WEBVTT 00:00:00.940 --> 00:00:04.540 Now that we have explored some of the basic features available with 00:00:04.540 --> 00:00:08.750 Shodan, we put those to use in a red team exercise scenario. 00:00:09.740 --> 00:00:13.990 We start with some basic information about a target, then examine the 00:00:13.990 --> 00:00:16.660 initial information available from a simple search. 00:00:17.640 --> 00:00:20.550 We refine that search with some additional filtering. 00:00:21.540 --> 00:00:24.990 Then we can see the set of results and potential attack targets. 00:00:27.540 --> 00:00:31.380 Now, let's consider how we might use banner searches and 00:00:31.380 --> 00:00:33.910 search filters in red team operations. 00:00:34.340 --> 00:00:37.540 Suppose we've been hired to conduct an adversarial attack 00:00:37.540 --> 00:00:41.790 simulation against a U.S. state, in this case, the government of 00:00:41.790 --> 00:00:46.030 that state. There's a state filter that we haven't used yet, so 00:00:46.030 --> 00:00:47.650 let's try that as a starting point. 00:00:49.640 --> 00:00:52.410 We can see there are several organizations that are not 00:00:52.410 --> 00:00:54.050 part of the state government listed. 00:00:55.040 --> 00:00:57.800 Let's refine our search a bit to include organizations with 00:00:57.800 --> 00:01:00.160 the text string government in the listing. 00:01:02.240 --> 00:01:07.160 So, that didn't work because we see counties listed and not state organizations. 00:01:08.640 --> 00:01:11.940 Let's try the search with an organization name that includes the 00:01:11.940 --> 00:01:18.360 word state. That gave us the right results. 00:01:18.840 --> 00:01:23.660 Now we have 38 entries to explore, some with potential targets of interest. 00:01:25.140 --> 00:01:26.460 Let's try another example. 00:01:27.340 --> 00:01:31.860 This time let's suppose we're given a single IP address as a starting point. 00:01:32.840 --> 00:01:35.930 Here's how we might utilize Shodan from the command line for some 00:01:35.930 --> 00:01:42.060 initial searching. We can see that this IP address has some services 00:01:42.060 --> 00:01:46.370 running, looks like a server with a web server on ports 80 and probably 00:01:46.370 --> 00:01:53.880 remote desktop protocol on port 3389. Ports 1911 and the UDP service on 00:01:53.880 --> 00:01:56.560 port 47808 are interesting. 00:01:57.540 --> 00:02:00.660 My first concern might be that this is a honeypot system. 00:02:01.040 --> 00:02:05.350 Shodan scores each system on its likelihood of being a honeypot, so let's 00:02:05.350 --> 00:02:11.680 check that with the honeyscore command. It doesn't look like this one is in 00:02:11.680 --> 00:02:15.920 this case. We do have an organization name, 00:02:15.920 --> 00:02:16.250 though. 00:02:17.240 --> 00:02:20.250 Let's search Shodan using that organization name in a 00:02:20.250 --> 00:02:23.320 search filter. Notice that I need to encapsulate the 00:02:23.320 --> 00:02:25.360 search parameters with single quotes. 00:02:26.840 --> 00:02:29.150 Here we can see the results for this organization. 00:02:31.140 --> 00:02:34.650 There are a variety of different systems that can be explored further. 00:02:36.640 --> 00:02:40.860 So I hope you can see the value that Shodan provides for red team operations.