Skip to content

Commit abddeb5

Browse files
author
Brian Patterson
committed
Land 7473, add censys search module
2 parents f2b9498 + 98afd0f commit abddeb5

File tree

2 files changed

+386
-0
lines changed

2 files changed

+386
-0
lines changed

‎documentation/modules/auxiliary/gather/censys_search.md

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
The module use the Censys REST API to access the same data accessible through web interface. The search endpoint allows searches against the current data in the IPv4, Top Million Websites, and Certificates indexes using the same search syntax as the primary site.
2+
3+
## Verification Steps
4+
5+
1. Do: `use auxiliary/gather/censys_search`
6+
2. Do: `set CENSYS_UID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX`
7+
3. Do: `set CENSYS_SECRET XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX`
8+
4. Do: `set CENSYS_SEARCHTYPE certificates`
9+
5: Do: `set CENSYS_DORK rapid7`
10+
6: Do: `run`
11+
12+
## Sample Output
13+
14+
#### Certificates Search
15+
16+
```
17+
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
18+
CENSYS_DORK => rapid7
19+
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE certificates
20+
CENSYS_SEARCHTYPE => certificates
21+
...
22+
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
23+
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
24+
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
25+
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
26+
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
27+
[+] 208.118.237.41 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
28+
[+] 64.125.235.5 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
29+
[+] 208.118.237.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
30+
[+] 208.118.237.40 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
31+
[+] 208.118.227.12 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
32+
[+] 208.118.237.38 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
33+
[+] 23.48.13.195 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
34+
[+] 208.118.227.14 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
35+
[+] 54.230.252.134 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
36+
[+] 54.230.249.63 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
37+
[+] 54.230.249.242 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
38+
[+] 54.230.249.187 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
39+
[+] 54.230.249.64 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
40+
[+] 54.230.249.181 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
41+
[+] 54.230.249.17 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
42+
[+] 54.230.249.183 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
43+
[+] 54.230.249.186 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
44+
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
45+
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
46+
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
47+
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
48+
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
49+
[+] 208.118.237.41 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
50+
[+] 64.125.235.5 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
51+
[+] 208.118.237.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
52+
[+] 208.118.237.40 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
53+
[+] 208.118.227.12 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
54+
[+] 208.118.237.38 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
55+
[+] 23.48.13.195 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
56+
[+] 208.118.227.14 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
57+
[+] 54.230.252.134 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
58+
[+] 54.230.249.63 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
59+
[+] 54.230.249.242 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
60+
[+] 54.230.249.187 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
61+
[+] 54.230.249.64 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
62+
[+] 54.230.249.181 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
63+
[+] 54.230.249.17 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
64+
[+] 54.230.249.183 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
65+
[+] 54.230.249.186 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
66+
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
67+
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
68+
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
69+
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
70+
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
71+
[+] 208.118.237.41 - CN=NeXpose Security Console, O=Rapid7
72+
...
73+
74+
```
75+
76+
### IPv4 Search
77+
78+
```
79+
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
80+
CENSYS_DORK => rapid7
81+
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE ipv4
82+
CENSYS_SEARCHTYPE => ipv4
83+
[*] 197.117.5.36 - 443/https
84+
[*] 208.118.237.81 - 443/https
85+
[*] 206.19.237.19 - 443/https
86+
[*] 54.214.49.70 - 80/http,443/https
87+
[*] 208.118.237.241 - 443/https
88+
[*] 162.220.246.141 - 443/https,22/ssh,80/http
89+
[*] 31.214.157.19 - 443/https,22/ssh
90+
[*] 52.88.1.225 - 443/https,22/ssh
91+
[*] 208.118.227.12 - 25/smtp
92+
[*] 38.107.201.41 - 443/https
93+
[*] 52.44.56.126 - 80/http,443/https
94+
[*] 52.54.227.6 - 443/https,80/http
95+
[*] 23.217.253.242 - 443/https,80/http
96+
[*] 96.6.3.45 - 80/http,443/https
97+
[*] 23.6.73.47 - 443/https,80/http
98+
[*] 23.78.99.243 - 80/http,443/https
99+
[*] 23.53.51.170 - 80/http,443/https
100+
[*] 23.62.201.47 - 443/https,80/http
101+
[*] 2.23.50.157 - 443/https,80/http
102+
[*] 118.215.191.13 - 80/http,443/https
103+
[*] 2.19.185.28 - 80/http,443/https
104+
[*] 2.18.195.99 - 443/https,80/http
105+
[*] 23.197.196.25 - 443/https,80/http
106+
[*] 95.100.104.181 - 443/https,80/http
107+
[*] 2.20.37.130 - 80/http,443/https
108+
[*] 23.194.237.34 - 443/https,80/http
109+
[*] 2.17.140.86 - 443/https,80/http
110+
[*] 64.125.235.5 - 25/smtp
111+
[*] 208.118.227.32 - 80/http
112+
[*] 2.21.129.149 - 80/http,443/https
113+
[*] 2.20.167.33 - 80/http,443/https
114+
[*] 95.100.139.218 - 80/http,443/https
115+
[*] 23.38.88.202 - 443/https,80/http
116+
[*] 2.17.184.80 - 443/https,80/http
117+
[*] 23.59.119.23 - 80/http,443/https
118+
[*] 2.16.14.225 - 443/https,80/http
119+
[*] 104.113.122.33 - 443/https,80/http
120+
[*] 23.223.44.164 - 80/http,443/https
121+
[*] 88.221.120.214 - 443/https,80/http
122+
[*] 23.47.36.145 - 443/https,80/http
123+
[*] 2.23.21.254 - 80/http,443/https
124+
[*] 208.118.237.39 - 443/https
125+
[*] 208.118.237.40 - 443/https
126+
[*] 208.118.237.41 - 443/https
127+
[*] 23.54.217.47 - 80/http,443/https
128+
[*] 96.17.254.188 - 443/https,80/http
129+
[*] 184.25.129.65 - 443/https,80/http
130+
[*] 104.121.167.123 - 443/https,80/http
131+
[*] 104.94.110.63 - 443/https,80/http
132+
[*] 104.91.11.216 - 80/http,443/https
133+
[*] 23.38.233.47 - 80/http,443/https
134+
[*] 52.86.110.89 - 80/http,443/https
135+
[*] 69.192.73.47 - 443/https,80/http
136+
[*] 184.86.57.47 - 443/https,80/http
137+
[*] 104.86.45.180 - 443/https,80/http
138+
[*] 184.87.72.153 - 80/http,443/https
139+
[*] 23.66.25.47 - 80/http,443/https
140+
[*] 23.56.162.76 - 80/http,443/https
141+
[*] 184.87.133.242 - 443/https,80/http
142+
[*] 23.55.74.28 - 80/http,443/https
143+
[*] 23.6.225.84 - 80/http,443/https
144+
[*] 23.46.133.153 - 443/https,80/http
145+
[*] 23.10.121.47 - 443/https,80/http
146+
[*] 104.109.35.169 - 80/http,443/https
147+
[*] 172.227.101.182 - 80/http,443/https
148+
[*] 184.27.23.104 - 80/http,443/https
149+
[*] 23.49.185.47 - 80/http,443/https
150+
[*] 23.67.172.177 - 80/http,443/https
151+
[*] 23.62.170.161 - 443/https,80/http
152+
[*] 23.219.71.35 - 443/https,80/http
153+
[*] 104.82.94.233 - 443/https,80/http
154+
[*] 184.26.73.47 - 80/http,443/https
155+
[*] 104.68.108.237 - 80/http,443/https
156+
[*] 23.60.39.77 - 80/http,443/https
157+
[*] 23.66.100.92 - 80/http,443/https
158+
[*] 23.61.28.182 - 443/https,80/http
159+
[*] 23.42.116.233 - 80/http,443/https
160+
[*] 104.105.14.197 - 80/http,443/https
161+
[*] 104.103.203.240 - 80/http,443/https
162+
[*] 104.65.57.235 - 80/http,443/https
163+
[*] 23.41.83.224 - 80/http,443/https
164+
[*] 184.51.185.47 - 80/http,443/https
165+
[*] 23.67.231.142 - 80/http,443/https
166+
[*] 208.118.237.38 - 443/https
167+
[*] 104.76.25.28 - 80/http,443/https
168+
[*] 23.196.125.176 - 443/https,80/http
169+
[*] 23.40.154.224 - 80/http,443/https
170+
[*] 23.77.33.204 - 443/https,80/http
171+
[*] 104.88.21.48 - 80/http,443/https
172+
[*] 173.223.134.47 - 80/http,443/https
173+
[*] 23.4.98.72 - 80/http,443/https
174+
[*] 23.44.97.3 - 80/http,443/https
175+
[*] 23.203.66.142 - 443/https,80/http
176+
[*] 23.42.216.251 - 443/https,80/http
177+
[*] 23.42.85.25 - 80/http,443/https
178+
[*] 173.255.195.131 - 80/http,23/telnet,25/smtp,110/pop3,53/dns,443/https,22/ssh
179+
[*] 104.83.219.182 - 443/https,80/http
180+
[*] 184.86.41.47 - 443/https,80/http
181+
[*] 104.97.72.196 - 443/https,80/http
182+
[*] 69.192.169.48 - 443/https,80/http
183+
```
184+
185+
### Websites Search
186+
187+
```
188+
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
189+
CENSYS_DORK => rapid7
190+
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE websites
191+
CENSYS_SEARCHTYPE => websites
192+
msf auxiliary(censys_search) > run
193+
194+
[+] rapid7.com - [37743]
195+
[+] logentries.com - [45346]
196+
[+] venturefizz.com - [106102]
197+
[+] gild.com - [116853]
198+
[+] sectools.org - [122125]
199+
[+] ericzhang.me - [155622]
200+
[+] metasploit.com - [156435]
201+
[+] datapipe.com - [209756]
202+
[+] routerpwn.com - [317896]
203+
[+] proxy-base.com - [507954]
204+
[+] config.fr - [542346]
205+
[+] winterwyman.com - [629471]
206+
[+] gogrid.com - [741009]
207+
[+] wesecure.nl - [997423]
208+
[*] Auxiliary module execution completed
209+
```
210+
211+
212+
## References
213+
214+
1. https://censys.io/api

‎modules/auxiliary/gather/censys_search.rb

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
##
2+
# This module requires Metasploit: http://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
7+
require 'msf/core'
8+
require 'rex/proto/http'
9+
10+
class MetasploitModule < Msf::Auxiliary
11+
12+
include Msf::Auxiliary::Report
13+
14+
def initialize(info={})
15+
super(update_info(info,
16+
'Name' => 'Censys Search',
17+
'Description' => %q{
18+
The module use the Censys REST API to access the same data
19+
accessible through web interface. The search endpoint allows searches
20+
against the current data in the IPv4, Top Million Websites, and
21+
Certificates indexes using the same search syntax as the primary site.
22+
},
23+
'Author' => [ 'Nixawk' ],
24+
'References' => [
25+
['URL', 'https://censys.io/api']
26+
],
27+
'License' => MSF_LICENSE
28+
))
29+
30+
register_options([
31+
OptString.new('CENSYS_UID', [true, 'The Censys API UID']),
32+
OptString.new('CENSYS_SECRET', [true, 'The Censys API SECRET']),
33+
OptString.new('CENSYS_DORK', [true, 'The Censys Search Dork']),
34+
OptEnum.new('CENSYS_SEARCHTYPE', [true, 'The Censys Search Type', 'certificates', ['certificates', 'ipv4', 'websites']])
35+
], self.class)
36+
end
37+
38+
def basic_auth_header(username, password)
39+
auth_str = username.to_s + ":" + password.to_s
40+
auth_str = "Basic " + Rex::Text.encode_base64(auth_str)
41+
end
42+
43+
def search(keyword, search_type)
44+
# search_type should be one of ipv4, websites, certificates
45+
46+
begin
47+
# "80.http.get.headers.server: Apache"
48+
payload = {
49+
'query' => keyword
50+
}
51+
52+
@cli = Rex::Proto::Http::Client.new('www.censys.io', 443, {}, true)
53+
@cli.connect
54+
55+
response = @cli.request_cgi(
56+
'method' => 'post',
57+
'uri' => "/api/v1/search/#{search_type}",
58+
'headers' => { 'Authorization' => basic_auth_header(@uid, @secret) },
59+
'data' => payload.to_json
60+
)
61+
62+
res = @cli.send_recv(response)
63+
64+
rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT
65+
print_error("HTTP Connection Failed")
66+
end
67+
68+
unless res
69+
print_error('server_response_error')
70+
return
71+
end
72+
73+
records = ActiveSupport::JSON.decode(res.body)
74+
results = records['results']
75+
76+
if @searchtype.include?('certificates')
77+
parse_certificates(results)
78+
elsif @searchtype.include?('ipv4')
79+
parse_ipv4(results)
80+
elsif @searchtype.include?('websites')
81+
parse_websites(results)
82+
end
83+
end
84+
85+
def valid_domain?(domain)
86+
domain =~ /^([a-z0-9]+(-[a-z0-9]+)*\.)+[a-z]{2,}$/
87+
end
88+
89+
def domain2ip(domain)
90+
ips = []
91+
begin
92+
ips = Rex::Socket.getaddresses(domain)
93+
rescue SocketError
94+
end
95+
ips
96+
end
97+
98+
def parse_certificates(records)
99+
ips = []
100+
records.each do |certificate|
101+
# parsed.fingerprint_sha256
102+
# parsed.subject_dn
103+
# parsed.issuer_dn
104+
subject_dn = certificate['parsed.subject_dn'].join(',')
105+
next unless subject_dn.include?('CN=')
106+
107+
host = subject_dn.split('CN=')[1]
108+
if Rex::Socket.is_ipv4?(host)
109+
ips << host
110+
elsif valid_domain?(host) # Fake DNS server
111+
ips |= domain2ip(host)
112+
end
113+
114+
ips.each do |ip|
115+
print_good("#{ip} - #{subject_dn}")
116+
report_host(:host => ip, :info => subject_dn)
117+
end
118+
end
119+
end
120+
121+
def parse_ipv4(records)
122+
records.each do |ipv4|
123+
# ip
124+
# protocols
125+
ip = ipv4['ip']
126+
protocols = ipv4['protocols']
127+
128+
protocols.each do |protocol|
129+
print_good("#{ipv4['ip']} - #{ipv4['protocols'].join(',')}")
130+
port, name = protocol.split('/')
131+
report_service(:host => ip, :port => port, :name => name)
132+
end
133+
end
134+
end
135+
136+
def parse_websites(records)
137+
records.each do |website|
138+
# domain
139+
# alexa_rank
140+
print_good("#{website['domain']} - #{website['alexa_rank']}")
141+
domain = website['domain']
142+
ips = domain2ip(domain)
143+
ips.each do |ip|
144+
report_host(:host =>ip)
145+
end
146+
end
147+
end
148+
149+
# Check to see if www.censys.io resolves properly
150+
def censys_resolvable?
151+
begin
152+
Rex::Socket.resolv_to_dotted("www.censys.io")
153+
rescue RuntimeError, SocketError
154+
return false
155+
end
156+
true
157+
end
158+
159+
def run
160+
# check to ensure www.censys.io is resolvable
161+
unless censys_resolvable?
162+
print_error("Unable to resolve www.censys.io")
163+
return
164+
end
165+
166+
@uid = datastore['CENSYS_UID']
167+
@secret = datastore['CENSYS_SECRET']
168+
@dork = datastore['CENSYS_DORK']
169+
@searchtype = datastore['CENSYS_SEARCHTYPE']
170+
search(@dork, @searchtype)
171+
end
172+
end

0 commit comments

Comments
 (0)