. So I have a cheat sheet here, so I'm going to go ahead and

just do 'title:camera'. So if we click on this, or if we search for this, we can see—I'm just going to go

into US—there's about 7,000 nodes out there. So what we can do here—I'm not going to go clicking

on anything if it doesn't pop up—but we can actually look and see different cameras out there. So

if you have an IP address, you can search for your camera's IP address in this instance and see if it's exposed

to the internet. And next we can do is—let me just do another little query—and this is a

general search for IoT devices, for webcams that have screenshots available. So we can do 'webcam

has:screenshot:true'. So what this is going to do is give us any kind of screenshots of webcams. So look—this is someone's backyard, looks like it's going to the ocean; this is someone's backyard; this is someone's computer

office; this is someone's bedroom; this is weird, but yeah, you guys get the gist. This is someone's, like, 3D printer—looks

like a 3D printer—that's outside the window. And you can see right here is the

IP address, and it's all on the public internet. So you're not doing anything malicious; it's just out there.

If you put your stuff out there on the internet, you're going to get exposed, right? So I'm just trying to see what

else we can show here. The cameras are really interesting. Let me go back here, and let's say, for example, we

want to see, uh, VoIP communication devices, right? So let's just go ahead and just do that for a second. And that's

voice over IP. So these are just little, little operators that I have as my little cheat sheet where I go and I

do, if I'm doing reconnaissance or anything like that. So if we do `device: VoIP`, we can see VoIP devices once

it actually comes up. And this will, like, do a general search for voice over IP devices. Wow, this thing is slow as hell. I

don't know if it's my VM or just my internet. I don't know, but who knows, it's

not going to be a long video. It's just going to show you—I'm just going to show

you guys some cool tricks you can use with Shodan, and you can explore yourself, right? You can use so many different

operators, and you can just do your own research. And I just wanted to display this tool, which I think is super

phenomenal, right? So New York, my city. Let's see what's going on in New York. Let's, uh, let's go to New York

City, and we'll give this a moment. All right, so we can see Polycom, we can see some Obi2000, Polycom. And if we

just open this up, it'll probably give us an IP address. And now let's go ahead and see if we can go to this IP. So this is

going to show us a, you know, a login for this. I'm not going to try to log in

because that's not my point of this video, but you can see that there's so many cool things that we can do with

This tool lets me see what else, uh, let's just go ahead and do Polycom because Polycom is pretty, uh, pretty famous, right?

So let's just do this one since we've seen Polycom. Let's go ahead and just do "title: Polycom." And with Polycom, we'll see so many things that just have to do with this, right?  Just with Polycom,

logins, uh, Polycom logins, etc. All right, so the next thing we'll do is

database searches, right? So, say for example, we want to see the basic product of MySQL. So let's just come up here; we

could do "product: MySQL," and this will search any MySQL servers that are exposed to the internet, right? And what does this mean? There are 3

million out here. That's crazy! And then you can go—you know, there's a million in the US—and you get the point. So if you

guys say, for example, we go to the US, let's just go to US, and we'll give this

a moment. All right. So say, for example, we click on here. Let's just see this IP: 50.

87.994. And you can see a whole bunch of different ports. You can see some open ports out here: pure

FTPD, um, you know, a lot of stuff: Apache, 110 POP, etc. So you guys get the gist. And

if this is your IP, obviously you would be at work. You can check your IP. And, for example, we can do 1

do Cloudflare 1.1.1.1. And if this was your, you know, if this was your IP address, you can say,

Okay, guys, do we want to have all these ports open to the world? If not, let's go ahead and close them, right? And it's

going to show you the IP, which is probably on one of your firewalls, right? So you want to make sure you can

Test that and see what's exposed to the internet, and if it is exposed to the internet, you know you don't want that.

You should close those ports. So let's see if I have any other cool things so we could do some like files and

directories as well. Let's just do that really quick. So if we do HTTP, do `tile` and then `index of /`, which is the root of a uh

directory. So let's just give this a jingle and see what uh populates. Holy moly, this thing is super

sloppy. So there's 62, 10 in a US, and you can see like Python packages and all

this cool stuff, right? You can get the gist of what I'm trying to do. So now we can look at, like, this is the fun thing I

like to do, especially if I'm, you know, if I'm doing a pen test for a client

and I want to see if any of their uh servers have legacy Windows operating systems or any any kind of legacy

operating systems. We can check that out. So say, for example, we want to do OS Windows 2012, uh

2012, right? Cuz 2012 is what, 12 years old now? I remember when I got certified in

Windows 2002 and I was like, damn, I'm the smartest kid on the block! But you

can see here like uh there's outdated servers out there. So if this is your client, you can say, hey, you know, you can

you know, let them know that 2002 is outdated. Okay? Let them know what happened there, but you guys get the

gist. Let's see what anything else... um, generic credentials. You can just do like default credentials. Let's just do that

really quick. I have that on my cheat sheet as well. You can just do a default credentials search in here and uh see

What pops up so you can see no password is set for the default user, and you know, obviously, this goes back to doing this with

permission. Obviously, I'm not condoning any—don't try to do this when you don't have permission to do it—and uh, you

know, this is another funny thing. You know, I actually did this on a penetration test, and I think I tell the story about the

uh, about the, about the printer. So this is an HP printer, and uh, this is actually from my test right here. Let me see if, if this is

still FTP—a laser printer FTP server. So let's just see if this actually comes back. But yeah, it still does. Um, this is

not my client, this is, but this is a Dell, for example—Dell B2360DN laser

printer. And you guys get the gist of what I'm saying. And obviously, you can just, you know, type in "hacked" just to see

if there's anything hacked out there. And uh, this is general, you know, anything that's been compromised and all that

stuff. So obviously, Russia, Russia, Russia. But yeah, that pretty much concludes this video. Hopefully you guys found this informative. If you have any questions or

any tricks that you want to share, throw it in the comments below. I'll see you guys in the next one. Thank you.

How To Use Shodan? Mastering Shodan.io: A Beginner's Guide to Cyber Recon - InfoSec Pat

Scripts