mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 06:45:08 +00:00
63 lines
3.1 KiB
Bash
63 lines
3.1 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
# Prowler - the handy cloud security tool (copyright 2018) by Toni de la Fuente
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
|
# use this file except in compliance with the License. You may obtain a copy
|
|
# of the License at http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software distributed
|
|
# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
|
|
# CONDITIONS OF ANY KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations under the License.
|
|
CHECK_ID_extra7102="7.102"
|
|
CHECK_TITLE_extra7102="[extra7102] Check if any of the Elastic or Public IP are in Shodan (requires Shodan API KEY)"
|
|
CHECK_SCORED_extra7102="NOT_SCORED"
|
|
CHECK_CIS_LEVEL_extra7102="EXTRA"
|
|
CHECK_SEVERITY_extra7102="High"
|
|
CHECK_ASFF_RESOURCE_TYPE_extra7102="AwsEc2Eip"
|
|
CHECK_ALTERNATE_check7102="extra7102"
|
|
CHECK_SERVICENAME_extra7102="ec2"
|
|
CHECK_RISK_extra7102='Sites like Shodan index exposed systems and further expose them to wider audiences as a quick way to find exploitable systems.'
|
|
CHECK_REMEDIATION_extra7102='Check Identified IPs; consider changing them to private ones and delete them from Shodan.'
|
|
CHECK_DOC_extra7102='https://www.shodan.io/'
|
|
CHECK_CAF_EPIC_extra7102='Infrastructure Security'
|
|
|
|
# Watch out, always use Shodan API key, if you use `curl https://www.shodan.io/host/{ip}` massively
|
|
# your IP will be banned by Shodan
|
|
|
|
# This is the right way to do so
|
|
# curl -ks https://api.shodan.io/shodan/host/{ip}?key={YOUR_API_KEY}
|
|
|
|
# Each finding will be saved in prowler/output folder for further review.
|
|
|
|
extra7102(){
|
|
if [[ ! $SHODAN_API_KEY ]]; then
|
|
textInfo "[extra7102] Requires a Shodan API key to work. Use -N <shodan_api_key>"
|
|
else
|
|
for regx in $REGIONS; do
|
|
LIST_OF_EIP=$($AWSCLI $PROFILE_OPT --region $regx ec2 describe-network-interfaces --query 'NetworkInterfaces[*].Association.PublicIp' --output text 2>&1)
|
|
if [[ $(echo "$LIST_OF_EIP" | grep -E 'AccessDenied|UnauthorizedOperation|AuthorizationError') ]]; then
|
|
textInfo "$regx: Access Denied trying to describe network interfaces" "$regx"
|
|
continue
|
|
fi
|
|
if [[ $LIST_OF_EIP ]]; then
|
|
for ip in $LIST_OF_EIP;do
|
|
SHODAN_QUERY=$(curl -ks https://api.shodan.io/shodan/host/$ip?key=$SHODAN_API_KEY)
|
|
# Shodan has a request rate limit of 1 request/second.
|
|
sleep 1
|
|
if [[ $SHODAN_QUERY == *"No information available for that IP"* ]]; then
|
|
textPass "$regx: IP $ip is not listed in Shodan" "$regx"
|
|
else
|
|
echo $SHODAN_QUERY > $OUTPUT_DIR/shodan-output-$ip.json
|
|
IP_SHODAN_INFO=$(cat $OUTPUT_DIR/shodan-output-$ip.json | jq -r '. | { ports: .ports, org: .org, country: .country_name }| @text' | tr -d \"\{\}\}\]\[ | tr , '\ ' )
|
|
textFail "$regx: IP $ip is listed in Shodan with data $IP_SHODAN_INFO. More info https://www.shodan.io/host/$ip and $OUTPUT_DIR/shodan-output-$ip.json" "$regx" "$ip"
|
|
fi
|
|
done
|
|
else
|
|
textInfo "$regx: No Public or Elastic IPs found" "$regx"
|
|
fi
|
|
done
|
|
fi
|
|
}
|