Finding Network Blind Spots: A Practical Guide to Scanning and Scripting with ScanSearch

Ever been in a situation where you need to quickly check if a specific port is exposed on a range of public IPs, or find all devices running a particular version of a service across the internet? Traditional methods can be cumbersome, requiring you to spin up your own scanners and manage large datasets.

This article isn't about setting up your own Shodan or Censys. Instead, we'll look at how to leverage an existing internet-wide search engine for network devices, services, and vulnerabilities – ScanSearch – to quickly gather intelligence and automate some common security and network discovery tasks. We'll focus on practical, runnable examples, primarily using Python for scripting.

The Problem: Manual Discovery is Tedious

Imagine you're developing a new IoT device and you want to see if similar devices already have known vulnerabilities exposed. Or perhaps you're performing a competitive analysis and want to understand the common network configurations of your rivals' public-facing infrastructure. Manually probing IP by IP is not only time-consuming but also often leads to rate-limiting or blocks.

ScanSearch aggregates this kind of data, allowing you to query for devices, services, and vulnerabilities much like you'd use a search engine for web pages. This saves significant time and resources.

Basic Querying with ScanSearch

Let's start with a simple example. Suppose we want to find all devices exposing port 22 (SSH) with a specific banner containing "OpenSSH 7.6p1".

While ScanSearch's web interface is great for interactive exploration, for automation, we'll eventually want to use its API (details on API access are typically found after signing up on their site). For now, let's conceptualize the query. A typical query might look something like this (syntax will vary slightly based on the actual API or web interface):

port:22 AND service.banner:"OpenSSH 7.6p1"

This query tells ScanSearch to look for records where the port field is 22 AND the service.banner field contains the string "OpenSSH 7.6p1". The results would likely include IP addresses, associated ports, and potentially more detailed service information.

Scripting Common Tasks with Python

Let's assume we have access to the ScanSearch API and can make authenticated requests. For our examples, we'll use a placeholder scansearch_api_client that abstracts away authentication and direct HTTP calls. You'd replace this with the actual client library or direct requests calls after obtaining your API key from ScanSearch.

Example 1: Finding Exposed RDP Services in a Specific Country

We often need to identify common attack surfaces. Remote Desktop Protocol (RDP) is a frequent target. Let's find all devices exposing RDP (port 3389) in Germany.

import json

# Placeholder for your actual ScanSearch API client
class ScanSearchAPI:
    def __init__(self, api_key):
        self.api_key = api_key
        # In a real scenario, this would initialize an HTTP client
        # and handle authentication.

    def search(self, query, page_size=100, page=1):
        print(f"Searching ScanSearch for: {query} (page {page})")
        # Simulate API response for demonstration
        if "port:3389 AND country:DE" in query:
            return {
                "total": 2,
                "results": [
                    {"ip": "192.0.2.10", "port": 3389, "country": "DE", "service": {"name": "ms-wbt-server"}},
                    {"ip": "192.0.2.11", "port": 3389, "country": "DE", "service": {"name": "ms-wbt-server"}}
                ]
            }
        elif "vulnerability.cve:CVE-2021-44228" in query:
             return {
                "total": 1,
                "results": [
                    {"ip": "198.51.100.20", "port": 8080, "vulnerability": {"cve": "CVE-2021-44228", "severity": "CRITICAL"}}
                ]
            }
        return {"total": 0, "results": []}

# --- Usage ---
api_key = "YOUR_SCANSEARCH_API_KEY" # Replace with your actual API key
client = ScanSearchAPI(api_key)

query = 'port:3389 AND country:DE'
response = client.search(query)

if response and response['results']:
    print(f"Found {response['total']} RDP services in Germany:")
    for result in response['results']:
        print(f"  IP: {result['ip']}, Port: {result['port']}")
else:
    print("No RDP services found matching the criteria.")

This script demonstrates how to construct a query to find RDP services in Germany. The actual client.search() call would interact with the ScanSearch API, returning structured data that you can then process.

Example 2: Identifying Devices with Specific Vulnerabilities

Staying on top of critical vulnerabilities is crucial. Let's say we want to find all devices that ScanSearch has indexed as being affected by a specific CVE, for instance, CVE-2021-44228 (Log4Shell).

# Using the same client from above

query = 'vulnerability.cve:CVE-2021-44228'
response = client.search(query)

if response and response['results']:
    print(f"Found {response['total']} devices with CVE-2021-44228:")
    for result in response['results']:
        print(f"  IP: {result['ip']}, Port: {result.get('port', 'N/A')}")
else:
    print("No devices found with CVE-2021-44228.")

This example shows how to query for specific CVEs. ScanSearch's ability to index vulnerabilities tied to devices can be a powerful tool for threat intelligence and incident response.

Beyond Basic Queries: Filtering and Aggregation (Conceptual)

While the specific aggregation features depend on the ScanSearch API, conceptually you might want to:

• Filter by service version: service.name:nginx AND service.version:"1.18.0"
• Search for specific HTTP headers: http.headers:"X-Powered-By: PHP/7.4.3"
• Combine criteria: port:80 AND country:US AND http.status_code:200

The key is understanding the available fields and their syntax in ScanSearch's query language. Always refer to the official ScanSearch documentation for the most accurate and up-to-date query syntax and API endpoints.

Conclusion

ScanSearch offers a practical way to gain visibility into internet-facing assets without the overhead of running your own distributed scanning infrastructure. By leveraging its powerful search capabilities and integrating with its API, developers and security professionals can automate repetitive discovery tasks, quickly identify potential blind spots, and respond faster to emerging threats. The examples above are just a starting point; the real power comes from crafting precise queries to answer your specific network intelligence questions.

Remember to consult the official ScanSearch website for API access, detailed query syntax, and comprehensive documentation to unlock its full potential.