[Shodan]

Introduction to Scada
So i am sure most of you are wondering what SCADA is,well SCADA stands for
"supervisory control and data acquisition"
SCADA is a industrial control system that you none other use to control things using your computer,and for some reason people like to connect alot of this stuff to the internet when they do not have to.
"Note connecting important stuff like traffic lights to the internet without no security at all is a bad idea"

What can i do with if i get into a SCADA system
Well you may ask this question,and i am sure that you will.It really all depends on what the SCADA system is there to do.It could do anything from control a light system in someones house or business all the way to controling Traffic lights or tv stations.
Actually the day i am righting this tutorial me and my friend got into a Tv Control Center hosted in denmark,yes i know that sounds completly crazy but yes it is all true.You will never guess what we did with it,Do you want to know?Ok i will tell you.Well we broadcasted a message across one of the tv channels that was airing saying that there security had been breached.

Shodan
You may now ask yourself how to do this,I will go over that now.
What is Shodan?
Shodan is going to be your best friend in this journey.And no the Shodan i am talking about is not from the 1999 video game System Shock 2,I am talking about the Search engine made for finding anything connected to the internet.
"Shodan can be found at the following link"
http://www.shodanhq.com/
So now that you are at Shodan you are going to want to register,No you do not have to register but if you want to see more search results then you are going to need to.
I highly recommend that you register,it is important.
So now that you are registerd and all set up you are all ready to go

Search Queries:
So here is a list of search queries you can use to find SCADA systems,Along with some few others like tv and webcam.
http://www.shodanhq.com/search?q=webcam
http://www.shodanhq.com/?q=port:161+country:US+simatic
http://www.shodanhq.com/?q=PLC
http://www.shodanhq.com/?q=allen+bradley
http://www.shodanhq.com/?q=fanuc
http://www.shodanhq.com/?q=Rockwell
http://www.shodanhq.com/?q=Cimplicity
http://www.shodanhq.com/?q=Omron
http://www.shodanhq.com/?q=Novatech
http://www.shodanhq.com/?q=Citect
http://www.shodanhq.com/?q=RTU
http://www.shodanhq.com/?q=Modbus+Bridge
http://www.shodanhq.com/?q=modicon
http://www.shodanhq.com/?q=bacnet
http://www.shodanhq.com/?q=telemetry+gateway
http://www.shodanhq.com/?q=SIMATIC
http://www.shodanhq.com/?q=hmi
http://www.shodanhq.com/?q=siemens+-…er+-Subscriber
http://www.shodanhq.com/?q=scada+RTS
http://www.shodanhq.com/?q=SCHNEIDER
http://www.shodanhq.com/?q=port%3A161+simatic
http://www.shodanhq.com/?q=telemetry+gateway
http://www.shodanhq.com/?q=%22cisco-ios%...odified%22
http://www.shodanhq.com/search?q=dreambox
Note Depending on what the search querie it is,is usllay what it is used.
Say you used webcam or dreambox
Dreambox is used for Tv Control Systems
And well you know what a webcam is.

What To Do Next:
So now that you you have used on of the "Search Queries" above you should see a list of ip address's and some info with them aswell,Don't worry about the info right now,only worry about the ipv4 address.So now you that you the list of ipv4 address's you are going to want to copy and paste them in your web browsers address bar,Some will have credidentials,If it ask for creds just keep copy and pasting untill you find one that does not ask for any creds,and trust me there will be some plenty that do not ask for creds.Also you can telnet into some of them using the ip.You don't need creds for most of that aswell.

How To Telnet Into A Scada System:
I am sure most of you already know how to telnet,but if you don't i will be going over that here today.
If you are using Windows 7 go to the Start Menu>Control Panel>Programs>Check Telnet Client & Server and then click ok.
After you have enabled Telnet in your windows Machine you are going to want to go in cmd "You can get into cmd by going to start menu>type cmd>enter".After you are in cmd type "telnet "iphere"" without any of the " and then click enter.

Additional Information:
Shodan can also be used to find
Telnet Servers
Ftp Servers
Vps Servers
Anything that is connected to the internet can be found with Shodan.
Most Telnet Servers,Ftp And Vps require Crededentials though.
That being said,you can Bruteforce the login or you can search forever untill you find one .

[unknownAttacker]

wow, thanks for this! as those are fun by themselves and also a good additional attack vector, they've always been one of my biggest interest. I didn't know Shodan though, looks awesome

[Shodan]

wow, thanks for this! as those are fun by themselves and also a good additional attack vector, they've always been one of my biggest interest. I didn't know Shodan though, looks awesome

So you don't use Shodan to find Scada systems?
What do you use to find them may i ask?

[unknownAttacker]

google if I'm searching for something just for fun (SCADA, routers and CCTVs often have control panels that can be reached from the outside and simply opened in a browser) and nmap if I'm scanning a network (nmap can detect certain devices). read my tuts on searching and on hacking online devices: http://www.hackcommunity.com/Thread-Adva...ing--21283 http://www.hackcommunity.com/Thread-Hack...ne-devices

[ZeddOucherif]

Good topic, thank you for your hard work sir

[krank557]

that is really cool stuff ...

[Rocky Ajwani]

Sounds cool,really i've heard this 1st time....will give it a try

Thanks for sharing!

[krank557]

they r asking for username and password what would i do.. ?:/