Skip to content

Latest commit

 

History

History
50 lines (41 loc) · 1.33 KB

README.md

File metadata and controls

50 lines (41 loc) · 1.33 KB
Raw

IPID

Goals

This script is for fingerprinting servers to determine what vunerabilities should lead to responsible disclosure.

TO DO

  1. security.txt = done (shodan)
  2. Find a domain
  • ssl subject or issuer domain (exclude common CAs)
  • check other ports on same IP (shodan)
    • EHLO banner
    • web content
    • ssh banner
    • SNMP
  • passive dns domain (dumpsterDNS, circl.lu etc)
  • reverse dns domain (exclude answers that contain the ip address in reverse as prob just the ISP?)
  • check BGP and repeat for other IPs in the subnet, find a pattern?
  1. Look for security contact on the domain (or IP if 1 unsuccessful)
  • security.txt
  • scrape 80/443 links for security
  • scrape for contact
  • whois
  • geoIP and pass to relevant CSIRT.Global chapter
  • pass to local NCSC
  1. Add setting.py

Shodan Input

When you query shodan.io, it returns a banner. The minimum parameters you can find it seems based on their documentation should always be something like this:

{
    "data": "Moxa Nport Device
            Status: Authentication disabled
            Name: NP5232I_4728
            MAC: 00:90:e8:47:10:2d",
    "ip_str": "46.252.132.235",
    "port": 4800,
    "org": "SingTel Mobile",
    "location": {
        "country_code": "SG"
    }
}

See link to documentation here: https://help.shodan.io/the-basics/search-query-fundamentals