University:
Boston University
Course:
GRS CS 910 | Directed Study: Systems
Academic year:

2020
Views:

27

Pages:

19
Author:

musicfever07ws6u

OUTSIDE LOOKING IN: USING SHODAN FOR VULNERABILITY SCANNING VULNERABILITY SCANNING DEFINITION Assessment of computers, systems, networks, and/or applications for weaknesses than can be exploited by unauthorized persons and potentially result in loss of confidentiality, integrity, and/or availability. REASONS TO DO VULNERABILITY SCANS Monitor compliance Determine where to focus your resources Quantify risk to the organization Identify vulnerable components of your network Resource planning COMMON SCANNING TOOLS NMap Nessus Qualys (variety of free tools, limited) censys.io Shodan Others (consult your local search engine) A BIT ABOUT SHODAN Search engine of Internet connected devices Created by John Matherly Launched in 2009 https://www.shodan.io A BIT MORE ABOUT SHODAN Free (as in beer) or inexpensive Simple to use Web U/I Command line tool DuckDuckGo !bang syntax (!shodan) API Enterprise accounts available SHODAN'S ADVANTAGES Fast Objective Free or inexpensive SPEED Scanning takes time Sequential scanning can fail Long TTL o en required OBJECTIVE No inside knowledge Uniform scanning technique No organizational bias No inadvertent whitelisting Random, non-incremental scanning FREE OR INEXPENSIVE Free unfiltered searches without account Free filtered searches with account Reports and API with paid account ($49 one time) Enterprise accounts start at $19/mo DATA RETURNED BY SHODAN Banner text Operating system Services running Versions Roughly equivalent to curl command: curl -I / 'http:/example.com' SPOTTING VULNERABILITIES Out of support versions Out of date packages Open ports (where none are expected) Unusual subnets Vendor default pages (mostly IoT but also printers, etc) ANY QUESTIONS/COMMENTS SO FAR? INTERNAL VS. EXTERNAL SCANS Internal scans originate from a privileged host or vlan (i.e. inside the firewall). External scans originate from the Internet (i.e. outside the firewall). UNAUTHENTICATED VS. AUTHENTICATED SCANS Unauthenticated - no response to auth requests. Authenticated - responds with valid credentials. CONSTRUCTING AN EXTERNAL UNAUTHENTICATED SCAN Consider where your assets are State the null hypothesis Scan to disprove the null hypothesis Run scan from an external IP against your net STATING THE NULL HYPOTHESIS A null hypothesis is a hypothesis that a researcher tries to disprove (e.g. "There are no webservers running in given subnet"). TRY DISPROVING THE NULL HYPOTHESIS for ((i=0;i<=255;i++)); do curl -I -k -X GET 192.0.2."${i}":80; done NINE HOURS LATER... It took an average of 2:06 to complete the curl request for each address in the /24 IP range of the query. 126 sec * 254 IP addresses = 32,004 seconds 32,004 / 60 = 533 minutes 533 / 60 = 9 hours