Introducing BAMF (Backdoor Access Machine Farmer)

Programming
, ,
1

Github

Open-source tool I wrote that uses Shodan (a search-engine for the Internet of things) to automate the discovery of potentially vulnerable routers running outdated firmware which can be exploited in order to target every device on the network. Any thoughts?

6 Likes
2

Sounds very illegal. And pretty cool.

Maybe we could also add an option to limit it to certain ranges, or does this do that already?

2 Likes
3

I only took a quick look at the code and it doesn’t look like it is possible for now, the only way to include more than one target is by using the Shodan search engine, so implementing IP ranges with perhaps CIDR notation in the future will be very useful, and I’m curious to see what other backdoors @colental will support, because if they reach a fair amount it could a very interesting program to play with. I mean… to look at.

4

Nice job man… I’ve looked at your code briefly and well, I decided to mess around with shodan a bit in Python and found a error that I can’t seem to resolve… basically when I do:

try:
#do stuff
except shodan.APIError as error:
#do stuff

There’s a error thrown at ‘except shodan.APIError as error:’ and I’m just curious if you solved this or not? I’ve even looked at the help document here:

https://shodan.readthedocs.io/en/latest/tutorial.html#searching-shodan

and their code is:

# Wrap the request in a try/ except block to catch errors
try:
        # Search Shodan
        results = api.search('apache')

        # Show the results
        print('Results found: {}'.format(results['total']))
        for result in results['matches']:
                print('IP: {}'.format(result['ip_str']))
                print(result['data'])
                print('')
except shodan.APIError, e:
        print('Error: {}'.format(e))

Any thoughts? :confused:

1 Like
5

Are you using a valid Shodan API key?

You can get a Shodan API key for free by creating a free account at https://account.shodan.io/register.

If you’re using a valid API key and getting a shodan.APIError then my guess would be that you’re trying to use a method that is only usable by accounts of paying members, and not by free accounts.

Most core features are available to free accounts, albeit with a lower request limit, however some of the more comprehensive features are limited to paying members.

1 Like
6

Good idea - searching certain IP ranges is now supported. Just use search <ip_range> (CIDR notation).

2 Likes
7

Nice man! This is dope. Thanks.

1 Like
8

It’s a error in the code I believe… I will look for a solution sometime in the near future. In the mean time, I will play around with your code. I think it’ll be cool to add several different vulnerabilities to search for, but that’s just a thought. lololol.

~Cheers!

9

figured it out… lolololol… It’s a silly error. :S

But since I’m borked I can’t run my script… :frowning:

10

This topic was automatically closed after 30 days. New replies are no longer allowed.