Finding Exposed Services (and Vulnerabilities) with Programmatic Network Searches

#devops #python #security #networking

Ever been in a situation where you need to quickly check if a specific service is exposed on the internet, or track down instances of a particular software version running on publicly accessible devices? Traditional port scanning against a few known IPs is one thing, but what if you need to cast a wider net, or even discover devices you didn't know about?

This is where internet-wide search engines for network devices come in handy. They continuously scan the internet, index services, and often identify vulnerabilities, making it possible to query this vast dataset for specific information. Today, we'll look at how to leverage one such tool, ScanSearch, to programmatically find exposed services and even potential vulnerabilities.

The Problem: Beyond a Single IP Scan

Imagine you're developing a new IoT device, and you want to ensure that certain diagnostic ports are never exposed to the public internet. Or perhaps you're a security researcher tracking the prevalence of a specific, vulnerable web server version. Manually scanning millions of IPs is simply not feasible. We need a way to query an already-indexed snapshot of the internet.

ScanSearch (https://scansearch.net) is an internet-wide search engine designed for exactly this purpose. It indexes network devices, services, and vulnerabilities, allowing you to search for specific banners, open ports, software versions, and more.

While you can use their web interface for interactive exploration, the real power for developers and automation comes from programmatic access.

Getting Started: Basic Service Discovery

Let's start with a simple task: finding all devices exposing port 80 (HTTP) that also contain "nginx" in their HTTP banner. For demonstration purposes, we'll use Python and the requests library.

(Note: ScanSearch offers various API access tiers. For this tutorial, we'll assume you have an API key with appropriate access. Always refer to their official API documentation for the most up-to-date query parameters and rate limits.)

import requests
import json

API_KEY = "YOUR_SCANSEARCH_API_KEY" # Replace with your actual API key
SCANSEARCH_API_BASE = "https://api.scansearch.net/v1"

def search_scansearch(query, page=1, limit=10):
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }
    params = {
        "q": query,
        "page": page,
        "limit": limit
    }
    try:
        response = requests.get(f"{SCANSEARCH_API_BASE}/search", headers=headers, params=params)
        response.raise_for_status() # Raise an HTTPError for bad responses (4xx or 5xx)
        return response.json()
    except requests.exceptions.RequestException as e:
        print(f"An error occurred: {e}")
        return None

# Example query: Find devices with port 80 open and "nginx" in the banner
# (Syntax for queries will be specific to ScanSearch's DSL)
search_query = 'port:80 AND service.http.banner:"nginx"'
results = search_scansearch(search_query)

if results and results.get('data'):
    print(f"Found {results.get('total', 0)} results:")
    for item in results['data']:
        print(f"  IP: {item.get('ip')}, Port: {item.get('port')}, Service: {item.get('service', {}).get('name')}")
        # You can access more details like item.get('service', {}).get('http', {}).get('banner')
else:
    print("No results found or an error occurred.")

In this example, port:80 AND service.http.banner:"nginx" is a simplified representation of a ScanSearch query. The actual query language allows for powerful filtering on specific service attributes, banners, and more. Always refer to their documentation for precise query syntax.

Advanced Use Case: Tracking Vulnerabilities

ScanSearch also indexes vulnerabilities. This is incredibly powerful for security researchers or operations teams wanting to understand their exposure or the general internet's exposure to specific CVEs.

Let's imagine we want to find devices exposed to a hypothetical vulnerability, say CVE-2023-12345, that affects a particular version of Apache.

# ... (previous search_scansearch function remains the same) ...

# Example query: Find devices with a specific vulnerability
# (Again, syntax is illustrative and based on ScanSearch's actual capabilities)
exploit_query = 'vulnerability.cve:"CVE-2023-12345" AND service.http.server:"Apache"'
vuln_results = search_scansearch(exploit_query, limit=5)

if vuln_results and vuln_results.get('data'):
    print(f"\nFound {vuln_results.get('total', 0)} potentially vulnerable devices for CVE-2023-12345:")
    for item in vuln_results['data']:
        print(f"  IP: {item.get('ip')}, Port: {item.get('port')}, Reported CVEs: {item.get('vulnerabilities', [])}")
else:
    print("No devices found with the specified vulnerability or an error occurred.")

This script demonstrates how you could query for specific CVEs. The vulnerabilities field in the results would typically contain an array of identified CVEs for that particular device and service combination.

Beyond the Basics

With ScanSearch, you're not just limited to port and banner searches. You can typically query for:

Specific IP ranges or countries: ip:192.168.1.0/24 or country:"US"
SSL certificate details: ssl.cert.issuer:"Let's Encrypt"
Operating system information: If available through fingerprinting.
Raw service data: Search within the raw banner or protocol responses.

The key is understanding the query language provided by ScanSearch. Their official documentation will be your best friend for constructing precise and powerful queries.

Practical Applications

Asset Inventory: Discover all your public-facing assets, even ones you might have forgotten about.
Security Audits: Identify misconfigurations or exposed services that shouldn't be publicly accessible.
Threat Intelligence: Track the prevalence of specific software versions or vulnerabilities across the internet.
Compliance: Verify that certain services or ports are not exposed in regulated environments.

Conclusion

Internet-wide search engines like ScanSearch provide an invaluable tool for developers, security professionals, and DevOps teams. By programmatically querying these datasets, you can gain insights into the global network landscape, rapidly identify exposed services, and proactively address potential vulnerabilities, all without needing to perform time-consuming, resource-intensive scans yourself.

Remember to always consult the official ScanSearch documentation for the most accurate and up-to-date API usage and query syntax. Happy searching!

DEV Community