Using Shodan filters and the BinaryEdge search engine

Shodan and BinaryEdge are both powerful tools for gathering information about internet-connected devices and vulnerabilities. By combining the two, you can gain a more comprehensive understanding of your attack surface and identify potential security risks.

Using Shodan Filters

Shodan filters allow you to refine your search results to focus on specific criteria, such as operating system, port, banner, location, organization, and tags. This can be helpful in narrowing down your search to devices that are most likely to be vulnerable or of interest.

Here are some examples of how to use Shodan filters:

• Filter by operating system:

os: "Windows 10"

• Filter by port:

port: 80

• Filter by banner:

banner: "Apache"

• Filter by location:

country: "US"

• Filter by organization:

org: "Google"

• Filter by tags:

tags: "vulnerable, IOT"

Integrating BinaryEdge Search Engine

BinaryEdge provides a comprehensive search engine that allows you to search for vulnerabilities based on various criteria, including:

• Common Vulnerability Scoring System (CVSS) score:

cvss: 7

• Vulnerability type:

vulntype: remote code execution

• Affected products or versions:

affected: "Apache httpd"

• Publication date:

published: past30days

• Exploitability:

exploitable: true

Combining Shodan Filters and BinaryEdge Search

By combining Shodan filters with the BinaryEdge search engine, you can create highly targeted searches that identify specific devices that are vulnerable to particular exploits. For example, you could search for devices running a specific operating system that are also affected by a recently published vulnerability with a high CVSS score.

Here’s an example of how to combine Shodan filters and the BinaryEdge search engine to find devices running Windows 10 that are vulnerable to the Heartbleed vulnerability (CVE-2014-0160):

os: "Windows 10" AND vuln_id: CVE-2014-0160

This search will return a list of devices that meet both criteria, allowing you to prioritize them for further investigation or remediation.

By leveraging the combined capabilities of Shodan and BinaryEdge, you can enhance your vulnerability management strategies and proactively identify and address potential security risks within your attack surface.

Pybinaryedge is a Python library that provides a wrapper around the Binary Edge API, enabling you to easily integrate Binary Edge’s vulnerability and intelligence data into your Python applications.

Installation:

pip3 install pybinaryedge

2. Verify the installation:

python -c "import pybinaryedge; print(pybinaryedge.__version__)"

This should print the installed version of the pybinaryedge library.

Usage:

1. Create an API client:

import pybinaryedge

api = pybinaryedge.API(api_key="YOUR_API_KEY")

Replace YOUR_API_KEY with your Binary Edge API key.

2. Use the API client to interact with Binary Edge data:

# Get information about a specific host
host_info = api.host("1.1.1.1")
print(host_info)

# Search for vulnerabilities affecting a specific domain
vuln_search_results = api.vuln_search(domain="example.com")
print(vuln_search_results)

The pybinaryedge library provides various methods for interacting with Binary Edge’s data, including:

• host: Retrieve information about a specific host
• vuln_search: Search for vulnerabilities affecting specific hosts, domains, or IP addresses
• domain_subdomains: List subdomains associated with a specific domain
• domain_dns: Retrieve DNS records for a specific domain
• dataleaks_organization: Check if an organization has been affected by data leaks
• dataleaks_info: Get information about data leaks affecting specific email addresses or domains

For detailed documentation and usage examples, refer to the pybinaryedge GitHub repository: https://github.com/Te-k/pybinaryedge

BinaryEdge Host Search Script

This Python script uses the BinaryEdge API to perform a host search for a specified domain.

1. Importing Required Modules:

from pybinaryedge import BinaryEdge
import os

The script imports the necessary modules: pybinaryedge for accessing the BinaryEdge API and os for handling environment variables.

2. Setting BinaryEdge API Key and Initializing BinaryEdge API:

key = os.environ['BINARYEDGE_API_KEY']
binaryEdge = BinaryEdge(key)

The BinaryEdge API key is retrieved from the environment variable 'BINARYEDGE_API_KEY', and an instance of the BinaryEdge class is created using this key.

3. Performing BinaryEdge Host Search:

search_domain = 'www.python.org'
results = binaryEdge.host_search(search_domain)

The script performs a host search using the specified domain ('www.python.org'). The search results are stored in the results variable.

4. Displaying IP Addresses of Matching Hosts:

for ip in results['events']:
    print("%s" % (ip['target']['ip']))

The script iterates over the search results (results['events']) and prints the IP addresses of the matching hosts.

Usage Example:

• Ensure the BinaryEdge API key is set correctly in the environment variable 'BINARYEDGE_API_KEY'.
• Run the script to perform a host search for the specified domain.
• The script outputs the IP addresses of the matching hosts.

from pybinaryedge import BinaryEdge
import os

key= os.environ['BINARYEDGE_API_KEY']

binaryEdge = BinaryEdge(key)

search_domain = 'www.python.org'

results = binaryEdge.host_search(search_domain)

for ip in results['events']:
    print("%s" %(ip['target']['ip']))

Summary:

• This script demonstrates how to use the BinaryEdge API to perform a host search based on a specific domain.
• It leverages the pybinaryedge Python library to interact with the BinaryEdge API.
• The script prints the IP addresses of the hosts that match the specified domain.