rapid7 / iotseeker

Created by Jin Qian via the GitHub Connector

IoTSeeker

This scanner will scan a network for specific types of IoT devices to detect if they are using the default, factory set credentials. The recent Internet outage has been attributed to use the IoT devices (CCTV Cameras, DVRs and others) with default credentials. It's the intention of this tool to help organizations scan their networks to detect these types of IoT devices and to identify whether credentials have been changed or if the device is still using the factory setting. Note that Mirai malware, suspected to have been used to launch the massive internet outage on Oct 21, 2016, mainly focuses on telnet services. IoTSeeker focuses on HTTP/HTTPS services.

In order to accommodate large IP ranges and make it capable of finding a large number of different types of IoT devices, this tool was designed with:

• High parallelism. So that it can scan thousands of IoT's at the same time
• Extensibility, making it easy to support new types of devices without needing to change or write lots of code.

The software has two parts. One is the device configuration file which is in JSON format, the other is the scanner, coded in perl, that does scanning, device identification and logging under the control the device configuration file.

This software uses the perl module AnyEvent for high parallelism and as a result, it only runs on Linux or Mac OS.

Here are the steps to install and run it:

• make sure perl and cpan are installed.
• Install perl packages by
• cpan AnyEvent::HTTP Data::Dumper JSON
• perl iotScanner.pl
  • example: perl iotScanner.pl 1.1.1.1-1.1.4.254,2.1.1.1-2.2.3.254

iotseeker's Issues

failed to establish TCP connection

I'm hoping to get some help over here...

I have everything installed, once I run the tool it tells me every IP in my range "failed to establish TCP connection". any thoughts? This is through my Mac and my linux distros.

Thanks

I have got an issue while trying to scan D-Link wifi camera

This is the error i get.
"unexpected status code 599 for ip 192.168.43.197"
Can someone help me out with this.
cheers

"Can't locate AnyEvent/HTTP.pm" issue

Hi,
As per the given command to run "iotScnner.pl" i am getting following issue.
running it on kali VM

root@Curosity:~/IoTSeeker# perl iotScanner.pl 1.23.123.431 Can't locate AnyEvent/HTTP.pm in @inc (you may need to install the AnyEvent::HTTP module) (@inc contains: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.28.1 /usr/local/share/perl/5.28.1 /usr/lib/x86_64-linux-gnu/perl5/5.28 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl/5.28 /usr/share/perl/5.28 /usr/local/lib/site_perl /usr/lib/x86_64-linux-gnu/perl-base) at iotScanner.pl line 1. BEGIN failed--compilation aborted at iotScanner.pl line 1.

I have also run the command "cpan AnyEvent::HTTP Data::Dumper JSON"

Please help in resolving it.

Thanks

Content-Type Headers

Hi,

While using IoTSeeker to scan for devices with default credentials on our
network we noticed that while IoTSeeker does work with basic auth but when
using forms it appears to not set the content-type HTTP header. IoTSeeker
then responds with 'default password was found' regardless of the
credentials passed to it from some devices such as AMX devices.

Using Wireshark we can see that IoTSeeker does not set the content-type
header and form variables are not set in the server response.

Using Wireshark with curl we confirmed that the content-type header is
(automatically) set and form variables are correctly set in the server
response.

I may have missed something in the devices.cfg?

"AMX":{
"devTypePattern": [["header", "server"], ["regex", "^The Knopflerfish"]],
"nextUrl": ["string", "/web/root/login.xml"],
"auth": ["form","", "userName=administrator&password=password", "body",
"!substr", "Invalid user name or password"]
},

Kind regards,
Elliott