How To Find Unsecured Camera Feeds

Search engines index websites on the web so you tin can find them more efficiently, and the same is truthful for internet-connected devices. Shodan indexes devices similar webcams, printers, and even industrial controls into one piece of cake-to-search database, giving hackers admission to vulnerable devices online across the globe. And you can search its database via its website or command-line library.

Shodan has inverse the manner hackers build tools, every bit it allows for a large part of the target discovery phase to be automatic. Rather than needing to scan the entire net, hackers can enter the right search terms to get a massive listing of potential targets. Shodan's Python library allows hackers to apace write Python scripts that fill in potential targets according to which vulnerable devices connect at any given moment.

You tin imagine hunting for vulnerable devices as similar to trying to discover all the pages on the internet about a specific topic. Rather than searching every page available on the web yourself, you tin enter a particular term into a search engine to get the most up-to-date, relevant results. The same is true for discovering continued devices, and what you can find online may surprise y'all!

Footstep 1: Log in to Shodan

First, whether using the website or the command line, you need to log in to shodanhq.com in a web browser. Although yous can use Shodan without logging in, Shodan restricts some of its capabilities to only logged-in users. For case, you tin only view one page of search results without logging in. And you can only see ii pages of search results when logged in to a free account. Equally for the control line, you will need your API Key to perform some requests.

Pace ii: Prepare Upward Shodan via Command Line (Optional)

A peculiarly useful feature of Shodan is that you don't need to open a web browser to use it if you know your API Key. To install Shodan, you'll demand to have a working Python installation. Then, you lot tin can type the following in a final window to install the Shodan library.

            ~$ pip install shodan  Collecting shodan   Downloading https://files.pythonhosted.org/packages/22/93/22500512fd9d1799361505a1537a659dbcdd5002192980ad492dc5262717/shodan-ane.14.0.tar.gz (46kB)     100% |████████████████████████████████| 51kB 987kB/south Requirement already satisfied: XlsxWriter in /usr/lib/python2.7/dist-packages (from shodan) (ane.1.ii) Requirement already satisfied: click in /usr/lib/python2.7/dist-packages (from shodan) (vii.0) Collecting click-plugins (from shodan)   Downloading https://files.pythonhosted.org/packages/e9/da/824b92d9942f4e472702488857914bdd50f73021efea15b4cad9aca8ecef/click_plugins-1.ane.i-py2.py3-none-any.whl Requirement already satisfied: colorama in /usr/lib/python2.7/dist-packages (from shodan) (0.iii.7) Requirement already satisfied: requests>=2.2.1 in /usr/lib/python2.seven/dist-packages (from shodan) (2.21.0) Building wheels for collected packages: shodan   Running setup.py bdist_wheel for shodan ... done   Stored in directory: /root/.cache/pip/wheels/fb/99/c7/f763e695efe05966126e1a114ef7241dc636dca3662ee29883 Successfully built shodan Installing collected packages: click-plugins, shodan Successfully installed click-plugins-1.one.1 shodan-1.14.0          

So, you can see all the available options -h to bring up the help menu.

            ~$ shodan -h  Usage: shodan [OPTIONS] Control [ARGS]...  Options:   -h, --help  Show this bulletin and exit.  Commands:   warning       Manage the network alerts for your account   convert     Catechumen the given input information file into a different format.   count       Returns the number of results for a search   data        Majority information admission to Shodan   domain      View all available information for a domain   download    Download search results and salvage them in a compressed JSON...   honeyscore  Bank check whether the IP is a honeypot or not.   host        View all available information for an IP address   info        Shows general information about your business relationship   init        Initialize the Shodan control-line   myip        Print your external IP address   org         Manage your organization's admission to Shodan   parse       Extract information out of compressed JSON files.   radar       Existent-Fourth dimension Map of some results as Shodan finds them.   scan        Scan an IP/ netblock using Shodan.   search      Search the Shodan database   stats       Provide summary information near a search query   stream      Stream data in existent-time.   version     Print version of this tool.          

These controls are pretty straightforward, just not all of them work without connecting it to your Shodan API Central. In a web browser, log in to your Shodan account, then go to "My Account" where you'll see your unique API Key. Copy it, then use the init command to connect the key.

• Don't Miss How to Use the Shodan API with Python to Automate Scans for Vulnerable Devices (Like Mr. Robot)

            ~$ shodan init XXXXxxxxXXXXxxXxXXXxXxxXxxxXXXxX  Successfully initialized          

Step three: Search for Accessible Webcams

In that location are many ways to find webcams on Shodan. Usually, using the proper name of the webcam's manufacturer or webcam server is a good kickoff. Shodan indexes the information in the banner, not the content, which means that if the manufacturer puts its name in the banner, you can search by it. If information technology doesn't, and then the search will be fruitless.

1 of my favorites is webcamxp, a webcam and network camera software designed for older Windows systems. After typing this into the Shodan search engine online, it pulls up links to hundreds, if non thousands, of web-enabled security cameras around the world.

To do this from the control line, use the search pick. (Results below truncated.)

            ~$ shodan search webcamxp  81.133.███.███  8080    ████81-133-███-███.in-addr.btopenworld.com HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-8\r\nConten t-Length: 7313\r\nCache-control: no-enshroud, must revalidate\r\nDate: Tue, 06 Aug 2019 21:39:29 GMT\r\nExpires: Tue, 06 Aug 2019 21:39:29 GMT\r\nPragma: no-cache\r\nServer: webcamXP five\r\n\r\n  74.218.███.██   8080    ████-74-218-███-██.se.biz.rr.com HTTP/1.1 200 OK\r\nConnection: shut\r\nContent-Blazon: text/html; charset=utf-8\r\nContent-Length: 7413\r\nCache-control: no-cache, must revalidate\r\nDate: Wed, 07 Aug 2019 xiv:22:02 GMT\r\nExpires: Wednesday, 07 Aug 2019 fourteen:22:02 GMT\r\nPragma: no-cache\r\nServer: webcamXP 5\r\n\r\n  208.83.██.205   9206    ████████████.joann.com    HTTP/one.i 704 t\r\nServer: webcam XP\r\north\r\northward  115.135.██.185  8086 HTTP/1.1 200 OK\r\nConnection: close\r\nContent-Blazon: text/html; charset=utf-8\r\nContent-Length: 2192\r\nCache-command: no-cache, must revalidate\r\nDate: Wed, 07 Aug 2019 06:49:20 GMT\r\nExpires: Wed, 07 Aug 2019 06:49:20 GMT\r\nPragma: no-enshroud\r\nServer: webcamXP 5\r\due north\r\north  137.118.███.107 8080    137-118-███-███.wilkes.net HTTP/ane.1 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-eight\r\nContent-Length: 2073\r\nCache-command: no-cache, must revalidate\r\nDate: Wed, 07 Aug 2019 12:37:54 GMT\r\nExpires: Wed, 07 Aug 2019 12:37:54 GMT\r\nPragma: no-cache\r\nServer: webcamXP 5\r\n\r\n  218.161.██.██   8080    218-161-██-██.HINET-IP.hinet.cyberspace HTTP/1.1 200 OK\r\nConnection: shut\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 7431\r\nCache-control: no-cache, must revalidate\r\nDate: Mon, 05 Aug 2019 18:39:52 GMT\r\nExpires: Mon, 05 Aug 2019 eighteen:39:52 GMT\r\nPragma: no-cache\r\nServer: webcamXP v\r\n\r\north  ...  92.78.██.███    37215   ███-092-078-███-███.███.███.pools.vodafone-ip.de HTTP/1.ane 200 OK\r\nConnection: close\r\nContent-Blazon: text/html; charset=utf-eight\r\nContent-Length: 8163\r\nCache-command: no-cache, must revalidate\r\nDate: Wed, 07 Aug 2019 05:17:22 GMT\r\nExpires: Wednesday, 07 Aug 2019 05:17:22 GMT\r\nPragma: no-cache\r\nServer: webcamXP v\r\n\r\n  85.157.██.███   8080    ████████.netikka.fi HTTP/1.i 200 OK\r\nConnection: close\r\nContent-Type: text/html; charset=utf-viii\r\nContent-Length: 7947\r\nCache-control: no-cache, must revalidate\r\nDate: Wed, 07 Aug 2019 00:25:41 GMT\r\nExpires: Wed, 07 Aug 2019 00:25:41 GMT\r\nPragma: no-cache\r\nServer: webcamXP 5\r\north\r\n  108.48.███.███  8080    ████-108-48-███-███.washdc.fios.verizon.cyberspace HTTP/i.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 339\r\nCache-command: no-cache, must revalidate\r\nDate: Tue, 06 Aug 2019 22:xl:21 GMT\r\nExpires: Tue, 06 Aug 2019 22:17:21 GMT\r\nPragma: no-cache\r\nServer: webcamXP\r\nWWW-Authenticate: Bones realm="webcamXP"\r\nContent-Type: text/html\r\n\r\n  (Terminate)          

To exit results, hit Q on your keyboard. If y'all simply want to see certain fields instead of everything, there are means to omit some information. First, let'southward run across how the syntax works past viewing the help page for search.

            ~$ shodan search -h  Usage: shodan search [OPTIONS] <search query>    Search the Shodan database  Options:   --colour / --no-colour   --fields TEXT         List of backdrop to evidence in the search results.   --limit INTEGER       The number of search results that should exist returned.                         Maximum: 1000   --separator TEXT      The separator betwixt the properties of the search                         results.   -h, --help            Bear witness this message and get out.          

Unfortunately, the assist page does non list all of the available fields you can search, but Shodan's website has a handy list, seen below.

            Properties:  asn                         [String] The autonomous system number (ex. "AS4837"). data                        [Cord] Contains the imprint data for the service. ip                          [Integer] The IP address of the host as an integer. ip_str                      [String] The IP address of the host as a string. ipv6                        [String] The IPv6 address of the host as a string. If this is present then the "ip" and "ip_str" fields wont be. port                        [Integer] The port number that the service is operating on. timestamp                   [String] The timestamp for when the banner was fetched from the device in the UTC timezone. Example: "2014-01-15T05:49:56.283713" hostnames                   [String[]] An array of strings containing all of the hostnames that have been assigned to the IP address for this device. domains                     [String[]] An array of strings containing the height-level domains for the hostnames of the device. This is a utility property in instance y'all want to filter by TLD instead of subdomain. It is smart enough to handle global TLDs with several dots in the domain (ex. "co.uk") location                    [Object] An object containing all of the location information for the device. location.area_code          [Integer]The area lawmaking for the device's location. Just bachelor for the U.s.. location.city               [String] The proper name of the urban center where the device is located. location.country_code       [String] The 2-letter of the alphabet country lawmaking for the device location. location.country_code3      [String] The iii-letter country code for the device location. location.country_name       [String] The name of the state where the device is located. location.dma_code           [Integer] The designated market expanse lawmaking for the surface area where the device is located. But available for the US. location.latitude           [Double] The breadth for the geolocation of the device. location.longitude          [Double] The longitude for the geolocation of the device. location.postal_code        [Cord] The postal code for the device'southward location. location.region_code        [String] The name of the region where the device is located. opts                        [Object] Contains experimental and supplemental data for the service. This tin can include the SSL document, robots.txt and other raw information that hasn't notwithstanding been formalized into the Banner Specification. org                         [Cord] The proper name of the organization that is assigned the IP infinite for this device. internet access provider                         [Cord] The Isp that is providing the organization with the IP infinite for this device. Consider this the "parent" of the arrangement in terms of IP buying. os                          [String] The operating system that powers the device. send                   [Cord] Either "udp" or "tcp" to signal which IP send protocol was used to fetch the data  Optional Properties:  uptime                      [Integer] The number of minutes that the device has been online. link                        [Cord] The network link blazon. Possible values are: "Ethernet or modem", "generic tunnel or VPN", "DSL", "IPIP or SIT", "SLIP", "IPSec or GRE", "VLAN", "jumbo Ethernet", "Google", "GIF", "PPTP", "loopback", "AX.25 radio modem". championship                       [String] The title of the website as extracted from the HTML source. html                        [String] The raw HTML source for the website. product                     [String] The name of the production that generated the banner. version                     [Cord] The version of the product that generated the banner. devicetype                  [String] The type of device (webcam, router, etc.). info                        [String] Miscellaneous information that was extracted about the product. cpe                         [String] The relevant Mutual Platform Enumeration for the production or known vulnerabilities if available. For more information on CPE and the official lexicon of values visit the CPE Dictionary.  SSL Properties: If the service uses SSL, such as HTTPS, then the banner will also contain a property called "ssl":  ssl.cert                    [Object] The parsed certificate backdrop that includes information such as when it was issued, the SSL extensions, the issuer, discipline etc. ssl.cipher                  [Object] Preferred cipher for the SSL connexion ssl.chain                   [Array] An array of certificates, where each string is a PEM-encoded SSL certificate. This includes the user SSL certificate up to its root certificate. ssl.dhparams                [Object] The Diffie-Hellman parameters if available: "prime", "public_key", "bits", "generator" and an optional "fingerprint" if we know which program generated these parameters. ssl.versions                [Array] A listing of SSL versions that are supported by the server. If a version isnt supported the value is prefixed with a "-". Instance: ["TLSv1", "-SSLv2"] ways that the server supports TLSv1 but doesnt support SSLv2.          

So, if we wanted to only view the IP address, port number, arrangement name, and hostnames for the IP address, we could apply --fields as such:

            ~$ shodan search --fields ip_str,port,org,hostnames webcamxp  81.133.███.███  8080    BT                      ████81-133-███-███.in-addr.btopenworld.com 74.218.███.██   8080    Spectrum Business organisation       ████-74-218-███-██.se.biz.rr.com 208.83.██.███   9206    Jo-ann Stores, LLC      ████████████.joann.com 115.135.██.███  8086    TM Internet 137.118.███.███ 8080    Wilkes Communications   137-118-███-███.wilkes.internet 218.161.██.██   8080    HiNet                   218-161-██-██.HINET-IP.hinet.net ... 92.78.██.███    37215   Vodafone DSL            ███-092-078-███-███.███.███.pools.vodafone-ip.de 85.157.██.███   8080    Elisa Oyj               ████████.netikka.fi 108.48.███.███  8080    Verizon Fios            ████-108-48-███-███.washdc.fios.verizon.net  (Cease)          

Look through the results and find webcams you desire to try out. Input their domain name into a browser and see if y'all go instant access. Here is an assortment of open webcams from diverse hotels in Palafrugell, Spain, that I was able to access without any login credentials:

Although it can be fun and exciting to voyeuristically lookout what's going on in front of these unprotected security cameras, unbeknownst to people around the world, yous probably desire to be more specific in your search for webcams.

Try Default Username & Passwords

Although some of the webcams Shodan shows y'all are unprotected, many of them will crave hallmark. To attempt to gain access without too much effort, try the default username and password for the security photographic camera hardware or software. I have compiled a short list of the default username and passwords of some of the near widely used webcams below.

• ACTi: admin/123456 or Admin/123456
• Axis (traditional): root/pass,
• Axis (new): requires password creation during first login
• Cisco: No default countersign, requires creation during outset login
• Grandstream: admin/admin
• IQinVision: root/organization
• Mobotix: admin/meinsm
• Panasonic: admin/12345
• Samsung Electronics: root/root or admin/4321
• Samsung Techwin (onetime): admin/1111111
• Samsung Techwin (new): admin/4321
• Sony: admin/admin
• TRENDnet: admin/admin
• Toshiba: root/ikwd
• Vivotek: root/<blank>
• WebcamXP: admin/ <blank>

At that place is no guarantee that any of those will piece of work, but many inattentive and lazy administrators simply leave the default settings in identify. In those cases, the default usernames and passwords for the hardware or software will give yous access to confidential and private webcams around the world.

Step iv: Search for Webcams by Geography

Now that we know how to notice webcams and potentially log in to them using default usernames and passwords, let'south get more specific and attempt to find webcams in a specific geographical location. For example, if we were interested in webcams by the manufacturer WebcamXP in Australia, we could discover them by typing webcamxp country:AU into the search box on Shodan's website.

And then how would we do an advanced search in the command line? Here's a quick listing of some of the things y'all can search for in Shodan via the command line:

            after:              Search past a timeframe delimiter for things after a sure date. asn:                Search past the autonomous system number. before:             Search by a timeframe delimiter for things before a certain date. metropolis:               Search by the metropolis where the device is located. country:            Search by the country where the device is located (ii-letter of the alphabet lawmaking). device:             Search by the device or network'due south proper name. devicetype:         Search by the blazon of device (webcam, router, etc.). domain:             Search an array of strings containing the acme-level domains for the hostnames of the device. geo:                Search by the coordinates where the device is located. hash:               Search by the banner hash. has_screenshot:true Search for devices where a screenshot is present. hostname:           Search by the hostname that has been assigned to the IP accost for the device. ip:                 Search past the IP address of the host as an integer. ip_str:             Search by the IP address of the host as a string. ipv6:               Search by the IPv6 address of the host as a string. isp:                Search past the ISP that is providing the arrangement with the IP space for the device. link:               Search by the network link type. Possible values are: "Ethernet or modem", "generic tunnel or VPN", "DSL", "IPIP or Sit", "SLIP", "IPSec or GRE", "VLAN", "jumbo Ethernet", "Google", "GIF", "PPTP", "loopback", "AX.25 radio modem". net:                Filter by network range or IP in CIDR notation. port:               Find devices based on the open ports/ software. org:                Search for devices that are on a specific arrangement's network. os:                 Search past the operating system that powers the device. state:              Search past the state where the device is located (two-alphabetic character code). title:              Search by text within the title of the website as extracted from the HTML source.          

And then if we were to search webcamxp state:AU on the website directly, to do it from the command line, yous would format as one of the ways below. However, if you're not on a paid plan, yous can't use the Shodan API to perform detailed searches like we are trying to here. But you can even so perform an advanced search on Shodan'due south website, with the regular restrictions for costless users.

            ~$ shodan search webcamxp country:AU ~$ shodan search device:webcamxp state:AU          

On the website, searching for webcamxp country:AU volition pull up a list of every WebcamXP in Australia that is web-enabled in Shodan's index, as shown below.

Pace five: Narrow Your Search for Webcams to a Urban center

To be even more specific, we tin can narrow our search down to an individual urban center. Let'southward see what we can find in Sydney, Australia, past typing webcamxp city:sydney into the website's search bar. For the command line, information technology would look similar 1 of the following commands — but information technology's a paid-but feature with the API.

            ~$ shodan search webcamxp city:sydney ~$ shodan search device:webcamxp city:sydney          

On the Shodan website, the search yields the results beneath.

When we click on one of these links, we find ourselves in someone'south backyard in Sydney, Australia!

Footstep half dozen: Find Webcams by Longitude & Latitude

Shodan even enables u.s. to be very specific in searching for spider web-enabled devices. In some cases, nosotros can specify the longitude and breadth of the devices we want to find.

In this case, nosotros will exist looking for WebcamXP cameras at the longitude and latitude (-37.81, 144.96) of the city of Melbourne, Australia. When we search, we go a list of every WebcamXP at those coordinates on the earth. We must utilise the keyword geo followed past the longitude and latitude. So in the search bar, utilise webcamxp geo: -37.81,144.96. On the command line interface, again, which is a paid characteristic, it'd look similar one of these:

            ~$ shodan search webcamxp geo:-37.81,144.96 ~$ shodan search device:webcamxp geo:-37.81,144.96          

When we become that specific, on Shodan'south website, it merely finds four WebcamXP cameras. Click on 1, and we tin find that once more, we take a individual webcam view of someone'due south camera in their backyard in Melbourne, Australia.

Step 7: Shodan from the Command Line

Something nosotros tin do from the command-line interface that nosotros tin't from the website is search for information on a host. For instance, nosotros can run the shodan myip command to print our external IP.

            ~$ shodan myip  174.███.██.███          

Once nosotros know it, we can search Shodan for data by running the host command.

            ~$ shodan host 174.███.██.███  174.███.██.███ Hostnames:               cpe-174-███-██-███.socal.res.rr.com Country:                 United states of america System:            Spectrum Updated:                 2019-08-02T23:04:59.182949 Number of open up ports:    i  Ports:      80/tcp          

Shodan Is a Powerful Manner to Detect Devices Across the Internet

I promise this short demonstration of the power Shodan gets your imagination stimulated for inventive ways you tin can find private webcams anywhere on the globe! If y'all're too impatient to chase down webcams on Shodan, you can utilize a website like Insecam to view attainable webcams yous can watch right at present. For instance, you tin view all the WebcamXP cameras that accept pictures.

Whether you utilize Shodan or an easier site such as Insecam to view webcams, don't limit yourself to WebcamXP, merely instead try each of the webcam manufacturers at a specific location, and who knows what you volition find.

I promise you enjoyed this guide to using Shodan to discover vulnerable devices. If you lot have any questions most this tutorial on using Shodan or have a comment, ask beneath or feel free to attain me on Twitter @KodyKinzie.

Want to start making money as a white hat hacker? Jump-get-go your hacking career with our 2020 Premium Ethical Hacking Certification Training Bundle from the new Null Byte Shop and get over lx hours of training from cybersecurity professionals.

Buy At present (90% off) >

Other worthwhile deals to bank check out:

• 97% off The Ultimate 2021 White Hat Hacker Certification Packet
• 99% off The 2021 All-in-1 Data Scientist Mega Bundle
• 98% off The 2021 Premium Learn To Lawmaking Certification Packet
• 62% off MindMaster Mind Mapping Software: Perpetual License

Cover image via Val Thoermer/Shutterstock; Screenshots and GIF by Kody/Null Byte

Source: https://null-byte.wonderhowto.com/how-to/find-vulnerable-webcams-across-globe-using-shodan-0154830/

Posted by: raulstonsommom90.blogspot.com

Share this post