Close

Page 1 of 2 12 LastLast
Results 1 to 10 of 15
  1. #1
    s3my0n's Avatar
    s3my0n is offline #!/usr/bin/env s3my0n
    Join Date
    Sep 2009
    Location
    /home/s3my0n/
    Posts
    841
    Blog Entries
    3
    Rep Power
    13

    New search engine: heaven for skiddies?

    There's a new search called SHODAN, which can look for servers, routers and printers using your search query, and get their response banners.

    This is what you can search for:

    • country:2-letter country code
    • hostname:full or partial host name
    • net:IP range using CIDR notation (ex: 18.7.7.0/24 )
    • port:21, 22, 23 or 80

    As you can see, anyone can easily find vulnerable hosts just by looking through all the banner responses which the searched sites output. This is really dangerous as many skiddies would just scan hosts anonymously day and night looking for a particular version of apache/ftpd/ssh whatever to exploit.

    So what do you think?

    Code:
    http://shodan.surtri.com/
    In view of such harmony in the cosmos which I, with my limited human mind, am able to recognise, there are yet people who say there is no God. But what makes me really angry is that they quote me for support of such views.
    Albert Einstein

  2. #2
    MaXe's Avatar
    MaXe is offline Founder of InterN0T
    Join Date
    Jun 2008
    Location
    Australia
    Posts
    4,316
    Blog Entries
    38
    Rep Power
    10

    Re: New search engine: heaven for skiddies?

    That's pretty cool, I like it even though I hope script kiddies are not going to abuse it :-)

    It can be used for ethical penetration tests as well but then there's usually better methods
    of achieving the same results with Google Dorks (if shodan doesn't use google).


  3. #3
    s3my0n's Avatar
    s3my0n is offline #!/usr/bin/env s3my0n
    Join Date
    Sep 2009
    Location
    /home/s3my0n/
    Posts
    841
    Blog Entries
    3
    Rep Power
    13

    Re: New search engine: heaven for skiddies?

    Quote Originally Posted by MaXe View Post
    That's pretty cool, I like it even though I hope script kiddies are not going to abuse it :-)

    It can be used for ethical penetration tests as well but then there's usually better methods
    of achieving the same results with Google Dorks (if shodan doesn't use google).
    Ha, better methods with google dorks? No way, shodan can scan ports, but can google say scan port 21? 22? 23? no.
    In view of such harmony in the cosmos which I, with my limited human mind, am able to recognise, there are yet people who say there is no God. But what makes me really angry is that they quote me for support of such views.
    Albert Einstein

  4. #4
    MaXe's Avatar
    MaXe is offline Founder of InterN0T
    Join Date
    Jun 2008
    Location
    Australia
    Posts
    4,316
    Blog Entries
    38
    Rep Power
    10

    Re: New search engine: heaven for skiddies?

    Google doesn't scan ports, correct but NMAP does and Shodan hasn't indexed everything :-)

    With Google Dorks it is possible to find subdomains which One can scan in NMAP afterwards ;-)


  5. #5
    s3my0n's Avatar
    s3my0n is offline #!/usr/bin/env s3my0n
    Join Date
    Sep 2009
    Location
    /home/s3my0n/
    Posts
    841
    Blog Entries
    3
    Rep Power
    13

    Re: New search engine: heaven for skiddies?

    Quote Originally Posted by MaXe View Post
    Google doesn't scan ports, correct but NMAP does and Shodan hasn't indexed everything :-)

    With Google Dorks it is possible to find subdomains which One can scan in NMAP afterwards ;-)
    Yeah, but nmap scans are not anonymous, even with SYN scans now days, so for anonymity AND banner grabbing nmap + google loses xD
    In view of such harmony in the cosmos which I, with my limited human mind, am able to recognise, there are yet people who say there is no God. But what makes me really angry is that they quote me for support of such views.
    Albert Einstein

  6. #6
    MaXe's Avatar
    MaXe is offline Founder of InterN0T
    Join Date
    Jun 2008
    Location
    Australia
    Posts
    4,316
    Blog Entries
    38
    Rep Power
    10

    Re: New search engine: heaven for skiddies?

    That's right but it's not that many that runs full logging on all connections or checks those if they do.

    If a company runs an IDS then the timing option along with other options in NMAP can prevent detection as well.

    But with Shodan you can become truly "invisible", the only problem is if the service
    becomes updated right after it has been added to the Shodan search engine database.


  7. #7
    Tsukasa's Avatar
    Tsukasa is offline -=Ninja Pirate=-
    Join Date
    Jun 2008
    Location
    ::1
    Posts
    489
    Rep Power
    14

    Re: New search engine: heaven for skiddies?

    Interesting site and ya know skids will abuse it, its in their code ethics. Click a few buttons = ir hacker xD
    "...a computer is a stupid machine with the ability to do incredibly
    smart things, while computer programmers are smart people with the
    ability to do incredibly stupid things. They are, in short, a perfect
    match".

  8. #8
    s3my0n's Avatar
    s3my0n is offline #!/usr/bin/env s3my0n
    Join Date
    Sep 2009
    Location
    /home/s3my0n/
    Posts
    841
    Blog Entries
    3
    Rep Power
    13

    Re: New search engine: heaven for skiddies?

    Hmm, I think the site reloads the servers which it found everytime somebody searches, otherwise yeah, the database would be out of date pretty quickly, they should have faq page xD
    In view of such harmony in the cosmos which I, with my limited human mind, am able to recognise, there are yet people who say there is no God. But what makes me really angry is that they quote me for support of such views.
    Albert Einstein

  9. #9
    Join Date
    Feb 2010
    Posts
    20
    Rep Power
    9

    Re: New search engine: heaven for skiddies?

    this link now redirects to google now...........
    Is there another similar website ??

  10. #10
    MaXe's Avatar
    MaXe is offline Founder of InterN0T
    Join Date
    Jun 2008
    Location
    Australia
    Posts
    4,316
    Blog Entries
    38
    Rep Power
    10

    Re: New search engine: heaven for skiddies?

    It works 100% fine for me. Use OpenDNS instead of using the DNS server
    that your ISP forces you to use by default. This will prevent your ISP from
    blocking a lot of sites which they tend to do and it isn't surprising that Shodan
    might be blocked at one or more ISP's already.

    If you don't know how to use it, then you're lucky just watch this video:
    InterN0T - Underground Security Training - Cinema


Page 1 of 2 12 LastLast

LinkBacks (?)

  1. 1st April 2013, 16:22

Similar Threads

  1. In search of Wisdom
    By EVS in forum Introductions
    Replies: 2
    Last Post: 27th May 2010, 11:44
  2. Kernel Hook Bypassing Engine (bypass the most AV)
    By Erratum in forum Offensive Guides & Information
    Replies: 1
    Last Post: 11th May 2010, 10:38
  3. [PAPER] Hacking the Skiddies
    By MaXe in forum Offensive Guides & Information
    Replies: 5
    Last Post: 1st February 2010, 14:56
  4. Vulnerable Search Engine
    By HybriD in forum Offensive Guides & Information
    Replies: 6
    Last Post: 8th October 2008, 20:41

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •