SlideShare a Scribd company logo
1 of 53
Download to read offline
第一次使用shodan.io就上手
Tony	Lin
@TDOH	Conf 2016	(12.07)
自我介紹
交作業大學 電機系
業餘資安愛好者
Data Science for IoT
shodan.io是做什麼的?
給 黑客 玩耍的大平台 / 搜尋引擎
全名 Sentient Hyper-Optimized Data Access Network
2009年上線,掃描網路世界,爬取Banner
搜尋所有連接到網路上的裝置
攝影機、VoIP、電冰箱、風力發電廠…
用途一: 滲透測試 / 安全研究
1. Reconnaissance(偵查)
2. Scanning (掃描)
3. Gaining Access
4. Maintaining Access
5. Clearing Track
6. Reporting
自由軟體鑄造場_20121202_網路安全測試實務_翁浩正(Allen Own)
用途二: 市場調查
Apache vs Nginx在日本的市佔率?
某漏洞會影響世界上多少台機器?
有多少比例的人在管理後台使用預設帳密?
在紐約有多少台FTP允許匿名登入?
…
登入帳號,使用進階filter
創一個暫時的email帳號來註冊shodan
10分鐘信箱 https://10minutemail.com/
在Explore可以找到一些熱門分類
Shodan Filters
• net: 搜尋特定IP網段
• net:140.113.0.0/16
• country: 國家代碼
• country:TW
• city: 城市
• city:Taipei
• port:
• port:3389
• os: 作業系統
• os:"Windows XP"
• hostname: 網域
• hostname:edu.tw
• org: 網路供應商(ISPs)
• org:"Taiwan Academic Network"
• product: 產品/軟體
• product:mongodb
• version: 版本
• version:2.2.22
搜尋範例
1. 在TANet內開遠端桌面連線的機器
port:3389 org:"Taiwan Academic Network" has_screenshot:True
2.在北京開MongoDB的機器
product:MongoDB city:beijing
3. 在Windows XP開Apache的機器
apache os:"Windows XP"
產生Report
這邊要等一、兩小時
淺談SCADA系統
• 全名Supervisory Control And Data Acquisition
• 資料採集與監控系統(廢水處理場、機場捷運中控)
分散式控制系統
• Distributed Control Systems
可編程邏輯控制器
• Programmable Logic Controllers
• RTU 遠程終端控制系統
• Remote Terminal Units
• HMI 人機介面
• Human-Machine Interfaces
長得大概像這樣
ICS (Industrial Control System)
~=
SCADA (Supervisory Control And Data Acquisition)
~=
DCS (Distributed Control System)
風力發電機
title:"xzeres wind"
法國施耐德電機
Schneider port:"80"
居然只能用IE開,這樣要我們怎麼教小孩?
一、丟廠商英文名字去找
Schneider / Siemens / Advantech
二、先把預設帳密試一輪
https://github.com/scadastrangelove/SCADAPASS
介紹Google Hacking
https://www.exploit-db.com/google-hacking-database/
透過Google搜尋引擎
搜尋各種敏感資訊 / 錯誤頁面 / 潛在弱點
https://pentest-tools.com/information-gathering/google-hacking#
Google Hacking 常用 Operators
• site: 搜尋特定Domain / IP
• site:140.113.*.*
• filetype/ext: 特定檔案格式
• ext:doc | ext:docx | ext:ppt | ext:pdf
• Intitle: 標題含有特定字串
• intitle:index.of
• Intext: 文本含有特定內容
• intext:"sql syntax near"
• - 去除不想看到的內容
• -mirror
https://www.sans.org/security-resources/GoogleCheatSheet.pdf
Directory listing vulnerabilities
Publicly exposed documents
Shodan vs Google
https://www.exploit-db.com/docs/33859.pdf
更多Shodan?
Map & Image
Exploits
CLI
> pip install shodan
> shodan init <API Key>
> shodan count microsoft iis 6.0
> shodan download ms-data microsoft iis 6.0
> shodan parse --fields ip_str,port,org --separator , ms-
data.json.gz
https://github.com/achillean/shodan-python
Chrome & Firefox Plugin
速度太慢,不是很推
Maltego Add-On
https://maltego.shodan.io/
營利模式
Export Credit: $5 / 10,000 results
一次買斷會員:$49
黑色星期五特價 $5
開發者API Plan:$19 / 月
ScanHub: $9 / 月
Shodan最近太不穩了
請容許我以圖片DEMO…
1. J牌攝影機
搜尋到的裝置:41k
預設帳密 admin / <blank>
Bypass login
內建Shell
2. A牌攝影機
搜尋到的裝置:155k+
預設帳密:admin/admin
約有60%的裝置採用預設帳密 (59/100)
透過curl把config檔打包帶回家
curl --cookie 'Cookie:SSID=YWRtaW46YWRtaW4=' -o system.txt http://<IP>/cgi-
bin/supervisor/System.cgi?action=download&filename=System.bin
https://gist.github.com/tnlin/24916131d0038a91cbafa021ec936d16
3. RTSP (H牌攝影機)
rtsp://<IP>/<Path>
Thank You

More Related Content

What's hot

Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]
Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]
Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]Mumbai B.Sc.IT Study
 
The Future of Security: How Artificial Intelligence Will Impact Us
The Future of Security: How Artificial Intelligence Will Impact UsThe Future of Security: How Artificial Intelligence Will Impact Us
The Future of Security: How Artificial Intelligence Will Impact UsPECB
 
Lessons learned from the SingHealth Data Breach COI Report
Lessons learned from the SingHealth Data Breach COI ReportLessons learned from the SingHealth Data Breach COI Report
Lessons learned from the SingHealth Data Breach COI ReportBenjamin Ang
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)phexcom1
 
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasuresJorge Sebastiao
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligenceseadeloitte
 
Shodan- That Device Search Engine
Shodan- That Device Search EngineShodan- That Device Search Engine
Shodan- That Device Search EngineInMobi Technology
 
Introduction to the ethics of machine learning
Introduction to the ethics of machine learningIntroduction to the ethics of machine learning
Introduction to the ethics of machine learningDaniel Wilson
 
Cyber security for an organization
Cyber security for an organizationCyber security for an organization
Cyber security for an organizationTejas Wasule
 
Cybercrime and its effects on personal life who uses internet
Cybercrime and its effects on personal life who uses internet Cybercrime and its effects on personal life who uses internet
Cybercrime and its effects on personal life who uses internet vimal kumar arora
 
Deception technology for advanced detection
Deception technology for advanced detectionDeception technology for advanced detection
Deception technology for advanced detectionJisc
 
Security operations center 5 security controls
 Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controlsAlienVault
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligencemohamed nasri
 
CYBER-CRIME PRESENTATION.ppt
CYBER-CRIME PRESENTATION.pptCYBER-CRIME PRESENTATION.ppt
CYBER-CRIME PRESENTATION.pptPraveen362297
 
Social media and Security: How to Ensure Safe Social Networking
Social media and Security: How to Ensure Safe Social NetworkingSocial media and Security: How to Ensure Safe Social Networking
Social media and Security: How to Ensure Safe Social NetworkingIshfaq Majid
 
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)Priyanka Aash
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Amrit Chhetri
 

What's hot (20)

Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]
Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]
Enterprise Java (Question Paper) [October – 2018 | Choice Based Syllabus]
 
The Future of Security: How Artificial Intelligence Will Impact Us
The Future of Security: How Artificial Intelligence Will Impact UsThe Future of Security: How Artificial Intelligence Will Impact Us
The Future of Security: How Artificial Intelligence Will Impact Us
 
Lessons learned from the SingHealth Data Breach COI Report
Lessons learned from the SingHealth Data Breach COI ReportLessons learned from the SingHealth Data Breach COI Report
Lessons learned from the SingHealth Data Breach COI Report
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)
 
Email phishing and countermeasures
Email phishing and countermeasuresEmail phishing and countermeasures
Email phishing and countermeasures
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
Shodan- That Device Search Engine
Shodan- That Device Search EngineShodan- That Device Search Engine
Shodan- That Device Search Engine
 
Implementing Ethics in AI
Implementing Ethics in AIImplementing Ethics in AI
Implementing Ethics in AI
 
Incident response
Incident responseIncident response
Incident response
 
Introduction to the ethics of machine learning
Introduction to the ethics of machine learningIntroduction to the ethics of machine learning
Introduction to the ethics of machine learning
 
malware analysis
malware  analysismalware  analysis
malware analysis
 
Cyber security for an organization
Cyber security for an organizationCyber security for an organization
Cyber security for an organization
 
Cybercrime and its effects on personal life who uses internet
Cybercrime and its effects on personal life who uses internet Cybercrime and its effects on personal life who uses internet
Cybercrime and its effects on personal life who uses internet
 
Deception technology for advanced detection
Deception technology for advanced detectionDeception technology for advanced detection
Deception technology for advanced detection
 
Security operations center 5 security controls
 Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
CYBER-CRIME PRESENTATION.ppt
CYBER-CRIME PRESENTATION.pptCYBER-CRIME PRESENTATION.ppt
CYBER-CRIME PRESENTATION.ppt
 
Social media and Security: How to Ensure Safe Social Networking
Social media and Security: How to Ensure Safe Social NetworkingSocial media and Security: How to Ensure Safe Social Networking
Social media and Security: How to Ensure Safe Social Networking
 
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
Security Strategy and Tactic with Cyber Threat Intelligence (CTI)
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021
 

Similar to 第一次使用Shodan.io就上手

A DIY Botnet Tracking System
A DIY Botnet Tracking SystemA DIY Botnet Tracking System
A DIY Botnet Tracking Systemlog0
 
11/14王團研究室—安全大師王團論毒 in台中
11/14王團研究室—安全大師王團論毒 in台中11/14王團研究室—安全大師王團論毒 in台中
11/14王團研究室—安全大師王團論毒 in台中T客邦
 
22
2222
2242qu
 
物聯網與工業4.0情境分析
物聯網與工業4.0情境分析物聯網與工業4.0情境分析
物聯網與工業4.0情境分析Kenny Huang Ph.D.
 
物聯網應用全貌以及微軟全球案例
物聯網應用全貌以及微軟全球案例物聯網應用全貌以及微軟全球案例
物聯網應用全貌以及微軟全球案例Herman Wu
 
Iot 自動販賣機
Iot 自動販賣機Iot 自動販賣機
Iot 自動販賣機艾鍗科技
 
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢T客邦
 
電腦鑑識程序之研究
電腦鑑識程序之研究電腦鑑識程序之研究
電腦鑑識程序之研究guestce8b9
 
Rsa2012 下一代安全的战略思考-绿盟科技赵粮
Rsa2012 下一代安全的战略思考-绿盟科技赵粮Rsa2012 下一代安全的战略思考-绿盟科技赵粮
Rsa2012 下一代安全的战略思考-绿盟科技赵粮NSFOCUS
 
20111104 apt攻击案例分享 glacier
20111104 apt攻击案例分享 glacier20111104 apt攻击案例分享 glacier
20111104 apt攻击案例分享 glacierdrewz lin
 
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)William Liang
 
云安全的意义
云安全的意义云安全的意义
云安全的意义drewz lin
 
A Concept of Network Analysis Tool by Data Mining
A Concept of Network Analysis Tool by Data MiningA Concept of Network Analysis Tool by Data Mining
A Concept of Network Analysis Tool by Data MiningJhang Raymond
 
Open Hardware/IoT物聯網軟硬整合
Open Hardware/IoT物聯網軟硬整合Open Hardware/IoT物聯網軟硬整合
Open Hardware/IoT物聯網軟硬整合hackntu
 
Iot安全问题分析
Iot安全问题分析Iot安全问题分析
Iot安全问题分析Bei Li
 
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇Dennis. Lee
 
雲端行動商務發展趨勢 V1.2
雲端行動商務發展趨勢 V1.2雲端行動商務發展趨勢 V1.2
雲端行動商務發展趨勢 V1.2yaohung
 

Similar to 第一次使用Shodan.io就上手 (20)

A DIY Botnet Tracking System
A DIY Botnet Tracking SystemA DIY Botnet Tracking System
A DIY Botnet Tracking System
 
11/14王團研究室—安全大師王團論毒 in台中
11/14王團研究室—安全大師王團論毒 in台中11/14王團研究室—安全大師王團論毒 in台中
11/14王團研究室—安全大師王團論毒 in台中
 
22
2222
22
 
物聯網與工業4.0情境分析
物聯網與工業4.0情境分析物聯網與工業4.0情境分析
物聯網與工業4.0情境分析
 
物聯網應用全貌以及微軟全球案例
物聯網應用全貌以及微軟全球案例物聯網應用全貌以及微軟全球案例
物聯網應用全貌以及微軟全球案例
 
Iot 自動販賣機
Iot 自動販賣機Iot 自動販賣機
Iot 自動販賣機
 
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢
11/21王團研究室—火線殺毒完全攻略—菁英課程:2010防毒新趨勢
 
電腦鑑識程序之研究
電腦鑑識程序之研究電腦鑑識程序之研究
電腦鑑識程序之研究
 
Rsa2012 下一代安全的战略思考-绿盟科技赵粮
Rsa2012 下一代安全的战略思考-绿盟科技赵粮Rsa2012 下一代安全的战略思考-绿盟科技赵粮
Rsa2012 下一代安全的战略思考-绿盟科技赵粮
 
20111104 apt攻击案例分享 glacier
20111104 apt攻击案例分享 glacier20111104 apt攻击案例分享 glacier
20111104 apt攻击案例分享 glacier
 
Emc keynote 1130 1200
Emc keynote 1130 1200Emc keynote 1130 1200
Emc keynote 1130 1200
 
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)
行動終端、物聯網與雲端平台在高速移動網路下的整合趨勢 (for MOPCON 2016)
 
AIoT智慧家庭系統
AIoT智慧家庭系統AIoT智慧家庭系統
AIoT智慧家庭系統
 
云安全的意义
云安全的意义云安全的意义
云安全的意义
 
A Concept of Network Analysis Tool by Data Mining
A Concept of Network Analysis Tool by Data MiningA Concept of Network Analysis Tool by Data Mining
A Concept of Network Analysis Tool by Data Mining
 
Mccc lab
Mccc labMccc lab
Mccc lab
 
Open Hardware/IoT物聯網軟硬整合
Open Hardware/IoT物聯網軟硬整合Open Hardware/IoT物聯網軟硬整合
Open Hardware/IoT物聯網軟硬整合
 
Iot安全问题分析
Iot安全问题分析Iot安全问题分析
Iot安全问题分析
 
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇
HKPC 行業專題培訓講座 , 雲計算 ~ 在零售業 (III) 產業鏈篇
 
雲端行動商務發展趨勢 V1.2
雲端行動商務發展趨勢 V1.2雲端行動商務發展趨勢 V1.2
雲端行動商務發展趨勢 V1.2
 

第一次使用Shodan.io就上手