Shodan: A Beginner's Journey

it's 3 minute [Music] Thursday hey welcome back to the channel my name is Gary this is Ramy I'm a hey welcome back to the channel my name is Gary this is Ramy I'm a cyber security professional by day this guy's a teddy bear by day okay go squirrels good boy today I'm going to show you around something called Showdown we're all used to using Google being nah maybe if you saw my last video you've done some Google Dorking where you can find some stuff on the internet that you shouldn't be able to find but showan

is a different Beast Al together so let's put 3 minutes on the clock and let's roll before I show you the tool I want you to think of Showdown as being like nmap if it was a company I've showed nmap many times before on the channel I'll put some links below Showdown scans the internet all the time I'm not sure on the frequency but it may as well be all the time and they take those results and they make them available to you on showdown. so here's the platform along the top here you can see

you got these little things like Maps images monitor developer and more these are the common tools that people use on Showdown but if you click the more button you'll actually get a little bit of a breakdown into other things that they do so here's core products Trends and the help center there's also developer services Enterprise stuff for companies and research as well there's even this really cool Showdown 2000 website that lets you explore the internet like it was the year 2000 pretty cool so let's have a look at what Showdown shows us because that's probably

the easiest way to show you what Showdown does I'm just going to click on images at the top these are remote desktop sessions that are available over the open internet that's right in either way when you you go to work these days you just open your laptop and you log into a virtual machine somewhere well it's kind of like that these are computers that people have made accessible over the internet via RDP remote desktop protocol but also you can see webcams here's a webcam this is a little bit creepy cuz that's a sofa is that

a blanket on the sofa yeah look there's a little old lady sat there on the sofa there's her head is she knitting or something I can see like a bar sticking down here she must be knitting herself a blanket you go girl there could be so many reasons why there is a camera potentially in Italy somewhere watching a little old lady sewing a nice blanket on her sofa this could be a service run by a company for example that keeps an eye on old people for their safety and they might not know that they have

Expos this to the entire internet with whatever setup they have that could be one explanation to this and I hope now you can see the usefulness of Showdown if you're a company or a security researcher or even an osen person there's Great Value in exploring the web like this you can find amazing things you can also find creepy things I'm just going to have a look through some of these remote desktop sessions ooh what's this this is what makes Showdown so fun you just want to like click through and look at everything does that look

like maybe a mechanical arm that picks things off a shelf like medicine maybe this could be medicine chilled medicine in a refrigerated container I see the number one and two on the roof yeah you definitely got this robotic arm kind of thing that can move up and down that's quite cool isn't it but what I'm looking for here is something maybe like this okay so this is a remote desktop session here and if we just zoom in you can see Frank Sabina shoe brackets blo something and then wner winter those are all very googleable terms

you could certainly search a couple of these together like Sabina Shu and wner winter on Google let's see if we can find anything there is this okay that is a real person with a real profile very interesting and the other one was wner Winter pop that in burner winter let's search them [Music] together okay I can't find it I'm not going to waste your time here you can see where I'm going with this opportunistic hackers people who just want to play around maybe cause some trouble ransomware gangs script kitties gry hat hackers who are on

the fence can just come to showan look around find usernames try and socially engineer some fishing emails try and directly attack those remote desktop sessions so many things and these images are just one part of Showdown you can set up Showdown monitoring for your entire network and it'll constantly monitor the internet for vulnerabilities and things and compare it to your network that's cool you can also view it by Maps I wouldn't recommend viewing it by Maps it's not like every single device in the world world has like a GPS connection and that is the exact

location of it but it can be useful if you just want to narrow something down or you're doing an investigation that warrants it if you look up at the top here in The Showdown homepage you got this search box they do have their own search query type language you can get some examples here hostname google.com or facebook.com for example you can also search for things like websites that are running Apache in their HTML if we just quickly do a search for that one here we go you can see 3,700 th000 entries all across the world

and then it lists the IP addresses and all the useful things this is the type of thing that cyber threat researchers do they search the internet when a new bug comes out let's say it's some zero day in some software they then search for that software on Showdown and it gives them an idea as to the scale of the problem it might just be there's six devices exposed in the world or 6 million in the case of bigger problems so look that's a very quick overview of Showdown top tip wait until Black Friday CRA Monday

because I believe every year they do a $5 lifetime membership deal you get an API key you can connect that into multigo so that you can search showdown from multigo Super useful I have a multigo video I'll link to that below also you're probably wondering what's inside this you getting that comment below I'll do an unboxing video soon see you next [Music] [Music] week