-
Notifications
You must be signed in to change notification settings - Fork 589
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSH-key checking #3
Comments
Looks like there are two new rulesets here:
|
Have a working prototype for this, will be up soon |
Fingerprinting added in 44e6d5c - still would be cool to lookup the fingerprint in a DB. |
@s-rah - Its possible to search ssh keys on Shodan, with the Shodan API. There is even a Go library: https://github.com/ns3777k/go-shodan Still getting to grips with Go, slowly, coming up to exams here though so its slow going. Hypothetically, an imaginary friend was able to deanonymize a good number of services by doing that (Shodanning the fingerprints)... |
Might help to look at #26 too, when implementing.. |
Closing this in favor of #73 |
A lot of hidden services (close to 3% in my last big scan) are configured so that the .onion address serves all ports.
If SSH is being served, you can grab the key fingerprint and sometimes uncloak the HS by checking it against Shodan or your own database of scans.
Example code (in Python) to do this is here: https://github.com/0x27/ssh_keyscanner
The text was updated successfully, but these errors were encountered: