Active

IP addresses from subdomains

for i in $(cat subdomains.txt); do dig $i | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -vE "10.*"; done

Search for all leaked keys/secrets using one regex

(?i)((access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=]{8,64})['\"]

Shodan Dorks

Webcam searches

1. title:camera – general search for anything matching the “camera” keyword.

2. webcam has_screenshot:true – a general search for any IoT device identified as a webcam that has screenshots available.

3. has_screenshot:true IP Webcam – another version of the above search, see how the results might differ?

4. server: webcampxp – webcamXP is one of the most popular and commonly encountered network camera software for Windows OS.

5. server: “webcam 7” – webcam 7 cameras; not as popular as the above type, but still they are still popular and encountered out there.

6. title:”blue iris remote view” – webcams identified as belonging to the Blue Iris webcam remote management and monitoring service.

7. title:”ui3 -“ – UI3 is a HTML5 web interface for Blue Iris mentioned above.

8. title:”Network Camera VB-M600″ – Canon manufactured megapixel security cameras.

9. product:”Yawcam webcam viewer httpd” – Yawcam stands for Yet Another WebCAM, free live streaming and webcam software.

10. title:”IPCam Client” – IPCam Client webcam devices.

11. server: GeoHttpServer – GeoVision (GeoHttpServer) Webcams, older webcam software with some had well documented vulnerabilities.

12. server: VVTK-HTTP-Server – Vivotek IP cameras.

13. title:”Avigilon” – access to the Avigilion brand camera and monitoring devices.

14. ACTi – various IP camera and video management system products.

15. WWW-Authenticate: “Merit LILIN Ent. Co., Ltd.” – a UK-based house automation / IP camera provider.

16. title:”+tm01+” – unsecured Linksys webcams, a lot of them with screenshots.

17. server: “i-Catcher Console” – another example of an IP-based CCTV system.

18. Netwave IP Camera Content-Length: 2574 – access to the Netwave make IP cameras.

19. 200 ok dvr port:”81″ – DVR CCTV cameras accessible via http.

20. WVC80N – Linksys WVC80N cameras.

Explore further by these tags:

WEBCAM: https://www.shodan.io/explore/tag/webcam

CAM: https://www.shodan.io/explore/tag/cam

CAMERA: https://www.shodan.io/explore/tag/camera

VOIP communication devices

1. device:”voip” – general search for Voice over IP devices.
2. device:”voip phone” – more specific search for anything VoIP containing a “phone” keyword.
3. server: snom – Snom is a VoIP provider with some legacy devices online.
4. “snom embedded 200 OK” – Snom devices with enabled authentication.
5. AddPac – an older VoIP provider, nearly exclusively legacy devices.
6. mcu: tandberg – Tandberg is a hardware manufacturer of multi-point control units for video conferencing.
7. title:”polycom” – Polycom is another VoIP communication brand.
8. title:”openstage” – Siemens Openstage brand IP phones.
9. 39 voip – some more VoIP services, mostly behind login screens
10. Server: MSOS/2.0 mawebserver/1.1 – VoIP media gateway, commonly used by services such as Patton SN4112 FXO.

Explore further by the VOIP tag: https://www.shodan.io/explore/tag/voip

Database searches

1. product:MySQL – broad search for MySQL databases.
2. mongodb port:27017 – MongoDB databases on their default port. Unsecured by default.
3. “MongoDB Server Information” port:27017 – another variation of the above search.
4. “MongoDB Server Information { “metrics”:” – fully open MongoDBs.
5. “Set-Cookie: mongo-express=” “200 OK” – MongoDB open databases.
6. kibana content-length:217 – Kibana dashboards accessible without authentication.
7. port:”9200″ all:elastic – Elasticsearch open databases.
8. port:5432 PostgreSQL – remote connections to PostgreSQL servers.
9. product:”CouchDB” – Apache CouchDB databases listed.
10. port:”5984″+Server: “CouchDB/2.1.0” – vulnerable CouchDB where remote code execution may be possible.

Explore further by the DATABASE tag: https://www.shodan.io/explore/tag/database

Maritime devices

1. maritime – general search for anything related to maritime devices.
2. sailor – another wide search, could yield unrelated results!
3. org:marlink – general search; Marlink is the world’s largest maritime satellite communications provider.
4. satcom – another maritime satellite communications services provider.
5. inmarsat – as above, but a slightly less known equipment vendor.
6. vsat – abbreviation for “very-small-aperture terminal”, a data transmitter / receiver commonly used by maritime vessels.
7. ECDIS – abbreviation for Electronic Chart Display and Information Systems, used in navigation and autopilot systems.
8. uhp vsat terminal software -password – satellite network router without a password.
9. ssl:”Cobham SATCOM” – maritime radio and locations systems.
10. title:”Slocum Fleet Mission Control” – maritime mission control software.

Explore further by the VSAT tag: https://www.shodan.io/explore/tag/vsat

Files & directories

1. http.title:”Index of /” – open lists of files and directories on various servers.
2. port:80 title:”Index of /” – slight variation of the above, note how the results might differ.
3. “220” “230 Login successful.” port:21 – FTP resources potentially accessible without login credentials.
4. 230 ‘anonymous@’ login ok – anonymous login allowed to FTP resources.
5. “Anonymous+access+allowed” port:”21″ – as above.
6. vsftpd 2.3.4 – legacy Linux based FTP service with a widely known security vulnerability
7. ftp port:”10000″ – Network Data Management Protocol (NDMP), used for backup of network-attached storage (NAS) devices.
8. “Authentication: disabled” port:445 product:”Samba” – SMB file sharing
9. “QuickBooks files OverNetwork” -unix port:445 – default settings for sharing QuickBooks files.
10. filezilla port:”21″ – popular file sharing software Filezilla.

Explore further by these tags:

FTP: https://www.shodan.io/explore/tag/ftp

SMB: https://www.shodan.io/explore/tag/smb

Legacy Windows operating systems

1. os:”Windows 5.0″ – Windows 2000; support ended in 2010.
2. os:”Windows 5.1″ – Windows XP; support ended in 2014.
3. os:Windows 2003 – Windows Server 2003; support ended in 2015.
4. os:”Windows Vista”– Windows Vista; support ended in 2017.
5. os:Windows 2008 – Windows Server 2008; support ended in 2020.
6. os:”Windows 7″ – Windows 7; support ended in 2020.
7. os:”Windows 8″ – Windows 8; support ended in 2016.
8. os:Windows 2011 – Windows Home Server 2011; support ended in 2016.
9. os:”Windows 8.1″ – Windows 8.1; support ended in 2018.
10. os:Windows 2012 – Windows Server 2012; support ended in 2018.

Explore further by the WINDOWS tag: https://www.shodan.io/explore/tag/windows

Default / generic credentials

1. admin 1234 – basic very unsecure credentials.
2. “default password” – speaks for itself…
3. test test port:”80″ – generic test credentials over HTTP.
4. “authentication disabled” “RFB 003.008” – no authentication necessary.
5. “root@” port:23 -login -password -name -Session – accounts already logged in with root privilege over Telnet, port 23.
6. port:23 console gateway – remote access via Telnet, no password required.
7. html:”def_wirelesspassword” – default login pages for routers.
8. “polycom command shell” – possible authentication bypass to Polycom devices.
9. “authentication disabled” port:5900,5901 – VNC services without authentication.
10. “server: Bomgar” “200 OK” – Bomgar remote support service.

Explore further by the VNC tag: https://www.shodan.io/explore/tag/vnc

Printers

1. printer – general search for printers.
2. “HP-ChaiSOE” port:”80″ – HP LaserJet printers accessible through HTTP.
3. title:”syncthru web service” – older Samsung printers, not secured by default.
4. “Location: /main/main.html” debut – admin pages of Brother printers, not secured.
5. port:161 hp – HP printers that can be restarted remotely via port 161.
6. port:23 “Password is not set” – open access via Telnet to printers without set passwords.
7. “Laser Printer FTP Server” – printers accessible via FTP with anonymous login allowed.
8. Printer Type: Lexmark – access to control panels for Lexmark make printers.
9. http 200 server epson -upnp – HTTP accessible Epson printers.
10. “Server: EPSON-HTTP” “200 OK” – another variation of the above search.
11. ssl:”Xerox Generic Root” – remote access to Xerox printers.
12. “Server: CANON HTTP Server” – Canon printer servers through HTTP connection.

Explore further by these tags:

PRINTER: https://www.shodan.io/explore/tag/printer

PRINTERS: https://www.shodan.io/explore/tag/printers

PRINT SERVER: https://www.shodan.io/explore/tag/print%20server

Compromised devices and websites

1. hacked – general search for the ‘hacked’ label.
2. “hacked by” – another variation of the above search.
3. http.title:”Hacked by” – another variation of the same search filter.
4. http.title:”0wn3d by” – resourced labelled as ‘owned’ by a threat agent, hacker group, etc.
5. “HACKED-ROUTER” – compromised routers, labelled accordingly.
6. port:”27017″ “send_bitcoin_to_retrieve_the_data” – databases affected by ransomware, with the ransom demand still associated with them.
7. bitcoin has_screenshot:true – searches for the ‘bitcoin’ keyword, where a screenshot is present (useful for RDP screens of endpoints infected with ransomware).
8. port:4444 system32 – compromised legacy operating systems. Port 4444 is the default port for Meterpreter – a Metasploit attack payload with an interactive shell for remote code execution.
9. “attention”+”encrypted”+port:3389 – ransomware infected RDP services.
10. “HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD” – compromised hosts with the name changed to that phrase.
11. “HACKED FTP server” – compromised FTP servers.

Explore further by the HACKED tag: https://www.shodan.io/explore/tag/hacked

Miscellaneous

1. solar – controls for solar panels and similar solar devices.
2. “ETH – Total speed” – Ethereum cryptocurrency miners.
3. http.html:”* The wp-config.php creation script uses this file” – misconfigured WordPress websites.
4. http.title:”Nordex Control” – searches for Nordex wind turbine farms.
5. “Server: EIG Embedded Web Server” “200 Document follows” – EIG electricity meters.
6. “DICOM Server Response” port:104 – DICOM medical machinery.
7. http.title:”Tesla” – anything with the term “Tesla” in the banner.
8. “in-tank inventory” port:10001 – petrol pumps, including their physical addresses.
9. http.title:”dashboard” – literally anything labelled ‘dashboard’, with many not accessible due to security by default.
10. http.title:”control panel” – as above, but whatever is labelled as control panels.

https://www.osintme.com/index.php/2021/01/16/ultimate-osint-with-shodan-100-great-shodan-queries/