Showing posts with label SHODAN. Show all posts
Showing posts with label SHODAN. Show all posts

09 June 2013

The George Washington University and a small win for intellectual property

Earlier this week, I received the following email from XanEdu on behalf of The George Washington University:
XanEdu is seeking permission on behalf of [xxx] at George Washington University to include the following material in a digital CoursePack for approximately 12 students enrolled in PSSL 6246 during the Summer 2013 semester:
Title: Shodan for Presentation Testers
Author: Schearer, Michael
Page Range: 1-79
Total Pages: 79
Publisher: (author) Schearer, Michael 
If permission is granted, XanEdu will post the material on a password-protected web site. Only the instructor and students registered for this course will have access. The material will be removed at the end of the semester.   
You may grant permission by emailing or faxing this request with approval information to my attention.  Should a royalty fee apply, please include that with your email or fax.   
Thank you for your consideration. Please contact us if you have any questions or need more information.
As with most of my materials, I released this presentation under the Creative Commons License: Attribution-NonCommercial-ShareAlike 3.0 Unported (CC BY-NC-SA 3.0).

GWU gets +1 for respecting intellectual property!

15 March 2013

Law in Plain English: In Re National Security Letter

This is one in a series of posts designed to describe court decisions in plain English. For more detail and background on the legal issues, see the link to the case below. For similar posts, click here.

In Re National Security Letter

The FBI issued a national security letter (NSL) to an unnamed ISP for certain subscriber information. The FBI certified that disclosure of the NSL could harm national security, so the ISP was prohibited from disclosing to anyone that they had received it (a gag order). The ISP challenged the constitutionality of the  non-disclosure provision as a violation of free speech, and challenged the judicial review provisions as a violation of the separation of powers. Judge Susan Illston of the United States District Court for the Northern District of California ruled that the nondisclosure provision was a form of prior restraint which was not narrowly tailored, since the provision applied to both the content of the NSL and the fact that the ISP even received it. As a result, it violated the ISP's freedom of speech. Additionally, the judicial review provisions violated both the First Amendment and the separation of powers principle by trying to narrow the ability of courts to review the nondisclosure orders. Furthermore, she prohibited the government from issuing any NSLs or from enforcing the nondisclosure provisions in this case and in any other cases. Lastly, she stayed enforcement of the judgement pending appeal or 90 days if there is no appeal (although that seems entirely likely).

Update (8/13/2013): I missed this a few months back, but the Government did file a notice of appeal.

27 February 2013

Law in Plain English: Gabelli v. SEC

This is one in a series of posts designed to describe court decisions in plain English. For more detail and background on the legal issues, see the link to the case below. For similar posts, click here.

Gabelli v. SEC

Gabelli was charged with violating a federal law by defrauding his clients. The statute of limitations required that charges be "commenced within five years from the date when the claim first accrued." The question here was "when the claim first accrued" meant when the fraud actually occurred, or when it was discovered. In a unanimous opinion, the Supreme Court ruled that the natural reading of the law required the statute of limitations began when the fraud actually occurred. To read otherwise would violate the fairness of the statute of limitations concept. In other words, the fraud charges against Gabelli were filed too late. The practical impact of this decision is that violations of federal laws subject to the statue of limitations here will begin to run when the fraud occurred, not when it was discovered.

22 February 2013

Law in Plain English: FTC v. Phoebe Putney Health System, Inc.

This is one in a series of posts designed to describe court decisions in plain English. For more detail and background on the legal issues, see the link to the case below. For similar posts, click here.

FTC v. Phoebe Putney Health System, Inc.

A Georgia-authorized hospital authority (Phoebe Putney Health System, PPHS) managed one hospital and then purchased the only other hospital in the same county. The Federal Trade Commission (FTC) filed an anti-trust complaint alleging that having one hospital authority owning both hospitals in the county would reduce competition. PPHS claimed that as a state-authorized entity, they were entitled to state-action immunity from the anti-trust liability. The question before the Court was whether PPHS was entitled to such immunity. The Supreme Court ruled that PPHS was not entitled to anti-trust immunity because Georgia did not make it affirmatively clear that its hospital authorities could take actions that would reduce competition. The practical impact of this decision is that states that wish to give state-action immunity to their subdivisions need to do so through a clearly articulated policy.

18 February 2013

Law in Plain English: Bloem v. Unknown Department of the Interior Employees

This is one in a series of posts designed to describe court decisions in plain English. For more detail and background on the legal issues, see the link to the case below. For similar posts, click here.

I've made a slight change to the "SCOTUS in Plain English" series to reflect the opportunity to discuss a few cases not at the Supreme Court level that are nonetheless interesting and worthy of discussion. As a result, the series is now called "Law in Plain English."

Bloem v. Unknown Department of the Interior Employees

The National Park Service distributed flyers warning Occupy protesters in McPherson Square that they would begin enforcing a prohibition on camping. Subsequently, many items of personal property (some that belonged to Bloem) were destroyed. Bloem filed a lawsuit against the unnamed Department of the Interior employees for the seizure and destruction of his property. The DoI filed a motion to dismiss, alleging that Bloem had failed to state a claim upon which relief could be granted. The District Court ruled that the tent city was expressive conduct, permitted by the First Amendment. Additionally, Bloem's allegations that the DoI had violated his Fourth and Fifth Amendment rights were sufficient, and thus Bloem had stated a plausible claim. For purposes of a motion to dismiss, which in this case is a 12(b)(6) motion, Bloem's alleged facts are presumed by the court to be true. In other words, the court looks at the case and says: even if we assume that all of his facts are true, has he made a plausible claim? This is a procedure hurdle to make sure that baseless lawsuits don't consume valuable time of the court. As a result, Bloem's claim survived the government's motion to dismiss and the case can move forward.

22 December 2012

Bugs in the boardroom? They're already there

Despite an ongoing joke otherwise, I did not create SHODAN. On the other hand, I have blogged and presented about SHODAN in the past, and I was one of the first people to recognize the impact of SHODAN to vulnerability identification analysis.

During a recent engagement for one of my clients, I came across an unsecured instance of a Polycom web interface; in other words this web interface required zero authentication to access all of its options (including, quite obviously, its administrative options).

I developed two searches to locate these devices. The first search finds results for telnet sessions associated with these Polycom devices. To be sure, this is more of an information search to show you how many of these sorts of devices are out there (and exposed to the Internet).

The second search is more useful: it relies on a unique HTTP response and returns exposed web interfaces for these Polycom devices. Many of these instances require additional administrative authentication, but some do not. Even though some of these devices require additional authentication, it seems at least mildly surprising that some of them are exposed to the Internet, among them: "Fargo Cass Co District Court Rm 5," and "British Embassy - Brasilia."

Here are the most common options on the front page:


The difference should be immediately available: by clicking on "Admin Settings" on the top bar, you will either be prompted for a password or not. Here (when no password is required), we are taken the Admin Settings page and every option is available to us, include remote administration and monitoring.


Low-hanging fruit to be sure, but it will literally gives you eyes and ears into the conference room.

10 July 2012

Michael Schearer answers your questions (my #defcon rant)

Let me begin this post with the (what should be unnecessary) caveat that I love all things DEFCON. The conference and the people have been nothing but good to me over the past six years. I will be there this year, and likely years into the future.

That being said, I have a particular nitpick, which I hope will be construed as constructive criticism, concerning a couple of speaking slots that are "so-and-so answers your questions." The speakers are Bruce Schneier and Kevin Poulsen. My second caveat is that this criticism is not directed to them; I don't have a problem with either guy. And this should not be construed as directed toward any given individual associated with DEFCON, because that's really not my intent. My issue is the format (as it relates to the return for the speaker).

DEFCON has presumably gotten more popular over the years as more people attend and more people submit proposals to speak. I'm not privy to these numbers, or to the overall quality of the submissions. But given the feedback I've gotten, it would seem that there are more good talks than there are speaking slots. Legitimately good talks get turned down. It happens. I have been fortunate to have most of my talks accepted. But I've been on the rejection side, too (for DEFCON and other cons). It sucks, especially when you put a lot of work into crafting what you think is a good proposal, and especially when you get good feedback from the conference and other people.

Let's talk about when "so-and-so answers your questions." Let's say we have 45-50 minutes and 3 minutes for any given question and answer. That leaves about 15-16 people (out of hundreds or thousands) who get to ask a question; or whomever can get to the microphone faster than me. Maybe I'm in the minority here, but I just don't get a lot out of these talks. But that's really a minor criticism.

My bigger concern is that people who have put time and effort into developing legitimately good proposals are unfortunately turned down for spots that require no work. When "so-and-so answers your questions," those speakers realistically don't have to prepare anything. Show up and answer questions. I could do that (if I were popular, which I am not, but I digress).

I'd like to think that in some small way, a CFP rewards people who put time and effort into the process. That isn't to say the longest or most detailed proposal should automagically be accepted; but time and effort should mean something. When I get accepted to speak at a conference, it's a treat and reward for what is often months of prior research. It means a lot. I sense that others probably feel the same way.

I realize that this criticism might seem self-serving because I didn't get selected this year (honestly, I am and was totally bummed about it; but it happens and I am not going to let it make my experience any less awesome). I'd like to think I would have this same criticism whether or not I got accepted. But this isn't about me. Better yet, I'd love to see Bruce or Kevin (or anyone in these circumstances) give a prepared talk; it shows me they actually care about putting time and effort into rewarding the attendees with thoughtful discussion instead of showing up for a handful of Q and As, something that anyone could do.

What do you think? I am whining too much and full of shit, or is there a point somewhere here?

08 March 2012

BackTrack tool review: snmpcheck

Note: This is part of a series on BackTrack 5 tool reviews. It is not meant to be an exhaustive analysis of any tool, just a demonstration of the tool using real-world targets.


This tool presumes that you know of a host running the snmp service. Alternatively, you can try finding one with a tool like SHODAN or scan with Nmap for port 161 (UDP) open.


Pretty simple--enter an IP address. Everything else is optional. If you know the snmp service is running on a different port, you can add that with the -p option. Additionally, if you happen to know the community string, add it with -c. Otherwise, snmpcheck will use the default public.

root@bt:/pentest/enumeration/snmp/snmpcheck# ./snmpcheck-1.8.pl
snmpcheck.pl v1.8 - SNMP enumerator
Copyright (c) 2005-2011 by Matteo Cantoni (www.nothink.org)

 Usage ./snmpcheck.pl -t

-t : target host;

-p : SNMP port; default port is 161;
-c : SNMP community; default is public;
-v : SNMP version (1,2); default is 1;
-r : request retries; default is 0;

-w : detect write access (separate action by enumeration);

-d : disable 'TCP connections' enumeration!
-T : force timeout in seconds; default is 20. Max is 60;
-D : enable debug;
-h : show help menu;

I found a random host with UDP port 161 open and the snmp service running. Point snmpcheck at it, and you're off:

root@bt:/pentest/enumeration/snmp/snmpcheck# ./snmpcheck-1.8.pl -t 134.48.81.17
snmpcheck.pl v1.8 - SNMP enumerator
Copyright (c) 2005-2011 by Matteo Cantoni (www.nothink.org)


 [*] Try to connect to 134.48.81.17
 [*] Connected to 134.48.81.17
 [*] Starting enumeration at 2012-03-08 20:28:07


 [*] System information
 -----------------------------------------------------------------------------------------------
 Hostname               : MARYN12105
 Description            : Hardware: x86 Family 6 Model 8 Stepping 6 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)
 Uptime system          : 6 hours, 47:16.37
 Uptime SNMP daemon     : 16 hours, 35:50.71
 Motd                   : -
 Domain (NT)            : MARQNET


 [*] User accounts
 -----------------------------------------------------------------------------------------------
 Administrator
 Guest
 arianace
 chapr
 ficengar
 mmana
 wilyrt


 [*] Network information
 -----------------------------------------------------------------------------------------------
 IP forwarding enabled   : no
 Default TTL             : 128
 TCP segments received   : 74692479
 TCP segments sent       : 57614412
 TCP segments retrans.   : 150854
 Input datagrams         : 2412799
 Delivered datagrams     : 2255627
 Output datagrams        : 1114372


 [*] Network interfaces
 -----------------------------------------------------------------------------------------------
Use of uninitialized value within @intspeed in pattern match (m//) at ./snmpcheck-1.8.pl line 676.
Use of uninitialized value within @intspeed in division (/) at ./snmpcheck-1.8.pl line 678.
 Interface               : [ up ] 3Com EtherLink PCI


Hardware Address : 00:a0:c9:c9:1a:7d
IP Address       : 134.48.81.17
Netmask          : 255.255.255.0
MTU              : 1500
Bytes In         : 1280835700 (1.2G)
Bytes Out        : 802255200 (766M)




 [*] Routing information
 -----------------------------------------------------------------------------------------------
      Destination  Next Hop       Mask Metric


          0.0.0.0     134.48.81.17          0.0.0.0        -


 [*] Listening TCP ports and connections
 -----------------------------------------------------------------------------------------------
   Local Address   Port      Remote Address   Port       State


         0.0.0.0    139             0.0.0.0    139       Listening
         0.0.0.0     23             0.0.0.0     23       Listening


 [*] Listening UDP ports
 -----------------------------------------------------------------------------------------------
   Local Address   Port


         0.0.0.0   1101
         0.0.0.0    137
         0.0.0.0    138


 [*] Non-administrative shares
 -----------------------------------------------------------------------------------------------
 Share Name : Inbox
 Path       : D:\Inbox
 Comments   : 


 Share Name : Outbox
 Path       : D:\Outbox
 Comments   : 


 [*] Wait...don't stop snmpcheck.pl...
 Total non anonymous users     : -


 [*] Enumerated 134.48.81.17 in 46.98 seconds


Windows 2000, hostname and domain, user accounts, open ports (both TCP and UDP), shares...Pretty nice bit of information gathering for one open port, don't you think?

07 March 2012

BackTrack tool review: theHarvester


Note: This is part of a series on BackTrack 5 tool reviews. It is not meant to be an exhaustive analysis of any tool, just a demonstration of the tool using real-world targets.


root@bt:/pentest/enumeration/theharvester# ./theHarvester.py 


*************************************
*TheHarvester Ver. 2.1 (reborn)     *
*Coded by Christian Martorella      *
*Edge-Security Research             *
*cmartorella@edge-security.com      *
*************************************




Usage: theharvester options 


       -d: Domain to search or company name
       -b: Data source (google,bing,bingapi,pgp,linkedin,google-profiles,exalead,all)
       -s: Start in result number X (default 0)
       -v: Verify host name via dns resolution and search for virtual hosts
       -f: Save the results into an HTML and XML file
       -n: Perform a DNS reverse query on all ranges discovered
       -c: Perform a DNS brute force for the domain name
       -t: Perform a DNS TLD expansion discovery
       -e: Use this DNS server
       -l: Limit the number of results to work with(bing goes from 50 to 50 results,
       -h: use SHODAN database to query discovered hosts
            google 100 to 100, and pgp doesn't use this option)


Examples:./theharvester.py -d microsoft.com -l 500 -b google
         ./theharvester.py -d microsoft.com -b pgp
         ./theharvester.py -d microsoft -l 200 -b linkedin


root@bt:/pentest/enumeration/theharvester# ./theHarvester.py -d un.org -b google -l 500 -h -n -c -t


*************************************
*TheHarvester Ver. 2.1 (reborn)     *
*Coded by Christian Martorella      *
*Edge-Security Research             *
*cmartorella@edge-security.com      *
*************************************




[-] Searching in Google:
Searching 0 results...
Searching 100 results...
Searching 200 results...
Searching 300 results...
Searching 400 results...
Searching 500 results...


[+] Emails found:
------------------
treaty@un.org
cocok@un.org
outreach@un.org
navarroperez@un.org
vandenwildenberg@un.org
ecu@un.org
news8@secint00.un.org
abukubi@un.org
@un.org


[+] Hosts found in search engines:
------------------------------------
157.150.185.49:www.un.org
157.150.195.212:careers.un.org
157.150.195.69:jobs.un.org
157.150.195.18:untreaty.un.org
157.150.195.187:comtrade.un.org
157.150.195.187:Comtrade.un.org
157.150.195.186:data.un.org
157.150.195.186:Data.un.org
157.150.185.49:cyberschoolbus.un.org
157.150.195.185:millenniumindicators.un.org
157.150.34.48:daccess-dds-ny.un.org
157.150.34.48:Daccess-dds-ny.un.org
157.150.195.94:mdgs.un.org
157.150.34.66:unasav4.un.org
157.150.185.202:Lists.un.org
157.150.185.201:unasav1.un.org
157.150.185.202:lists.un.org
157.150.185.28:ns1.un.org
157.150.195.76:unic.un.org
157.150.195.76:Unic.un.org
157.150.34.24:webmail02.un.org
193.188.135.35:escwa.un.org
157.150.195.153:unstats.un.org
157.150.195.153:Unstats.un.org
157.150.195.178:odslogin.un.org
157.150.196.65:myun.un.org
157.150.195.130:esa.un.org
157.150.195.105:doc.un.org
98.129.229.168:blogs.un.org
157.150.195.130:webapps01.un.org
157.150.195.193:icsc.un.org
157.150.185.49:Cyberschoolbus.un.org
157.150.195.93:dss.un.org
157.150.185.49:visit.un.org
157.150.185.49:Visit.un.org
157.150.195.94:Mdgs.un.org
157.150.195.30:unpan1.un.org
157.150.34.32:radio.un.org
157.150.34.32:Radio.un.org
157.150.34.48:daccess-ods.un.org
157.150.195.69:Jobs.un.org
157.150.195.39:secint00.un.org
157.150.34.32:endviolence.un.org
157.150.195.75:ochaonline.un.org
157.150.195.75:Ochaonline.un.org
157.150.195.130:Webapps01.un.org
157.150.195.30:Unpan1.un.org


[+] Proposed SET
---------------
[]


[+] Starting active queries:
[-]Performing reverse lookup in :157.150.185.0/24
157.150.185.255[-]Performing reverse lookup in :157.150.195.0/24
157.150.195.255[-]Performing reverse lookup in :157.150.34.0/24
157.150.34.255[-]Performing reverse lookup in :193.188.135.0/24
193.188.135.255[-]Performing reverse lookup in :157.150.196.0/24
157.150.196.255[-]Performing reverse lookup in :98.129.229.0/24
98.129.229.255Hosts found after reverse lookup:
---------------------------------
157.150.185.21:ny-mail-p-av-001.un.org
157.150.185.22:ny-mail-p-av-002.un.org
157.150.185.26:ny-mail-p-cl-001.un.org
157.150.185.27:ny-mail-p-cl-002.un.org
157.150.185.28:ns1.un.org
157.150.185.43:euq1.un.org
157.150.185.55:webmail.un.org
157.150.185.73:sftp.un.org
157.150.185.85:ws.dss.un.org
157.150.185.86:tfs.dss.un.org
157.150.185.87:ldap03.un.org
157.150.185.201:unasav1.un.org
157.150.185.202:unasav2.un.org
157.150.185.203:qa.dss.un.org
157.150.195.1:sms4.un.org
157.150.195.2:itsraudio.un.org
157.150.195.3:secap1515.un.org
157.150.195.5:www1.un.org
157.150.195.6:jsserver.un.org
157.150.195.7:secap262.un.org
157.150.195.8:cgi.un.org
157.150.195.9:www2.un.org
157.150.195.10:secint24.un.org
157.150.195.12:www4.un.org
157.150.195.14:secint05.un.org
157.150.195.16:secdhl01.un.org
157.150.195.18:untreaty.un.org
157.150.195.19:secln079.un.org
157.150.195.22:secint01.un.org
157.150.195.23:srch2.un.org
157.150.195.24:secrs02-195.un.org
157.150.195.25:secfil01.un.org
157.150.195.26:secap514.un.org
157.150.195.27:dcfs17.un.org
157.150.195.28:www0.un.org
157.150.195.29:secap591.un.org
157.150.195.30:secap061.un.org
157.150.195.31:secap254.un.org
157.150.195.33:secint02.un.org
157.150.195.34:secint03.un.org
157.150.195.36:secap068.un.org
157.150.195.37:secext1a.un.org
157.150.195.38:secext1b.un.org
157.150.195.39:secint00.un.org
157.150.195.40:secap093.un.org
157.150.195.41:secint26.un.org
157.150.195.42:secap097.un.org
157.150.195.43:websrch1.un.org
157.150.195.45:secap263.un.org
157.150.195.46:secint10.un.org
157.150.195.47:secint11.un.org
157.150.195.48:secint12.un.org
157.150.195.51:dcfs19.un.org
157.150.195.52:secap622.un.org
157.150.195.53:secap623.un.org
157.150.195.54:secap770.un.org
157.150.195.56:secap248.un.org
157.150.195.57:secap222.un.org
157.150.195.58:secap282.un.org
157.150.195.59:secap624.un.org
157.150.195.60:secap426.un.org
157.150.195.61:secap427.un.org
157.150.195.62:secap428.un.org
157.150.195.63:secap429.un.org
157.150.195.65:secap625.un.org
157.150.195.66:secap640.un.org
157.150.195.67:secap771.un.org
157.150.195.68:secap772.un.org
157.150.195.69:secap838.un.org
157.150.195.70:secap887.un.org
157.150.195.71:secap888.un.org
157.150.195.72:secap961.un.org
157.150.195.75:secap922.un.org
157.150.195.76:secint56.un.org
157.150.195.79:secap150-c3.un.org
157.150.195.81:secap014-c1.un.org
157.150.195.82:secap026.un.org
157.150.195.83:secap027.un.org
157.150.195.86:secap408.un.org
157.150.195.87:secap409.un.org
157.150.195.88:secap410.un.org
157.150.195.90:secap414.un.org
157.150.195.91:training.epas.un.org
157.150.195.92:netscaler-unpa.un.org
157.150.195.93:secap510.un.org
157.150.195.94:secap509.un.org
157.150.195.96:ictsurvey.un.org
157.150.195.97:secap056-c5.un.org
157.150.195.101:secint33.un.org
157.150.195.102:secint34.un.org
157.150.195.103:secint35.un.org
157.150.195.104:secint36.un.org
157.150.195.105:secint38.un.org
157.150.195.106:secint50.un.org
157.150.195.110:escwadr.un.org
157.150.195.111:ns2e.un.org
157.150.195.116:secnet020.un.org
157.150.195.132:secap836.un.org
157.150.195.135:secap308.un.org
157.150.195.136:secap034.un.org
157.150.195.139:secap685-c1.un.org
157.150.195.157:secnet045.un.org
157.150.195.160:secnet050.un.org
157.150.195.163:secap1032.un.org
157.150.195.168:secnet069.un.org
157.150.195.185:secnet086.un.org
157.150.195.186:secnet087.un.org
157.150.195.187:secnet088.un.org
157.150.195.188:secnet089.un.org
157.150.195.190:mobileoffice.un.org
157.150.195.193:secnet105.un.org
157.150.195.194:secnet106.un.org
157.150.195.203:dfs-vbpproxy-03.un.org
157.150.195.204:secap1315.un.org
157.150.195.206:secnet128.un.org
157.150.195.207:unsmin.un.org
157.150.195.208:secnet153.un.org
157.150.195.209:secnet154.un.org
157.150.195.210:secnet156.un.org
157.150.195.211:secnet157.un.org
157.150.195.212:secnet158.un.org
157.150.195.213:secap1439.un.org
157.150.195.214:secent161.un.org
157.150.195.215:secnetdss-tmp.un.org
157.150.195.216:secnet162.un.org
157.150.195.217:secnet163.un.org
157.150.195.218:secnet164.un.org
157.150.195.219:dfs-vbpproxy-01.un.org
157.150.195.220:dfs-vppproxy-02.un.org
157.150.195.221:secnet173.un.org
157.150.195.222:mobileofficebeta.un.org
157.150.195.238:seclg01-195.un.org
157.150.195.239:seclgnd3-195.un.org
157.150.34.20:ny-mail-r-av-001.un.org
157.150.34.21:ny-mail-r-av-002.un.org
157.150.34.31:sftp.un.org
157.150.34.37:ny-mail-r-cl-001.un.org
157.150.34.38:ny-mail-r-cl-002.un.org
157.150.34.40:ldap02.un.org
157.150.34.43:webmaildr.un.org
157.150.34.49:euq2.un.org
157.150.34.57:ns2.un.org
157.150.34.65:unasav3.un.org
157.150.34.66:unasav4.un.org
157.150.34.68:ldap04.un.org
157.150.196.1:intranet.un.org
157.150.196.3:esdstest.un.org
157.150.196.11:secln017.un.org
157.150.196.20:secap092.un.org
157.150.196.22:wwwppbd.un.org
157.150.196.29:intranet3.un.org
157.150.196.34:secap149.un.org
157.150.196.36:galaxy.un.org
157.150.196.38:secap137.un.org
157.150.196.41:galaxy-training.un.org
157.150.196.52:secap179.un.org
157.150.196.53:secap180.un.org
157.150.196.62:eassets.un.org
157.150.196.63:secap220.un.org
157.150.196.65:secap235.un.org
157.150.196.86:iseek.un.org
157.150.196.196:telecommutingapps.un.org
157.150.196.200:unhq-appsuat-c1.un.org
[-] Starting DNS brute force:
zlog.un.org[+] Hosts found after DNS brute force:
[-] Starting DNS TLD expansion:
Searching for: un.aero
[+] Hosts found after DNS TLD expansion:
==========================================
157.150.34.32:un.org
[+] Shodan Database search:
Searching for: 157.150.185.49:www.un.org
Searching for: 157.150.195.212:careers.un.org
Searching for: 157.150.195.69:jobs.un.org
Searching for: 157.150.195.18:untreaty.un.org
Searching for: 157.150.195.187:comtrade.un.org
Searching for: 157.150.195.187:Comtrade.un.org
Searching for: 157.150.195.186:data.un.org
Searching for: 157.150.195.186:Data.un.org
Searching for: 157.150.185.49:cyberschoolbus.un.org
Searching for: 157.150.195.185:millenniumindicators.un.org
Searching for: 157.150.34.48:daccess-dds-ny.un.org
Searching for: 157.150.34.48:Daccess-dds-ny.un.org
Searching for: 157.150.195.94:mdgs.un.org
Searching for: 157.150.34.66:unasav4.un.org
Searching for: 157.150.185.202:Lists.un.org
Searching for: 157.150.185.201:unasav1.un.org
Searching for: 157.150.185.202:lists.un.org
Searching for: 157.150.185.28:ns1.un.org
Searching for: 157.150.195.76:unic.un.org
Searching for: 157.150.195.76:Unic.un.org
Searching for: 157.150.34.24:webmail02.un.org
Searching for: 193.188.135.35:escwa.un.org
Searching for: 157.150.195.153:unstats.un.org
Searching for: 157.150.195.153:Unstats.un.org
Searching for: 157.150.195.178:odslogin.un.org
Searching for: 157.150.196.65:myun.un.org
Searching for: 157.150.195.130:esa.un.org
Searching for: 157.150.195.105:doc.un.org
Searching for: 98.129.229.168:blogs.un.org
Searching for: 157.150.195.130:webapps01.un.org
Searching for: 157.150.195.193:icsc.un.org
Searching for: 157.150.185.49:Cyberschoolbus.un.org
Searching for: 157.150.195.93:dss.un.org
Searching for: 157.150.185.49:visit.un.org
Searching for: 157.150.185.49:Visit.un.org
Searching for: 157.150.195.94:Mdgs.un.org
Searching for: 157.150.195.30:unpan1.un.org
Searching for: 157.150.34.32:radio.un.org
Searching for: 157.150.34.32:Radio.un.org
Searching for: 157.150.34.48:daccess-ods.un.org
Searching for: 157.150.195.69:Jobs.un.org
Searching for: 157.150.195.39:secint00.un.org
Searching for: 157.150.34.32:endviolence.un.org
Searching for: 157.150.195.75:ochaonline.un.org
Searching for: 157.150.195.75:Ochaonline.un.org
Searching for: 157.150.195.130:Webapps01.un.org
Searching for: 157.150.195.30:Unpan1.un.org
Searching for: 157.150.185.21:ny-mail-p-av-001.un.org
Searching for: 157.150.185.22:ny-mail-p-av-002.un.org
Searching for: 157.150.185.26:ny-mail-p-cl-001.un.org
Searching for: 157.150.185.27:ny-mail-p-cl-002.un.org
Searching for: 157.150.185.43:euq1.un.org
Searching for: 157.150.185.55:webmail.un.org
Searching for: 157.150.185.73:sftp.un.org
Searching for: 157.150.185.85:ws.dss.un.org
Searching for: 157.150.185.86:tfs.dss.un.org
Searching for: 157.150.185.87:ldap03.un.org
Searching for: 157.150.185.202:unasav2.un.org
Searching for: 157.150.185.203:qa.dss.un.org
Searching for: 157.150.195.1:sms4.un.org
Searching for: 157.150.195.2:itsraudio.un.org
Searching for: 157.150.195.3:secap1515.un.org
Searching for: 157.150.195.5:www1.un.org
Searching for: 157.150.195.6:jsserver.un.org
Searching for: 157.150.195.7:secap262.un.org
Searching for: 157.150.195.8:cgi.un.org
Searching for: 157.150.195.9:www2.un.org
Searching for: 157.150.195.10:secint24.un.org
Searching for: 157.150.195.12:www4.un.org
Searching for: 157.150.195.14:secint05.un.org
Searching for: 157.150.195.16:secdhl01.un.org
Searching for: 157.150.195.19:secln079.un.org
Searching for: 157.150.195.22:secint01.un.org
Searching for: 157.150.195.23:srch2.un.org
Searching for: 157.150.195.24:secrs02-195.un.org
Searching for: 157.150.195.25:secfil01.un.org
Searching for: 157.150.195.26:secap514.un.org
Searching for: 157.150.195.27:dcfs17.un.org
Searching for: 157.150.195.28:www0.un.org
Searching for: 157.150.195.29:secap591.un.org
Searching for: 157.150.195.30:secap061.un.org
Searching for: 157.150.195.31:secap254.un.org
Searching for: 157.150.195.33:secint02.un.org
Searching for: 157.150.195.34:secint03.un.org
Searching for: 157.150.195.36:secap068.un.org
Searching for: 157.150.195.37:secext1a.un.org
Searching for: 157.150.195.38:secext1b.un.org
Searching for: 157.150.195.40:secap093.un.org
Searching for: 157.150.195.41:secint26.un.org
Searching for: 157.150.195.42:secap097.un.org
Searching for: 157.150.195.43:websrch1.un.org
Searching for: 157.150.195.45:secap263.un.org
Searching for: 157.150.195.46:secint10.un.org
Searching for: 157.150.195.47:secint11.un.org
Searching for: 157.150.195.48:secint12.un.org
Searching for: 157.150.195.51:dcfs19.un.org
Searching for: 157.150.195.52:secap622.un.org
Searching for: 157.150.195.53:secap623.un.org
Searching for: 157.150.195.54:secap770.un.org
Searching for: 157.150.195.56:secap248.un.org
Searching for: 157.150.195.57:secap222.un.org
Searching for: 157.150.195.58:secap282.un.org
Searching for: 157.150.195.59:secap624.un.org
Searching for: 157.150.195.60:secap426.un.org
Searching for: 157.150.195.61:secap427.un.org
Searching for: 157.150.195.62:secap428.un.org
Searching for: 157.150.195.63:secap429.un.org
Searching for: 157.150.195.65:secap625.un.org
Searching for: 157.150.195.66:secap640.un.org
Searching for: 157.150.195.67:secap771.un.org
Searching for: 157.150.195.68:secap772.un.org
Searching for: 157.150.195.69:secap838.un.org
Searching for: 157.150.195.70:secap887.un.org
Searching for: 157.150.195.71:secap888.un.org
Searching for: 157.150.195.72:secap961.un.org
Searching for: 157.150.195.75:secap922.un.org
Searching for: 157.150.195.76:secint56.un.org
Searching for: 157.150.195.79:secap150-c3.un.org
Searching for: 157.150.195.81:secap014-c1.un.org
Searching for: 157.150.195.82:secap026.un.org
Searching for: 157.150.195.83:secap027.un.org
Searching for: 157.150.195.86:secap408.un.org
Searching for: 157.150.195.87:secap409.un.org
Searching for: 157.150.195.88:secap410.un.org
Searching for: 157.150.195.90:secap414.un.org
Searching for: 157.150.195.91:training.epas.un.org
Searching for: 157.150.195.92:netscaler-unpa.un.org
Searching for: 157.150.195.93:secap510.un.org
Searching for: 157.150.195.94:secap509.un.org
Searching for: 157.150.195.96:ictsurvey.un.org
Searching for: 157.150.195.97:secap056-c5.un.org
Searching for: 157.150.195.101:secint33.un.org
Searching for: 157.150.195.102:secint34.un.org
Searching for: 157.150.195.103:secint35.un.org
Searching for: 157.150.195.104:secint36.un.org
Searching for: 157.150.195.105:secint38.un.org
Searching for: 157.150.195.106:secint50.un.org
Searching for: 157.150.195.110:escwadr.un.org
Searching for: 157.150.195.111:ns2e.un.org
Searching for: 157.150.195.116:secnet020.un.org
Searching for: 157.150.195.132:secap836.un.org
Searching for: 157.150.195.135:secap308.un.org
Searching for: 157.150.195.136:secap034.un.org
Searching for: 157.150.195.139:secap685-c1.un.org
Searching for: 157.150.195.157:secnet045.un.org
Searching for: 157.150.195.160:secnet050.un.org
Searching for: 157.150.195.163:secap1032.un.org
Searching for: 157.150.195.168:secnet069.un.org
Searching for: 157.150.195.185:secnet086.un.org
Searching for: 157.150.195.186:secnet087.un.org
Searching for: 157.150.195.187:secnet088.un.org
Searching for: 157.150.195.188:secnet089.un.org
Searching for: 157.150.195.190:mobileoffice.un.org
Searching for: 157.150.195.193:secnet105.un.org
Searching for: 157.150.195.194:secnet106.un.org
Searching for: 157.150.195.203:dfs-vbpproxy-03.un.org
Searching for: 157.150.195.204:secap1315.un.org
Searching for: 157.150.195.206:secnet128.un.org
Searching for: 157.150.195.207:unsmin.un.org
Searching for: 157.150.195.208:secnet153.un.org
Searching for: 157.150.195.209:secnet154.un.org
Searching for: 157.150.195.210:secnet156.un.org
Searching for: 157.150.195.211:secnet157.un.org
Searching for: 157.150.195.212:secnet158.un.org
Searching for: 157.150.195.213:secap1439.un.org
Searching for: 157.150.195.214:secent161.un.org
Searching for: 157.150.195.215:secnetdss-tmp.un.org
Searching for: 157.150.195.216:secnet162.un.org
Searching for: 157.150.195.217:secnet163.un.org
Searching for: 157.150.195.218:secnet164.un.org
Searching for: 157.150.195.219:dfs-vbpproxy-01.un.org
Searching for: 157.150.195.220:dfs-vppproxy-02.un.org
Searching for: 157.150.195.221:secnet173.un.org
Searching for: 157.150.195.222:mobileofficebeta.un.org
Searching for: 157.150.195.238:seclg01-195.un.org
Searching for: 157.150.195.239:seclgnd3-195.un.org
Searching for: 157.150.34.20:ny-mail-r-av-001.un.org
Searching for: 157.150.34.21:ny-mail-r-av-002.un.org
Searching for: 157.150.34.31:sftp.un.org
Searching for: 157.150.34.37:ny-mail-r-cl-001.un.org
Searching for: 157.150.34.38:ny-mail-r-cl-002.un.org
Searching for: 157.150.34.40:ldap02.un.org
Searching for: 157.150.34.43:webmaildr.un.org
Searching for: 157.150.34.49:euq2.un.org
Searching for: 157.150.34.57:ns2.un.org
Searching for: 157.150.34.65:unasav3.un.org
Searching for: 157.150.34.68:ldap04.un.org
Searching for: 157.150.196.1:intranet.un.org
Searching for: 157.150.196.3:esdstest.un.org
Searching for: 157.150.196.11:secln017.un.org
Searching for: 157.150.196.20:secap092.un.org
Searching for: 157.150.196.22:wwwppbd.un.org
Searching for: 157.150.196.29:intranet3.un.org
Searching for: 157.150.196.34:secap149.un.org
Searching for: 157.150.196.36:galaxy.un.org
Searching for: 157.150.196.38:secap137.un.org
Searching for: 157.150.196.41:galaxy-training.un.org
Searching for: 157.150.196.52:secap179.un.org
Searching for: 157.150.196.53:secap180.un.org
Searching for: 157.150.196.62:eassets.un.org
Searching for: 157.150.196.63:secap220.un.org
Searching for: 157.150.196.65:secap235.un.org
Searching for: 157.150.196.86:iseek.un.org
Searching for: 157.150.196.196:telecommutingapps.un.org
Searching for: 157.150.196.200:unhq-appsuat-c1.un.org
Searching for: 157.150.34.32:un.org
[+] Shodan results:
===================