University:
Boston University
Course:
GRS CS 910 | Directed Study: Systems
Academic year:

2024
Views:

373

Pages:

14
Author:

Brianna Sherman

OR YOU COULD DO THIS... 1. Open a web browser 2. Go to shodan.io 3. Login 4. Type the following in search box: net:192.0.2.0/24 port:80 WHAT DID WE LEARN? Nearly identical results Reasonably fresh, mostly Results are downloadable Ready for parsing Pipe to other apps NOW WHAT? Click on Download Results Choose your format (CSV, JSON, XML) Import to spreadsheet Process with Python, Perl, etc Open tickets in tracking system USE THE RESULTS TO PLAN Identify hosts with impending EOS/EOL issues Find hosts aﬀected by specific CVE net:192.0.2.0/24 vuln:CVE-20140160 Assign work to sys ad Enter work into tracking/ticketing system CONSTRUCTING QUERIES FROM JSON Use the hierarchy from the results JSON to construct new queries. Given this JSON snippet: "http": {"redirects": [], "title": "302 Found", "robots": null } Corresponding Shodan query: http.title:"302 Found" SERVICES ON NON-STANDARD PORTS Use the minus sign to exclude results. In this case, exclude the standard SMTP port. product:postfix -port:25 PARSING JSON WITH COMMAND LINE Use the command line tool to parse downloaded results. This command: shodan parse --fields ip_str,hostnames --separator , ~/shodan-export.json Returns: 192.0.2.106,i.madethisup.edu, 192.0.2.111,learning.is.gd, SEARCHING FROM THE COMMAND LINE This command line search: shodan search --fields ip_str,hostnames "product:openssh port:22 net:192.0.2.0/24" Returns a result set like this: 192.0.2.106,i.madethisup.edu, 192.0.2.111,learning.is.gd, COLLECT DATA IN REAL TIME WITH STREAMS Use streams to gather data from Shodan crawlers as it is collected. See the API docs for full details. CREATE A NETWORK ALERT Create a network alert for the desired IP range: shodan alert create "My Alert" 192.0.2.0/24 Successfully created network alert! Alert ID: HFI66IBBH0X8Z8VQ LIST ALERTS TO GET ID Obtain the alert ID: shodan alert list Alert ID Name IP/ Network HFI66IBBH0X8Z8VQ My Alert 192.0.2.0/30 SET UP THE STREAM JSON results will write to /var/lib/shodan... shodan stream --alert HFI66IBBH0X8Z8VQ --datadir /var/lib/shodan ANOTHER NEAT THING DuckDuckGo has a !bang for Shodan. If DDG is your default search engine, type the following into your search bar: !shodan net:192.0.2.0/24 port:80 YET ANOTHER NEAT THING There are Shodan browser plugins for Chrome and Firefox.