achillean

46 ms·

61.
by achillean 5y ago
We've been using it for https://internetdb.shodan.io and it's been doing a few thousand lookups/ second without problems.
62.
by achillean 5y ago
In January 2021, Nginx took over Apache as the #1 web server on the Internet that users can install: https://i.imgur.com/pjU1G61.png https://trends.shodan.io/search?query=http+port%3A443#facet/... I&#x
63.
Show HN: InternetDB API – Fast IP Lookups for Port and Vulnerability Information(internetdb.shodan.io)
2 points by achillean 5y ago|0 comments
64.
by achillean 5y ago
"compromised" means that it looks like the service was taken over by somebody else. That can mean website defacement (ex. "Hacked by XXX"), database ransomware or any other way that a bad guy can compromise a service.
65.
by achillean 5y ago
Typically it means you've configured your firewall correctly. Shodan continuously crawls the Internet so it's not based on user requesting scans. The IPv4 space is fairly small so Shodan just checks every IP (3+ billion) to find t
66.
by achillean 5y ago
No, it's not static. The information is pulled from a file that gets updated by a separate script.
67.
by achillean 5y ago
We provide both long-polling and webhooks but almost everybody chooses to use webhooks. From what I've seen, a reason is that a lot of other tools/ platforms that you want to integrate with don't support long-polling. They pr
68.
Show HN: CLI tools to ping and do DNS lookups from different parts of the world(gitlab.com)
4 points by achillean 5y ago|1 comments
69.
Show HN: Run ping/ DNS lookups from multiple locations around the world(geonet.shodan.io)
6 points by achillean 5y ago|0 comments
70.
by achillean 5y ago
This looks amazing! Are you considering open-sourcing it? Would love to see how it fits as a background for https://2000.shodan.io There are probably a lot of outrun-style websites/ projects that could use this.
71.
by achillean 5y ago
Nmap generated a similar version many years ago and it's still available at: https://nmap.org/favicon/ We also did something looks at favicons by IP: https://faviconmap.shodan.io/
72.
by achillean 5y ago
Your account got banned due to scraping of the website.
73.
by achillean 5y ago
We don't do bans like that so it sounds like there might have been a configuration/ network issue.
74.
by achillean 5y ago
There are a few thousand web servers that return this status code for their main page :) https://www.shodan.io/search/report?query=http.status%3A418&...
75.
by achillean 5y ago
That's not what the article said though. They say that the compromised devices had these characteristics among others: * Port 2000 open * Port 5678 open * SOCKS proxy on port 80 (maybe) Most likely most of the visitors to your website
76.
by achillean 5y ago
In cases like this it's actually not that difficult as they're using devices that can be fingerprinted from the Internet. We at Shodan provide a local, embedded database (SQLite or RocksDB) so you can see which open ports connecti
77.
by achillean 5y ago
Yes, via the API. Btw all of our websites are entirely built on the same public Shodan API that everybody else has access to.
78.
by achillean 5y ago
FYI: Shodan also does monthly hostname-based scans of the Internet where we set the "Host"/ SNI headers. We use our own DNS DB to grab a list of hostnames/ IPs to launch scans of: https://www.shodan.io/do
79.
by achillean 5y ago
It doesn't matter. We check every IPv4 regardless. And for our regular crawling we don't ping before we try to connect as a lot of firewalls block ICMP.
80.
by achillean 5y ago
That's not how it works. Shodan continuously checks all IPs on the Internet. When you visit the website you're checking for existing information in the database. Your use of the Shodan website/ API doesn't change how Sho
81.
by achillean 5y ago
Bingo. Many years ago I tried to fix it but it was quickly reverted. I understand their policy though and hopefully it will get fixed at some point.
82.
by achillean 5y ago
Ah yeah, I didn't think you were :) It's just a common misconception so I wanted to let readers here know.
83.
by achillean 5y ago
The Wikipedia article is unfortunately woefully out of date in describing what Shodan does. For example, Shodan collects data on thousands of ports: https://www.shodan.io/search/facet?query=net%3A0%2F0&facet=p... A
84.
by achillean 5y ago
Note that Shodan doesn't try to login using default credentials. If you see banners advertising their defaults it just means that the device is telling you what its defaults are - it doesn't mean that the device is still using the
85.
by achillean 5y ago
I worked nearly full-time for about 2 years using my personal savings on a project management software for labs ("Labengine"). The big hook was that it let you run common bioinformatics apps on your data and it would automatically
86.
by achillean 5y ago
There definitely are instances of those databases on the west coast. For example: https://www.shodan.io/search?query=product%3Aelastic+state%3...
87.
by achillean 5y ago
It was probably one of @Viss's talks. Here's one he did at DEFCON: https://www.youtube.com/watch?v=-T-3buBwMEQ
88.
by achillean 5y ago
We also crawl IPv6 but it's a very different and more complicated algorithm. We would still end up crawling a sizable chunk but there are obviously unknowns in how biased our dataset would be (i.e. we might index mostly cloud servers a
89.
by achillean 5y ago
Looks like this is an automated campaign: https://www.shodan.io/search?query=READ__ME_TO_RECOVER_YOUR_...
90.
by achillean 5y ago
Here is an overview of what Shodan is: https://help.shodan.io/the-basics/what-is-shodan The scanning algorithm is mostly just this: 1. Generate a random IPv4 address 2. Select a random port from a list of ~2k ports 3.

More ›