The Hacks of Mr. Robot: How to Use the Shodan API with Python to Automate Scans for Vulnerable Devices « Null Byte :: WonderHowTo

Shodancalls itself "the search engine for internet-connected devices." With so many devices connected to the internet featuring varying levels of security, the special capabilities of this search engine mean it can provide a list of devices to test and attack. In this tutorial, we'll use Python to target specific software vulnerabilities and extract vulnerable target IP addresses from Shodan.Any device connected to the internet must reveal some sort of information regarding itself. This can be relatively limited, as clever system configurations can block most undesired requests. On some devices, one might be able to scan ports to reveal things such as the services running on a web server or the name of a webcam connected to a wireless network.In "eps3.0_power-saver-mode.h," the first episode of the third season ofMr. Robotseries, the titular character, played by Christian Slater, uses the Shodan search engine in order to gather information about his corporate advisory, Evil Corp. Tyrell (Martin Wallström) and Angela (Portia Doubleday) are at his side, watching in disbelief, as Mr. Robot, the shadow personality of Elliot (Rami Malek), does an "Apache Tomcat" search.Image by Mr. Robot/USA NetworksA search like the one used in the show can reveal essential information about a potential target. Using this same technique, we'll look at exactly what can be found using Shodan's search function and how it can be used to execute a hack.Step 1: Using ShodanShodan can be accessed like most other search engines, by navigating toshodan.ioin a web browser.Rather than using traditional search terms to search the content of a publicly indexed website, when searching Shodan, we'll generally look for the information found in device headers or other information besides the device's HTTP web content, which is indexed by traditional search engines.InMr. Robot, the titular character searches the string below.org:"Evil Corp" product:"Apache Tomcat"While we could search this same search command, the fictional company Evil Corp. most likely will not return any results (or will it?!). The second component of the string, the "product" filter, is still a functional and useful search. This search string does require usage of filters, an option only available to registered users. A Shodan account can be registered by clicking on the "Login/Register" button at the top right of the homepage or by visitingaccount.shodan.io/registerdirectly.After a Shodan account is registered, a number of additional search capabilities will become available in the form of filters. Some of these filters are shown in the list below.country: filter to a specific countrycity: filter to a specific citygeo: filter by coordinateshostname: look for a matching hostnamenet: limit to an IP/prefixos: filter based on operating systemport: filter based on open portsThese filters can be applied using the same format as in the example used inMr. Robot, where the filter is included in the search followed by a colon and the search term. The format shown below can be used for any of the filters available within Shodan.filter:"Keyword"In this example, "filter" would be the name of the filter used, and "Keyword" would be the search term which is sought within the filter's category. Multiple filters can be applied, so long as they are separated by spaces.Don't Miss:How to Find Vulnerable Targets Using Shodan — The World's Most Dangerous Search EngineThe "Apache Tomcat" search, as shown in the show, will indeed return legitimate results when used on Shodan. We can test this by searching the string shown below.product:"Apache Tomcat"After searching, we can see that over 1.4 million results are returned. This search provides some interesting data regarding the locations and organizations which are using Apache Tomcat, but to a hacker, these results can have a different sort of utility.An attacker might specifically search for servers or web-connected devices using out-of-date software with known vulnerabilities in order to find devices to exploit. This process could be completed manually by copying results from a Shodan search in a web browser and choosing addresses to attack manually. However, the process can also be automated by using scripting languages and Shodan's API, which is somethingMr. Robotdid not show.Step 2: Retrieving a Shodan API KeyIn order to use Shodan's API to directly request and receive data while bypassing the web interface, we'll need to use our API key. This API key can be retrieved by navigating to the "My Account" section of the Shodan website, linked at the upper right of the homepage or simply by openingaccount.shodan.io.This key will be inserted into the Python code used to make API calls, so it may be useful to copy it to your clipboard or save it to a file.Step 3: Calling the Shodan API with PythonIn order to use Python to make requests using the Shodan API, we'll need to have a functional Python environment as well as the Shodan Python module installed. In the examples used in this tutorial, Python 2.7 is used. Python 3 also works using the module but would require a number of syntax changes to be functional with the scripts shown in this tutorial. On Debian-based Linux operating systems, Python 2.7 can be installed by opening a terminal emulator and running the command below.~$ sudo apt-get update && sudo apt-get install python2.7With Python installed, we can also install the Shodan Python module. This can be done usingpipor by usingEasy Install. Pip can also be installed usingapt-getwith the command below.~$ sudo apt-get install python-pipAfter pip is installed, we can use pip to install the Shodan Python module.~$ sudo pip install shodanIf you have multiple versions of Python present on your device, and potentially multiple versions of pip, you may need to specify you wish to install the module for Python 2.7 by using the command below instead, with pip2.7 specified.~$ sudo pip2.7 install shodanIf neither of these techniques succeed, the library can also be installed by running the command below.~$ easy_install shodanOnce Python and the Shodan library are installed, we can begin writing a new Python script. On the Linux command line, we can create a new file and begin editing it usingnano. Be sure to choose a filename other than "shodan" so that there are no conflicts between referencing the library and the script itself. Below, we'll create a file called "search.py."~$ nano search.pyThe first thing we'll want to add to this file is a line which will load the Shodan library. We can use theimportfunction of Python to do this, as seen below.import shodanNext, we can define our Shodan API key so that the script can use it to make API queries. Add the following lines to do so.SHODAN_API_KEY = "insert your API key here"

api = shodan.Shodan(SHODAN_API_KEY)Replace"insert your API key here"with your API key retrieved from Shodan's website, leaving the quotation marks enclosing the field.Next, we can use atrydeclaration to define what the script should attempt. Following this, we can add a command which uses theapi.searchunit of the Shodan API to actually request a search's results.try:
        # Search Shodan
        results = api.search('apache')In this example, the search string is simplyapache, however, this can be replaced with any search desired, including searches with filters such as those shown earlier in the tutorial. We can return the results of this search using the set of print commands shown near the end of the code below.# Show the results
print 'Results found: %s' % results'total'
for result in results'matches':
print 'IP: %s' % result'ip_str'
print result'data'
print ''
except shodan.APIError, e:
print 'Error: %s' % eThe script should now appear similar to the code displayed in the image below. More information on the Shodan API and this code can be foundat its documentation page.The script can now be saved and tested. Within nano, we can save the script withCtrl+O, and exit nano withCtrl+X. From within the same directory, we can run the script using the command below.~$ python2 script.pyRunning the script should return a number of IP addresses and some information associated with them, including HTTP status, location, and other device information indexed by Shodan. This information is formatted very similarly to the data shown when searching within the web interface.While this additional information may allow for additional criteria to be processed by other scripts and tools, if one wished to automate the process of gathering and testing attacks against IP addresses, this format is largely unnecessary.To only return IP addresses, we can change the formatting of our Python script. First, we can remove theIP:prefix from the line shown below.print 'IP: %s' % result'ip_str'Such that it looks like this line instead:print '%s' % result'ip_str'We can also delete the line which precedes it, and the two lines which follow it.print 'Results found: %s' % results'total'
print result'data'
print ''The script should now appear like the one shown below.When we run this script, it will instead return a list of IP addresses without any other unnecessary content.This list is much more useful for automating attacks against the list, but we need to have an effective way to save it. We can use shell operations in order to send the output directly to a log file. When running the script, include the>>operator followed by the name of the file you wish to send the output to.~$ python2 search.py >> log.txtNow we have a text file containing a list of IPs which we can use to test various attacks, depending on what search terms we've used to identify particular kinds of vulnerable systems.Step 4: Automating Tasks with Shodan ResultsFor an example of a command line utility which can use an IP address as an argument, we'll useping. Using something which actively attempts to attack or exploit the devices found by Shodan would be illegal and irresponsible, so make sure to only run tools you have permission to use on a target if you're actually exploiting anything. First, we'll create a new shell script using nano the same way we did earlier.~$ nano ping.shWe can begin the script with the "crunchbang" (the#!symbols) and shell declaration. This states that it is a shell script, to be run by the bash shell.#!/bin/bashNext, we can add a statement which allows us to do something with each line of our IP list file individually.cat log.txt | while read line
do
ping $line
doneThe script should now look like the one shown in the image below.We can now save this script withCtrl+O, and exit nano once again withCtrl+X. To be able to run the script, we'll need to mark it as executable by our operating system by granting it this privilege usingchmod.~$ chmod +x ping.shNow, we can run the script from the command line.~$ ./ping.shThe script should iterate through each IP in the address and send a ping to each IP.If this works, you've now successfully retrieved Shodan results and individually processed them! Ping is hardly an attack vector, but with a few minor changes, a similar script could be used by an attacker for malicious purposes.Don't Miss:How to Find Vulnerable Webcams Across the Globe Using ShodanStep 5: Weaponizing the AttackThe string which initiated the "ping" within the shell script would be one easy area to manipulate the action which is done with the IPs retrieved from Shodan. The original Python script could also be updated for more complicated exploits or tests. The basicpingcommand of the "while" iteration of the shell script is shown below.ping $lineThe$linevariable in this command represents each line of the IP list file, log.txt. We can replace this ping command with any other string which would include an IP address as an argument. We could usenmapto port-scan the target IPs by using the command below, using the-sSargument to conduct a service scan.nmap -sS $lineWhile each internet-connected device has a variety of ways in which it could be indexed by scanning services such as Shodan, one can check the security of their local network and router by checking their external IP at a website likewhatsmyip.organd searching this IP on Shodan to see what sort of information is available.Other ApplicationsThis format could be expanded to practically any other attack which could be launched from a command line and includes an IP. This sort of scanning and attacking of multiple targets is an extremely effective method for discovering vulnerable systems without having to take the time to individually find and attack them manually.This methodology can be applied to all sorts of different attacks, using Shodan, Python, shell scripting, or other tools, so long as they have the capability of finding devices and attacking them without user input.I hope that you enjoyed this tutorial on Shodan! If you have any questions about this tutorial or Shodan usage in general, feel free to leave a comment below or reach me on Twitter@tahkion.Don't Miss:How to Find Any Router's Web Interface Using ShodanWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by TAKHION/Null ByteRelatedHow To:Find Vulnerable Webcams Across the Globe Using ShodanHow To:Hack Together a YouTube Playing Botnet Using ChromecastsHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHow To:Discover Computers Vulnerable to EternalBlue & EternalRomance Zero-DaysHack Like a Pro:How to Find Vulnerable Targets Using Shodan—The World's Most Dangerous Search EngineNews:Samy's MagSpoof Hacking Device Was Just Featured on Mr. RobotHack Like a Pro:How to Find Any Router's Web Interface Using ShodanThe Hacks of Mr. Robot:How to Hack BluetoothHow To:Seize Control of a Router with RouterSploitHow To:Inject Keystrokes into Logitech Keyboards with an nRF24LU1+ TransceiverHow To:Conduct Recon on a Web Target with Python ToolsHow To:Take Control of Sonos IoT Devices with PythonHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Hack WPA WiFi Passwords by Cracking the WPS PINNews:Hacking SCADAHow To:Use Dorkbot for Automated Vulnerability DiscoveryHow To:Automate Brute-Force Attacks for Nmap ScansHow To:Discover & Attack Raspberry Pis Using Default Credentials with Rpi-hunterHow To:Hijack Chromecasts with CATT to Display Images, Messages, Videos, Sites & MoreHow To:Here's Why You Need to Add Python to Your Hacking & Programming ArsenalWeekend Homework:How to Become a Null Byte Contributor (1/29/2012)Weekend Homework:How to Become a Null Byte Contributor (1/12/2012)How To:Shorten URLs from the Command Line with PythonWeekend Homework:How to Become a Null Byte Contributor (2/17/2012)News:Learn to Code in Python, Part One: Variables, Input and OutputWeekend Homework:How to Become a Null Byte ContributorHow To:Things to Do on WonderHowTo (01/25 - 01/31)How To:Code Your Own Twitter Client in Python Using OAuthHow To:Things to Do on WonderHowTo (02/01 - 02/07)How To:Generate Word-Lists with Python for Dictionary AttacksHow To:Things to Do on WonderHowTo (01/18 - 01/24)News:The Google+ API Has Finally Launched with Read-Only Public Data