Now that we have explored some of the basic features available with
Shodan, we put those to use in a red team exercise scenario.
We start with some basic information about a target, then examine the
initial information available from a simple search.
We refine that search with some additional filtering.
Then we can see the set of results and potential attack targets.
Now, let's consider how we might use banner searches and
search filters in red team operations.
Suppose we've been hired to conduct an adversarial attack
simulation against a U.S. state, in this case, the government of
that state. There's a state filter that we haven't used yet, so
let's try that as a starting point.
We can see there are several organizations that are not
part of the state government listed.
Let's refine our search a bit to include organizations with
the text string government in the listing.
So, that didn't work because we see counties listed and not state organizations.
Let's try the search with an organization name that includes the
word state. That gave us the right results.
Now we have 38 entries to explore, some with potential targets of interest.
Let's try another example.
This time let's suppose we're given a single IP address as a starting point.
Here's how we might utilize Shodan from the command line for some
initial searching. We can see that this IP address has some services
running, looks like a server with a web server on ports 80 and probably
remote desktop protocol on port 3389. Ports 1911 and the UDP service on
port 47808 are interesting.
My first concern might be that this is a honeypot system.
Shodan scores each system on its likelihood of being a honeypot, so let's
check that with the honeyscore command. It doesn't look like this one is in
this case. We do have an organization name,
though.
Let's search Shodan using that organization name in a
search filter. Notice that I need to encapsulate the
search parameters with single quotes.
Here we can see the results for this organization.
There are a variety of different systems that can be explored further.
So I hope you can see the value that Shodan provides for red team operations.