What is Shodan?
I was thinking about making a new post and since I was walking around Shodan looking at our systems, I said why not? Well, Shodan is a search engine like Google but a little different, we can search everything that is connected to the internet.
This is great as a tool but it is a delight for many because due to ignorance many people have devices connected to the Internet with user and pass by default that can be found in Shodan quite fast or outdated systems.
You remember the post Tuning in Google, in which we talked about GoogleDorks, well in Shodan we also have search filters that if we add it to python using the API they offer instead of web, its potential is tremendous, you also have libraries for other languages here.
In order to use the API you have to have query credits where depending on the chosen plan you can have up to unlimited queries. In the free version you have 100 query credits, each query credit gives you up to 100 results which means that you can download 10000 results every month for free.
Let's install the python library on our lab machine. If you have followed our posts it would be as simple as running
sudo pip3.7 install shodan
And with the following command we will see the help
We already have it installed but we will not be able to use it until we connect to the APi, to do this we launch
shodan init XXXXyourAPIXXXX
We are not going to expand on its use, we leave it to you to investigate. We will just show you a small example and leave you some filters.
You can find the API filters here in its web site
Some of the web filters are:
os: Filter by operating system
country: Filter by country
city: Filter by city
net: Filter by network segments
geo: Filter by specifying coordinates
hostname: Filter by hostname
port. Filter by port
With these few filters we can start playing to see the potential of Shodan.
A small example to make people aware of the danger of leaving a Windows remote desktop exposed on the Internet, since Shodan will find it and you will start to be a target for many people, due to all the vulnerabilities that Windows remote desktop suffers, having all the chances to end up with an encrypted system. It would be enough to simply put in the Shodan web search engine
And it will show you more than 35000 computers currently. As you will see if you have a computer with remote desktop exposed to the Internet, sooner or later you will get a surprise.
So far for today, but first tell you, do not do what you do not want to do to you. Have a nice weekend.