SecurityTrails Blog

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

The most critical part of any website is its web server. The web server is responsible for accepting requests from your visitors, understanding them, and giving your website visitors answers to their requests.

Consequently, your web server is also the first component of your website in the line of attack. That's because attackers target your web server to find any vulnerabilities, configuration-related errors and SSL certificate-related security issues.

As part of the Securitytrails blog series highlighting both online vulnerability scanning tools and information gathering utilities, today we'll explore a tool focused on scanning web servers called Nikto. Let's learn more about Nikto and how to use it to scan your web server.

What is Nikto?

**Nikto**, also known as Nikto 2, is an open source (GPL) and free-to-use web server scanner which performs vulnerability scanning against web servers for multiple items including dangerous files and programs, and checks for outdated versions of web server software. It also checks for server configuration errors and any possible vulnerabilities they might have introduced.

The Nikto vulnerability scanner project is a fast-moving effort, frequently updated with the latest known vulnerabilities. This allows you to scan your web servers with confidence as you search for any possible issues.

Main features:

Nikto is free to use, open source and frequently updated.

Can be used to scan any web server: Apache, Nginx, Lighttpd, Litespeed, et cetera.

Scans against 6700+ known vulnerabilities and version checks for 1250+ web servers (and growing).

Scans for configuration-related issues such as open index directories.

SSL certificate scanning.

Ability to scan multiple ports on a server with multiple web servers running.

Ability to scan through a proxy and with http authentication.

Ability to specify maximum scan time, exclude certain types of scans and unusual report headers seen as well.

Nikto installation

The Nikto vulnerability scanner can be installed in multiple ways on both Windows and Linux-based systems. It is available in package format on Linux for easy installation via a package manager (apt, yum, etc.) and also available via Github to be installed or run directly from the project source.

For our tutorial, we'll install Nikto from an operating system distribution package as well as from Github directly. This will give us multiple ways to install and integrate the Nikto web scanner into our tool sets.

Github-based installation

While the Nikto web scanner can be installed from most operating systems' software repositories, installation from Github will always ensure you have the latest version of Nikto working with your system. This is important for any security analysis tool, ensuring the search for vulnerabilities is working with the most current information possible.

The Github-based installation method is also ideal for Linux distributions which do not carry Nikto in their software repositories, which makes installing Nikto possible on nearly every Linux distribution/platform.

To begin the installation from Github, clone the git repository:

Switch to the nikto, program folder:

You can now use the Nikto website vulnerability scanner to scan any website or IP address. Simply replace "" with any domain or IP address you wish to scan:

If the above command does not work, you can try:

Kali Linux-based installation

Kali Linux is the go-to Linux distribution for users who are into pentesting and security analysis. And adding the Nikto vulnerability scanner to your security analysis tool set on Kali Linux can be achieved with just a couple of commands, as shown below.

First, refresh your APT package lists and install any pending updates:

Next, install the Nikto web scanner with the command:

To verify that the Nikto website v...

When attackers attempt to steal data, having insider access to a system is their best bet. And if that insider access is gained through a privileged account that holds the keys to critical systems and data, that would be like hitting the jackpot—but only for the attackers. This is why we consider privilege escalation, the attempt to compromise an account and then expand its privileges, a key component of nearly all advanced cyber attacks.

Let's now explore privilege escalation, along with its different types, common techniques used by attackers and defenders to achieve it, and what organizations can do to mitigate this very common, and very dangerous, cybersecurity threat.

What is privilege escalation?

In order to enter a network and reach their final objective—data exfiltration—cyber attacks typically follow a sequence of techniques. During the first stage, reconnaissance, attackers plan and research a prospective target by gathering personal or company information. And to gain more intel about the target, phishing emails are often used.

Using the information gathered and analyzed, the attacker can successfully compromise a system, usually by gaining access with a low-level account. In this scenario, and phase of the cyber attack life cycle, attackers look around the network, map it and search for exploitable vulnerabilities. The level of access they have in this phase won't get them to the desired data, so they would need to obtain access to more sensitive information and other parts of the system. This is when attackers attempt privilege escalation to gain more permissions—privileges and access to additional systems.

"Privilege escalation", therefore, is defined by the techniques and activities attackers use to gain elevated permissions and access to a system, network or applications. Attackers exploit vulnerabilities, system weaknesses and misconfigurations after they've successfully compromised the system through a low-level account, and now need to heighten their privileges to study the system and carry out the cyber attack. Generally, any violation of set boundaries for account and user permissions is considered a privilege escalation.

Unfortunately, attackers often have a clear pathway for privilege escalation with organizations burdened by inadequate security controls and measures. These include the lack of enforcing the least-principle privilege, which states that a user should be given only those privileges needed to complete their tasks and nothing more.

Privilege escalation exploits are pieces of code that release a payload focusing on finding known vulnerabilities CVEs in the target system. Executing that exploit will allow attackers access to sensitive data and the ability to corrupt, destroy or steal it and disrupt business operations, or simply remain in the network to execute further attacks and establish persistence.

How many types of privilege escalation are there?

There are two main types of privilege escalation: horizontal and vertical.

Vertical privilege escalation

Vertical privilege escalation can best be illustrated with a look at a phishing email. Take, for example, the standard email message that appears to come from a service or website you use: "We have noticed unusual activity from your account. Please click this link and log in to verify your identity". If you were to actually fall for this, and click that link to log in, you would likely be taken to a webpage mimicking the authentic website, where once you input your credentials, the attacker would be able to use them and gain access directly to your account. The attacker could then perform the same actions you and your account have permissions for.

This type of privilege escalation is the "easier" of the two, as it doesn't entail elevating permissions. Attackers don't work by upgrading the privileges of the account they've compromised, they simply use the privileges granted with that account.

Horizontal privilege es...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

Vulnerability scanning is one of the foundations of standard enterprise security. An enterprise with a good security posture will have: a firewall, some type of asset mapping, a vulnerability scanner and possibly even a security team that does some type of pentesting. Keep in mind that the list above is not exhaustive, but the rudimentary outline of an enterprise with a few good security measures in place.

Vulnerability scanners, in particular, are critical for ensuring that any threats that may have made it past the firewall are picked up before they can infect and destroy entire networks.

The enterprise proprietary vulnerability scanner market is filled with competitors (such as Qualysguard or Nessus), and while some companies prefer running proprietary enterprise scanners, there are also many companies that prefer using collective intelligence and open source scanners.

One such product is ** OpenVas** (now renamed Greenbone Vulnerability Management or gvm). In this post we'll refer to OpenVas gvm interchangeably, as the old name is still used to identify the software.

What is OpenVas gvm?

** OpenVas gvm** is a fully featured vulnerability scanner, but it's also one component of the larger "Greenbone Security Manager" (gsm).

OpenVas dates back to 2009 and the project is maintained by a commercial open source company. With its focus on the enterprise market and its long history, any risks of enterprises adopting a technology that might become abandoned are greatly reduced.

Here are some notable positives of OpenVas gvm:

Has a long history (since 2009) with daily updates and over 50000 vulnerability tests.

Is backed by an enterprise software security company.

Can perform various types of authenticated unauthenticated tests.

Supports a variety of high and low level Internet and industrial protocols.

Has an internal programming language that can be used for implementing custom vulnerability tests.

Who should use it?

OpenVas gvm is useful for companies' Devops security teams. In most scenarios it would be used by people in a blue team environment.

While pentesters and people doing bug bounties can use it as well, other available tools may be preferable, geared toward their areas of expertise.

Installing OpenVas gvm

There are multiple methods for installing OpenVas gvm. We'll discuss the two most popular methods before proceeding with the installation.

*Note: It is always important to use some type of sandboxing environment when installing new software. You can opt for a virtual machine (VM), container or a remote test server.*

Compiling from source

This is probably the most complicated method for installing OpenVas gvm. If you are comfortable compiling software written in C, this shouldn't prove too challenging for you. However, we recommend not doing this because OpenVas is a large piece of software with many parts.

We've compiled software before in previous software reviews, see Masscan, but OpenVas does have two great alternatives: it's pre packaged on Kali and has a PPA for Ubuntu.

Installing on Kali Linux

Installing OpenVas on Kali requires just a few commands:

Kali runs as root, so there is no need for sudo. The second part of the setup on Kali will be similar to the Ubuntu install. We will mention at which point you can run the commands on Kali to achieve the same setup on Ubuntu.

Installing on Ubuntu 20.04

Our first discovery when attempting an install on Ubuntu was that much of the existing documentation discusses the ' OpenVas' PPA.* The problem encountered here is that OpenVas was renamed gvm (Greenbone Vulnerability Management), so we need to adjust the commands appropriately. We'll use Ubuntu 20.04 to install gvm.

First we update Ubuntu itself:

Now let's install the required package that will enable us to add the PPA.*

A prompt like the follo...

Indicators of compromise are great, aren't they? They're those little pieces of data that provide security researchers and digital forensics analysts with evidence of a breach on a system or network, and allow them to investigate the impact of the attack.

Indicators of compromise can be anything from a file that doesn't belong to a system directory, to suspect or known malicious domains and IPs, to anything that can show proof of a breached system. And by relying on known data concerning malicious actors and events, reports on emerging threats, reputational lists and threat intelligence feeds, these smoking guns also inform better tools and detection techniques that can be used in the event of future attacks.

But what happens when a zero-day threat emerges that is unknown, with no previous knowledge to draw from? What if behaviors exhibited by the threat have not been classified as malicious, and detection using IoC isn't possible?

Don't cure, prevent

Think of using IoC like treating a cold: you already have a runny nose, a sore throat and you can't get out of bed. They're all indicators of a cold — IoC! But you're just trying to ease the symptoms, and the damage has been done. Now, you could've taken note when you woke up with a slightly sore throat that one morning, before all the symptoms hit you with full force. Perhaps taking some preventative measures could have saved you a lot of trouble and discomfort.

This is how watching for **indicators of attack**, before an event fully happens, can work for you. Put simply, it's acting proactively.

Indicators of attack vs indicators of compromise: main differences

Indicators of compromise consider, as we saw in the introduction, reactive detection of a security breach by showing evidence of a breached system. This can be the presence of viruses and malware, anomalies with privileged user accounts, malicious IPs and other forensic evidence that indicate a high probability of an attack.

In the cyber attack life cycle, there are different steps and actions involved. Indicators of attack, or IoA reflect a series of events and actions attackers must execute in order to gain unauthorized access to a system or a network.

**Proactive detection** can take place during all of the steps that precede the attack — reconnaissance, weaponization and delivery — before the threat becomes a successful exploit. And when context can be gained as early as the recon phase, defenders can block attackers from moving forward. With reactive detection of IoC, the detection of intrusion is done after the attacker has already gained access to the system, in the later phases of the cyber attack life cycle.

While IoC are inherently bad as **evidence of a security compromise**, IoA become bad based on what they mean in the context of the situation. This means that one behaviour won't always be an indicator of attack, and whether it is classified as one would depend on the intent of the actor behind it.

For instance, port scanning isn't an inherently malicious activity, and can be performed by a benign scanner, but it can also be done by an attacker in the recon stage of an attack, trying to obtain as much information about your network as possible to discover any vulnerabilities. So, flagging this activity as an IoA wouldn't really be useful. But if we add context with additional logs showing evidence of other internal hosts communicating to external hosts using atypical ports, then this can very well be an indicator of attack.

Indicators of attack **detect an active attack in real time**, before the final goal of the exploit, data theft, or similar operation is achieved. They cover the gaps IoC leave behind, by **detecting unknown threats**, and because IoA identify activity and behaviour rather than methods and tools used, **malwareless attacks can also be uncovered**. Once IoA are detected, they're refined by adding contextual information from other security tools to determine wheth...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

An api can be accessed in different ways, via your browser or your command line, but the easiest way is by using an api wrapper. While api access points may change over time, using an api wrapper will ensure the way you call the api always remains the same in your code.

Today we're excited to announce the immediate availability of a new Securitytrails api wrapper, and this time it's written in php, one of the most popular programming languages powering a big part of the Internet. This wrapper was written by Arjit Chaudary, one of the new technical writers who has recently joined the Securitytrails team.

Supported functions

Note: most of these functions require only 1 parameter.

At the time of this writing, this php wrapper supports 17 functions; we'll list the main ones here:

getdomain

The getdomain api call is used to return current data about the domain queried. For example, the getdomain api call returns how many domains are bound to the same IP address as well.

getsubdomain

The getsubdomain api call is used to return all subdomains which are found to be associated with a domain.

getdomainwhois

The getdomainwhois api call is used to return the domain Whois details, such as domain owner, registry date, expiry date, etc.

getassociateddomains

The getassociateddomains api call is used to return any associated domains with the domain looked up.

get dns history

The get dns history api call is used to return historical dns data about a domain being queried.

1. domain — The domain you are looking up

2. record_type — The record type being looked up; this can be a, aaaa, mx, ns, soa or txt

getwhoishistory

The getwhoishistory api call is used to return historical Whois information about a domain being queried.

getcompanydetails

The getcompanydetails api call is used to return information about a company via its domain.

Other functions

There are many other functions such as:

checkping.

checkusage.

getdomaintags.

getcompanyassociatedips.

getipneighbors.

getipwhois.

getipuseragents.

getsslcertificatesPages.

getsslcertificatesStream.

getfirehosecertificatetransparency.

Get full insight into all of these extra functions by visiting the official Github docs.

Getting started

Let's see what the required steps are to get this api wrapper working on your php applications.

Generate an api key

To use the php api wrapper, you first need a Securitytrails api key. This can be obtained from your Securitytrails account at

Head over to the api Keys option on the left menu:

Once on the api Keys page, you can copy your api key by clicking on the copy button:

Installation

Installing the Securitytrails api php Wrapper is super easy; all you need to do is clone the git repository or simply download the file securitytrails.php and include it in your projects to use it right away.

In most use cases, it is recommended to download the api wrapper via Git, as this allows you to easily update the wrapper (when there are any updates to it) by running a simple git pull command.

In our example, we'll download the api wrapper by using Git.

Run the commands listed in the order below. This will download the Securitytrails api php Wrapper into your current folder:

In this folder, you'll find the api wrapper named securitytrails.php, which can now be included in your existing project.

How can I use it?

Here, we'll try the getdomain api call which returns current data about the given hostname and more.

Create a file called test.php with the following code:

Replace your api key here with the api key token obtained from your account in the previous step (do not remove the double quotes).

Once that's done, head over to your website and visit the page test.php which we created above, and you'll see the following output

Other usage examples

Finding domain W...

In order to survive, cybercrime must evolve. Cybersecurity experts are constantly working on tools, tactics and practices to monitor, prevent and respond to threats, patch vulnerabilities and avoid zero day threats. And while technology is constantly evolving, cybercriminals are constantly creating new attacks to fit the trends as well as tweak existing attacks to avoid detection.

Organizations, at large, deploy spam filters to detect viruses, use antivirus software, and secure firewall, intrusion detection and protection solutions to keep the bad guys from getting into their network. Security awareness and readiness regarding phishing attacks is also on the rise, with employees becoming better-versed in recognizing and responding to phishing attempts. Cybercriminals are thus tasked with finding ways to overcome these obstacles to their goal of gaining access to organizations' networks.

In nature, we observe predators that hide next to bodies of water, watering holes, where the prey gathers, and wait for the opportunity to attack.

Unfortunately, cybercriminals have found a way to emulate this predatory behaviour. They prey on unsuspecting victims browsing regularly visited websites. This is called a **watering hole attack**.

What are watering hole attacks?

The concept of **watering hole attacks** is similar to spear phishing. Malicious attackers have figured out that opportunistic phishing emails are easily discarded, and that the more targeted and tailored attacks are to an individual, the more the attacks are likely to succeed.

What differentiates spear phishing from watering hole attacks is that spear phishing attempts to persuade unsuspecting victims to click on an attachment or perform other actions with which they would divulge their private information.

Watering hole attacks, on the other hand, don't need to lure victims in that way. These attacks are already positioned in a particular space, infecting a third party-service or a website that the victim frequents, using using malware with the end goal of infecting the user’s device and gaining access to an organization's network.

We do see more opportunistic-in-nature watering hole attacks, possibly actors building a botnet, in which more widely popular websites are infected. We'll be focusing on those more sophisticated and targeted watering hole attacks, but their techniques don't differ all that much.

Objectives for such attacks include gaining access to sensitive computer systems as well as data theft, whether financial, personal, strategic or intellectual. While they are targeted, they do have a wider scope than spear phishing, and catch more victims than those targeted — so if they get lucky, they'll catch the ones that will reveal the desired network credentials that allow the attackers access to the network.

Because relying on luck isn't the most optimal solution, attackers often combine watering hole attacks with spear phishing campaigns. This way, they can send victims highly targeted and customized emails prompting them to visit a website that seems harmless and familiar but is, in fact, compromised and will infect users with malware. This is often done by compromising the website's automated email system, ensuring any detection is avoided.

Another tactic attackers use to avoid being detected is employing social engineeringtechniques geared toward specifically choosing and compromising legitimate websites, appropriate to their target. This will ensure these websites are not blacklisted.

Watering hole attacks usually target businesses and organizations through their employees, vendors and suppliers, but public websites that are popular in the victim's industry can be effective as well. These include discussion boards, smaller news outlets, industry conferences, and more.

How does waterholing work?

Attackers start with a target. They then find websites that users frequent, compromise the websites, wait for victims to enter, then in...

Note: The audio version doesn't include code or commands. Those parts of the post can be seen in the text version.

A couple of months ago we were delighted to share big news about one of the hottest features of SurfaceBrowser: sql explorer. Introducing this new sql based feature allowed many of our customers to perform classic sql based queries against our massive infosec database and all its host and IP attributes.

Today we're excited to announce the immediate availability of Regex (R-Like) support for hostnames in sql explorer. Let's see it in action with a few examples.

Find all domains that start with the word "paypal"

The code will be similar to this:

Take a look at the following screencast to see the results:

As you can see by using Regex (RLIKE) you can find any strings with particular patterns, in this case we used domain.hostname rlike "paypal[a-z]*.*", just as an example, but there are many possibilities. Let’s see some additional variations.

Let's say we want to avoid subdomains in our results. We simply need to add "AND domain.subdomain is null" to our previous query:

The output will look like:

And is numeric regex supported? Well, of course!

For this, we can alter the previous select to include the R-Like query as shown below:

The result will include domains such as:

Find paypal-based domain names that are using self-signed certificates and Let's Encrypt SSLs

In this case, we'll repeat the previous syntax, but we can add another attribute such as **ssl.is_self_signed = true**, which will match only self-signed SSL certificates:

Another variation may be to combine this with **ssl.issuer.organization = "Let's Encrypt"**, as this can unveil all the domain names that are using free SSL certificates, which is pretty common in some phishing-based websites.

Once you have your results ready, click 'Add to downloads' to get all these domains packaged into JSON and CSV formats:

We can take all these examples even further by combining other host and IP attributes that are present in our SurfaceBrowser sql explorer interface.

If you're interested in playing with the rest of the supported Regex syntaxes for domain.hostname, you may want to check the official ES docs.

We're already working on adding new supported endpoints for this Regex feature. Stay tuned!

Access sql explorer today

The sql explorer preview is now available to interested customers.

Want to get a head start in using this valuable new feature?

Request a demo!

Data loss has long been a serious issue for businesses of all sizes. Yet despite growing awareness surrounding the issue — and the security measures taken to prevent it — the number of data breaches continues to grow every year. Even worse, losing data isn't only just losing data: it also brings with it financial impact, loss of customer trust, corporate liability, loss of current and future business, and often some very hefty legal fines.

Traditional security controls such as firewalls, physical controls and network segmentation do help to keep malicious actors out of the network, but what about the inside of the network? After all, within your organization there are people with authorized access to sensitive data, and recognizing their intentions isn't easy. The danger often comes from within, and organizations need to maintain visibility over their sensitive data, including how it's interacted with, and who has access to it. This is where data loss prevention comes in.

It's a term that's often thrown around, and with such a wide scope it can be difficult to define. But that's precisely what we'll do today.

What is data loss prevention?

Data loss prevention, or DLP-is a set of procedures and tools used to prevent data loss, by ensuring that an organization's data isn't misused or accessed by unauthorized users. Organizations use DLP-to both secure their data and to comply with regulatory requirements.

The term DLP-is mostly used for tools and software that classify critical data and control data transfer to protect it from unauthorized users, and to prevent authorized users from accidentally or maliciously sharing data and putting the organization at risk. The data is classified according to the organization's business rules and policies, which are typically driven by compliance (GRPR for example).

DLP-tools monitor different entry points on a network, such as endpoints, email servers, and gateways; and also control data transfer between users and external parties. They also secure data at rest, in motion and in use and control that activity, monitoring for any potentially malicious data transfer or use. For example, DLP-tools would flag an activity such as an employee transferring corporate files to an external device, or forwarding an internal email outside the organization.

To reiterate, DLP-solutions monitor data inside the network, filter activity to stop suspicious activity, provide reporting for incident response and compliance, and analyze suspicious behavior to provide context to security teams.

Different types of data loss prevention

While we just went over how a "regular" DLP-solution works, there are still different solutions that work based on the perimeter they protect. As organizations generally have many security solutions in place, they don't often need an all, encompassing DLP. It's more practical to have one that suits their needs, with the type of solution they use focused on what needs to be protected. That's why we recognize four main types of DLP-solutions — network, endpoint, email and cloud DLP.

Network DLP

Network DLP-provides visibility into data in motion, by monitoring traffic that goes in and out of an organization's network. These solutions protect the organization's network, web application, email and FTP. Usually cloudbased, network DLP-solutions monitor every bit of data traffic between users and endpoints, blocking data transfer based on predefined rules which are customized for the organization and its policies. Unauthorized data transfer and malware are then prevented from travelling through the network.

Endpoint DLP

Endpoint DLP-solutions provide visibility into data on, well — endpoints. These solutions monitor laptops, PCs, servers, USBs, mobile devices, workstations, just about all devices on the network. They protect data used on company devices by ensuring information isn't sent or copied to unauthorized devices, and flag any attempts to do so. Endpoint ...

Note: The audio version doesn't include data from the tables. Those parts of the post can be seen in the text version.

Just recently, we came across a flash alert released by the FBI concerning 63 domains that were impersonating the US Census Bureau. We were intrigued and wanted to investigate further, so for our second Recon Safari we're going to look at what Osint data we can uncover from these spoofed domains.

We'll be primarily using Surfacebrowser, our browser-based, all-in-one passive intelligence tool.

Some of the data we'll look at includes:

Whois, including history.

DNS, current and historical.

Subdomains with their associated hosts, ports and more.

SSL certificates.

We will also apply some logical deduction to spot any obvious trends. Let's dig in!

The list of suspicious domains

The list appears to indicate 63 domains, but if you look more closely, the actual number is only 57. The actual number of domains is even less because some of these domains are actually subdomains. Examples include bendus.ensus.org and calforniac.ensus.org.

The second noticeable trend we picked up on is the use of '-' for domains with the exact same spelling. Examples of these include:

uscensusbureau.co, us-census-bureau.co

censuscareers.com, census-careers.com

uscensusbureau.net, us-census-bureau.net

Here are common keywords with these spoofed domains:

bureau (a difficult word to spell and easily exploitable via misspelled domains).

careers.

jobs.

form.

survey.

The 4 main TLDs of the spoofed domains are **.com, .net, .org** and **.us**.

Exploring the Data

The spreadsheet below introduces the Osint data we found on the 57 domains. The data contains: registrar, current Whois, registration date, historical Whois, subdomains with their hosts and open ports, the certificate authority and relevant notes.

You can find the full spreadsheet at the following link.

For some of the domains (arrecensust.cf, censuspeer.cf) we found no available data.

The bulk of the spoofed domains, over 30 of them, are currently registered with Network Solutions.

You can find all domains registered on 08-09-2018 in the spreadsheet above, categorized under the orange label. We could assume that the Whois data being used here is inaccurate.

In a couple of these orange-labelled domains, we were able to find historical Whois data pointing to a @census.gov email. Our powerful "Associated Domains" engine was able to uncover at least 35 domains through various associations:

Many of the domains above were initially registered 6 years ago, all on the same date: 2014-03-19.

Of the few registered on different dates (census2020.net), we uncovered an association to an organization named Naleo Educational Fund.

Another important domain is: 2020census.us. The current Whois for this domain points to a Doug Gardner of Reingold (marked under the blue label). This Whois data should look familiar because we found Whois data associated with this person, organization in 7 of the spoofed domains identified above. The www subdomain points to a "Confluence Networks" IP: 208, 91, 197, 27.

The same 208, 91, 197, 27 IP is also present on www.uscensus.us.

Doing a lookup on 208, 91, 197, 27 IP uncovered over 1 million associated domains, but by using Surfacebrowser, we were able to filter them out and found 314 "census"-related domains. We tested a number of these domains and a lot of them have redirects.

It redirects to "link in the document".

A sample of this redirect situation is on uscensusbureau-gov.u.

The Whois, including historical data for searchacross.com is guarded by Whois protection, so we're unable to extract any data from that angle.

The same issue exists for another of these redirect domains: wellnesszap.com.

We thought we were in luck because the third redirect domain had historical Whois data pointing to a person with no Whois privacy: fill-out-census-online.net (which has the same Whois as on figure 1), s...

In this day and age, IoT devices are just about anywhere and everywhere. It's not uncommon to find a smart TV, a WiFi router or even a webcam in the garage—not to mention all the other internet connected devices we use every day.

Given the increasing need for remote public network access with IoT devices, we see an ever growing list of security concerns. These include devices that aren't configured correctly or are simply too old, with security flaws in their firmware. You know that security camera that's been on the street corner since 2013? It's probably on the internet, too, with a major security flaw that allows anyone to connect to it and watch your street.

With an estimated 26 to 31 billion IoT devices currently in use, estimating a low figure of 1% for devices with security flaws connected to the public internet still gives us a staggering 260 million devices that can be compromised (or are already).

Security researchers are always on the lookout for such devices, to find any security holes before the bad guys do. But searching for 260 million devices on the internet is like looking for a needle in a haystack.

Scanning through 4, 294, 967, 296 IPv4 addresses might be possible, but looking for devices which are operational only on IPv6 space is just about impossible to scan in any reasonable period of time, especially for a single person faced with 340, 282, 366, 920, 938, 463, 463, 374, 607, 431, 768, 211, 456 IPv6 addresses. But wait... we have Shodan!

What is Shodan?

Simply put, Shodan is a search engine for IoT devices. Shodan crawls the internet all day and night looking for IoT devices and indexes them for easy reference via a simple search query. With this IoT device information, we're able to discover many, many things about the public internet connected devices in our homes, offices and beyond.

The IoT device information available at Shodan unlocks various possibilities, including:

Security research

Various IoT devices have their firmware versions listed right on the login page.

This means researchers can find devices running specific versions of firmware with known vulnerabilities and possibly contact ISPs to inform them of such vulnerabilities existing on their networks.

Sales Marketing research

IoT devices also display their brands and model numbers right on the login pages and in the HTTP headers, which opens up sales and marketing research topics, like How many people use a brand X WiFi router?

How many people use a smart television from X year?

Such information gives sales, marketing people ideas for targeting certain regions with offers, to get them to purchase newer devices.

Consumer research

IT managers, Red teams and Blue Teams, and general SOC teams at companies can look for devices they're about to purchase, to determine whether said devices have any known security issues (e.g., new large scale on campus security camera deployments).

Users can watch for their own IP addresses to see if any device in their home is listed at Shodan as well. This acts as a security tool for finding home devices which don't need to be on the public internet space.

Grabbing intelligence data with Shodan

Using Shodan to gather intelligence data is super easy and straightforward. To begin, head over to Shodan's website, located at www.shodan.io

Once we're at Shodan, we see the following menu bar at the top of the website.

Here we see two primary options, first a search box and second an explore option. These allow for a multitude of possibilities in finding intelligence data for IoT devices.

Using the "Search" feature

Whether we're looking for a specific IoT device brand or model, or for devices on a specific IP address, we can utilize the Search option by inputting a device name, device type (webcams, routers, etc.), IP address or just about anything that helps to identify the type of device we're looking for. Shodan will then locate any relevant devices found with the data ...