The Streaming API is an HTTP-based service that returns a real-time stream of data collected by Shodan. The stream returns the information as a JSON-encoded string using 2 output formats that can be set using the "t" URL parameter:
https://stream.shodan.io
This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in devices located in certain ASNs.
https://stream.shodan.io/shodan/asn/{asn}?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/asn/3303,32475?key={YOUR_API_KEY}"
{
"hash": 1574478560,
"http": {
"robots_hash": null,
"redirects": [],
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"server": "LiteSpeed",
"host": "96.127.186.100",
"html": "",
"location": "/",
"html_hash": 0,
"sitemap": null,
"securitytxt_hash": null
},
"timestamp": "2021-01-28T04:29:02.206862",
"hostnames": [
"ams-pnode1.websitehostserver.net"
],
"org": "SingleHop LLC",
"data": "HTTP/1.0 301 Moved Permanently\r\nLocation: https://96.127.186.100/\r\nCache-Control: private, no-cache, max-age=0\r\nPragma: no-cache\r\nServer:LiteSpeed\r\nContent-Length: 0\r\nConnection: Close\r\n\r\n",
"port": 443,
"transport": "tcp",
"isp": "SingleHop LLC",
"asn": "AS32475",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": null,
"dma_code": null
},
"ip": 1618983524,
"domains": [
"websitehostserver.net"
],
"ip_str": "96.127.186.100",
"_id": "97533624-bd22-46ce-9395-17ad28b304d6",
"os": null,
"_shodan": {
"crawler": "6d64feef3c6422575abbbf34b1a2e0d9a29b812d",
"options": {},
"id": "1dbb01bb-5cd8-46b5-94d0-aee415b8c9ed",
"module": "auto",
"ptr": true
},
"opts": {}
}
{
"hash": -1008615971,
"product": "AkamaiGHost",
"http": {
"robots_hash": null,
"redirects": [],
"securitytxt": null,
"title": "Invalid URL",
"sitemap_hash": null,
"robots": null,
"server": "AkamaiGHost",
"host": "104.66.169.60",
"html": '...',
"location": "/",
"components": {},
"html_hash": 1470236789,
"sitemap": null,
"securitytxt_hash": null,
},
"timestamp": "2021-01-28T04:29:01.265871",
"hostnames": ["a104-66-169-60.deploy.static.akamaitechnologies.com"],
"org": "Akamai Technologies",
"data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 04:29:01 GMT\r\nDate: Thu, 28 Jan 2021 04:29:01 GMT\r\nConnection: close\r\n\r\n",
"port": 80,
"transport": "tcp",
"info": "Akamai's HTTP Acceleration & Mirror service",
"isp": "Akamai Technologies",
"asn": "AS3303",
"location": {
"country_code3": null,
"city": "Zurich",
"region_code": "ZH",
"postal_code": null,
"longitude": 8.5394,
"country_code": "CH",
"latitude": 47.3624,
"country_name": "Switzerland",
"area_code": null,
"dma_code": null,
},
"ip": 1749199164,
"domains": ["akamaitechnologies.com"],
"ip_str": "104.66.169.60",
"_id": "93aa0f66-a2fb-44bc-9b04-6488b776b915",
"os": null,
"_shodan": {
"crawler": "530935e60964ee0af497843f10b63adf84a753e3",
"options": {},
"id": "81d22eeb-60e5-4937-93af-557fcd7c089e",
"module": "http",
"ptr": true,
},
"opts": {},
}
...
$ shodan stream --asn 3303,32475
108.178.33.110 465 nts.newtechservics.net 220-nts.newtechservics.net ESMTP Exim 4.93 #2 Wed, 27 Jan 2021 22:30:46 -0600 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n250-nts.newtechservics.net Hello 224.211.96.163 [224.211.96.163]\r\n250-SIZE 104857600\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-AUTH PLAIN LOGIN\r\n250 HELP\r\n
194.209.127.35 443 HTTP/1.1 400 Bad Request\r\nDate: Thu, 28 Jan 2021 04:30:55 GMT\r\nServer: Apache\r\nContent-Length: 362\r\nConnection: close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n
198.91.83.212 587 220-so7.infinitysrv.com ESMTP Exim 4.93 #2 Wed, 27 Jan 2021 23:30:14 -0500 \r\n220-We do not authorize the use of this system to transport unsolicited, \r\n220 and/or bulk e-mail.\r\n250-so7.infinitysrv.com Hello 224.102.202.156 [224.102.202.156]\r\n250-SIZE 52428800\r\n250-8BITMIME\r\n250-PIPELINING\r\n250-STARTTLS\r\n250 HELP\r\n
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.asn(asn=['3303', '32475'], raw=False, timeout=None):
print(banner)
{
"product": "OpenSSH",
"hash": -1466980181,
"timestamp": "2021-01-28T04:32:43.847222",
"hostnames": ["198.69.174.178.static.wline.lns.sme.cust.swisscom.ch"],
"ssh": {
"hassh": "95bb891b9ee1c49ec74906ec70b53766",
"fingerprint": "93:34:09:e1:83:8c:b9:14:24:f1:47:dc:87:db:d5:13",
"mac": "hmac-sha2-256",
"cipher": "aes128-ctr",
"key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDIU zXYBIxlp9lna4xcY3WZou5L55r9rMgMDBYrDkg3y6V\nGLIQZUFo nxZFq6Lwvl29G3jTZoFRTnZvuuJiHzM5iAqbVLPwjMglD1VBTGt M9SPL85T/ltBys\n/kBp0aOFmJ50MqBBpmJBoGxSRruIlrdeWrpomT3T4D3VvfE2iTtZr15GREN/829CX0D8cDe5FU8J\nL7FxCiY8jmKjCh3d5PCyflK7xV6vNiueUXVGwTM7SaqggOjIRWpLq x9FtfVSUhlPC61vEdqbwvO\ncmMCpYCX81chG/ARrbGwTKPKZpEpdGUJIsrqYRiNO47Wtqubu4qgwsAxNwfvpuTqRn6F\n",
"kex": {
"languages": [""],
"server_host_key_algorithms": [
"ssh-rsa",
"ssh-dss",
"ecdsa-sha2-nistp256",
"ssh-ed25519",
],
"encryption_algorithms": [
"chacha20-poly1305@openssh.com",
"aes256-gcm@openssh.com",
"aes128-gcm@openssh.com",
"aes256-ctr",
"aes192-ctr",
"aes128-ctr",
],
"kex_follows": False,
"unused": 0,
"kex_algorithms": [
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
],
"compression_algorithms": ["none", "zlib@openssh.com"],
"mac_algorithms": [
"umac-128-etm@openssh.com",
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"umac-128@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
],
},
"type": "ssh-rsa",
},
"org": "Swisscom",
"data": "SSH-2.0-OpenSSH_6.6.1\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDIU zXYBIxlp9lna4xcY3WZou5L55r9rMgMDBYrDkg3y6V\nGLIQZUFo nxZFq6Lwvl29G3jTZoFRTnZvuuJiHzM5iAqbVLPwjMglD1VBTGt M9SPL85T/ltBys\n/kBp0aOFmJ50MqBBpmJBoGxSRruIlrdeWrpomT3T4D3VvfE2iTtZr15GREN/829CX0D8cDe5FU8J\nL7FxCiY8jmKjCh3d5PCyflK7xV6vNiueUXVGwTM7SaqggOjIRWpLq x9FtfVSUhlPC61vEdqbwvO\ncmMCpYCX81chG/ARrbGwTKPKZpEpdGUJIsrqYRiNO47Wtqubu4qgwsAxNwfvpuTqRn6F\nFingerprint: 93:34:09:e1:83:8c:b9:14:24:f1:47:dc:87:db:d5:13\n\nKex Algorithms:\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tssh-dss\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes256-gcm@openssh.com\n\taes128-gcm@openssh.com\n\taes256-ctr\n\taes192-ctr\n\taes128-ctr\n\nMAC Algorithms:\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
"port": 22,
"cpe23": ["cpe:2.3:a:openbsd:openssh:6.6.1"],
"info": "protocol 2.0",
"isp": "Swisscom",
"transport": "tcp",
"cpe": ["cpe:/a:openbsd:openssh:6.6.1"],
"asn": "AS3303",
"version": "6.6.1",
"location": {
"country_code3": None,
"city": "Rotkreuz",
"region_code": "ZG",
"postal_code": None,
"longitude": 8.4237,
"country_code": "CH",
"latitude": 47.1412,
"country_name": "Switzerland",
"area_code": None,
"dma_code": None,
},
"ip": 2997765574,
"domains": ["swisscom.ch"],
"ip_str": "178.174.69.198",
"_id": "869b9926-ec14-4f8f-9874-958ac0f594e2",
"os": None,
"_shodan": {
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
"options": {},
"id": "a25352e1-c6ee-4f16-9644-c5f0123b3c07",
"module": "ssh",
"ptr": True,
},
"opts": {},
}
{
"ip": 2999022327,
"hash": 1615177765,
"timestamp": "2021-01-28T04:32:31.377469",
"hostnames": ["247.114.193.178.dynamic.wline.res.cust.swisscom.ch"],
"org": "Swisscom",
"data": "NTP\nprotocolversion: 3\nstratum: 3\nleap: 0\nprecision: -19\nrootdelay: 0.0144958496094\nrootdisp: 0.0212249755859\nrefid: 3283747942\nreftime: 3820795962.41\npoll: 0\n\n",
"port": 123,
"transport": "udp",
"isp": "Swisscom",
"asn": "AS3303",
"location": {
"country_code3": None,
"city": "Bedano",
"region_code": "TI",
"postal_code": None,
"longitude": 8.9194,
"country_code": "CH",
"latitude": 46.0512,
"country_name": "Switzerland",
"area_code": None,
"dma_code": None,
},
"ntp": {
"root_delay": 0.014495849609375,
"clock_offset": -0.16389727592468262,
"precision": -19,
"reftime": 1611807162.412037,
"refid": 3283747942,
"delay": 0.35701704025268555,
"leap": 0,
"version": 3,
"root_dispersion": 0.0212249755859375,
"stratum": 3,
"poll": 0,
"monlist": None,
},
"domains": ["swisscom.ch"],
"ip_str": "178.193.114.247",
"_id": "6948a7a3-b461-4085-beea-12a81054f0ea",
"os": None,
"_shodan": {
"crawler": "6f55d367cbfc8dfe8f206264b1aea3853dd5b496",
"options": {},
"id": "027c411a-59aa-48ca-a87c-558ad6b39708",
"module": "ntp",
"ptr": True,
},
"opts": {
"raw": "1c0300ed000003b60000056fc3ba0466e3bcb83a697b40f3e3bcbcdf04f9b000e3bcbcdf08b73d09e3bcbcdf08e0a83c",
"ntp": {},
},
}
...
This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in devices located in certain countries.
https://stream.shodan.io/shodan/countries/{countries}?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/countries/DE,US?key={YOUR_API_KEY}"
{
"hash": -947592388,
"product": "Apache httpd",
"http": {
"robots_hash": null,
"redirects": [],
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": null,
"server": "Apache",
"host": "50.63.119.180",
"html": "\n\n\npageok
\n\n",
"location": "/",
"components": {},
"html_hash": -295716025,
"sitemap": null,
"securitytxt_hash": null
},
"timestamp": "2021-01-28T04:37:03.375136",
"hostnames": [
"ip-50-63-119-180.ip.secureserver.net"
],
"org": "GoDaddy.com, LLC",
"data": "HTTP/1.1 200 OK\r\nDate: Thu, 28 Jan 2021 04:36:59 GMT\r\nServer: Apache\r\nLast-Modified: Fri, 26 Apr 2013 01:57:05 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 76\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n",
"port": 80,
"transport": "tcp",
"isp": "GoDaddy.com, LLC",
"cpe23": [
"cpe:2.3:a:apache:http_server"
],
"cpe": [
"cpe:/a:apache:http_server"
],
"asn": "AS26496",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": null,
"dma_code": null
},
"ip": 843020212,
"domains": [
"secureserver.net"
],
"ip_str": "50.63.119.180",
"_id": "85efede2-0730-422c-9e50-bb78054c6d82",
"os": null,
"_shodan": {
"crawler": "6d64feef3c6422575abbbf34b1a2e0d9a29b812d",
"options": {},
"id": "e418aa3b-c938-4124-be79-1ae40eaec50c",
"module": "auto",
"ptr": true
},
"opts": {}
}
{
"hash": 561623480,
"tags": [
"cloud"
],
"timestamp": "2021-01-28T04:37:05.314514",
"hostnames": [
"server-13-249-211-149.blr50.r.cloudfront.net"
],
"org": "Amazon CloudFront",
"data": "HTTP/1.1 400 Bad Request\r\nServer: CloudFront\r\nDate: Thu, 28 Jan 2021 04:37:05 GMT\r\nContent-Type: text/html\r\nContent-Length: 915\r\nConnection: close\r\nX-Cache: Error from cloudfront\r\nVia: 1.1 b5f6daf006d688b2f5eef74923ab8562.cloudfront.net (CloudFront)\r\nX-Amz-Cf-Pop: BLR50-C3\r\nX-Amz-Cf-Id: jxkyP17GNCKAKARB8a3XpoQBB2yCkyNFv16WnkukSV5z8Sm-vcNBiA==\r\n\r\n\n\nERROR: The request could not be satisfied \n\n400 ERROR
\nThe request could not be satisfied.
\n
\nBad request.\nWe can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.\n
\nIf you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.\n
\n
\n\nGenerated by cloudfront (CloudFront)\nRequest ID: jxkyP17GNCKAKARB8a3XpoQBB2yCkyNFv16WnkukSV5z8Sm-vcNBiA==\n
\n\n\n",
"port": 443,
"cloud": {
"region": "GLOBAL",
"service": "AMAZON",
"provider": "Amazon"
},
"isp": "Amazon CloudFront",
"transport": "tcp",
"asn": "AS16509",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": null,
"dma_code": null
},
"ip": 234476437,
"domains": [
"cloudfront.net"
],
"ip_str": "13.249.211.149",
"_id": "da4400f5-e491-4b6b-a59d-87daa61f5a6f",
"os": null,
"_shodan": {
"crawler": "cdd92e2d835a37d2798fa6c7105171f4d214012f",
"options": {},
"id": "fccd014d-c1fb-4ccc-9608-c0f918994cd6",
"module": "https",
"ptr": true
},
"opts": {}
}
...
$ shodan stream --countries DE,US
104.119.235.104 443 a104-119-235-104.deploy.static.akamaitechnologies.com HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 04:42:31 GMT\r\nDate: Thu, 28 Jan 2021 04:42:31 GMT\r\nConnection: close\r\n\r\n
94.217.105.167 5060 dslb-094-217-105-167.094.217.pools.vodafone-ip.de SIP/2.0 404 Not Found\r\nVia: SIP/2.0/UDP nm;branch=foo;rport=26810;received=224.81.229.144\r\nFrom: ;tag=root\r\nTo: ;tag=264F54AE66322F72\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nUser-Agent: FRITZ!OS\r\nContent-Length: 0\r\n\r\n
217.245.253.62 5060 pd9f5fd3e.dip0.t-ipconnect.de SIP/2.0 404 Not Found\r\nVia: SIP/2.0/UDP nm;branch=foo;rport=26810;received=224.233.255.101\r\nFrom: ;tag=root\r\nTo: ;tag=BE51C3DE7CA9410B\r\nCall-ID: 50000\r\nCSeq: 42 OPTIONS\r\nUser-Agent: FRITZ!OS\r\nContent-Length: 0\r\n\r\n
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.countries(countries=['DE', 'US'], raw=False, timeout=None):
print(banner)
{
"hash": 1811259547,
"product": "AkamaiGHost",
"http": {
"robots_hash": None,
"redirects": [],
"securitytxt": None,
"title": "Invalid URL",
"sitemap_hash": None,
"robots": None,
"server": "AkamaiGHost",
"host": "104.65.171.116",
"html": "...",
"location": "/",
"components": {},
"html_hash": 519667384,
"sitemap": None,
"securitytxt_hash": None,
},
"timestamp": "2021-01-28T04: 48: 43.016220",
"hostnames": [
"a104-65-171-116.deploy.static.akamaitechnologies.com"
],
"org": "Akamai Technologies",
"data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu,28 Jan 2021 04: 48: 42 GMT\r\nDate: Thu,28 Jan 2021 04: 48: 42 GMT\r\nConnection: close\r\n\r\n",
"port": 80,
"transport": "tcp",
"info": "Akamai's HTTP Acceleration & Mirror service",
"isp": "Akamai Technologies",
"asn": "AS16625",
"location": {
"country_code3": None,
"city": "Seattle",
"region_code": "WA",
"postal_code": None,
"longitude": -122.3412,
"country_code": "US",
"latitude": 47.6032,
"country_name": "United States",
"area_code": None,
"dma_code": 819,
},
"ip": 1749134196,
"domains": [
"akamaitechnologies.com"
],
"ip_str": "104.65.171.116",
"_id": "55628ae0-4e44-4718-b54a-b111def82a1f",
"os": None,
"_shodan": {
"crawler": "7c8a517854004745d56289900cdd23806e84f988",
"options": {},
"id": "62879cde-6746-4e74-92b9-4ae6bd262042",
"module": "http",
"ptr": True,
},
"opts": {},
}
{
"hash": -1235910801,
"timestamp": "2021-01-28T04: 48: 43.598569",
"hostnames": [
"dynamic-095-115-022-014.95.115.pool.telefonica.de"
],
"org": "O2 Deutschland",
"data": "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\n\r\n",
"port": 8089,
"transport": "tcp",
"isp": "O2 Deutschland",
"asn": "AS6805",
"location": {
"country_code3": None,
"city": "Munich",
"region_code": "BY",
"postal_code": None,
"longitude": 11.5816,
"country_code": "DE",
"latitude": 48.1441,
"country_name": "Germany",
"area_code": None,
"dma_code": None,
},
"ip": 1601377806,
"domains": [
"telefonica.de"
],
"ip_str": "95.115.22.14",
"_id": "07296d34-6421-45d9-9c39-a2f8054829b0",
"os": None,
"_shodan": {
"crawler": "a63b71ce4b8ab943fe83502b265dc615867966e1",
"options": {},
"id": "46e37486-bf21-49b2-bd78-3e43693ff1f5",
"module": "https-simple-new",
"ptr": True,
},
"opts": {},
}
...
Only returns banner data for the list of specified ports. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in a specific list of ports.
https://stream.shodan.io/shodan/ports/{ports}?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/ports/22,443?key={YOUR_API_KEY}"
{
"hash": 1592590585,
"product": "AkamaiGHost",
"http": {
"robots_hash": null,
"redirects": [],
"securitytxt": null,
"title": "Invalid URL",
"sitemap_hash": null,
"robots": null,
"server": "AkamaiGHost",
"host": "23.8.80.84",
"html": "\nInvalid URL \n\nInvalid URL
\nThe requested URL \"[no URL]\", is invalid.\nReference #9.4ede3717.1611810347.6c0f8ec\n\n",
"location": "/",
"components": {},
"html_hash": 1809591553,
"sitemap": null,
"securitytxt_hash": null
},
"timestamp": "2021-01-28T05:05:47.864200",
"ssl": {
"chain_sha256": [
"555a575d447769003b96bc6b6849ffecc710831ccf648082dbcb0a6e81f0037f",
"14363822517e2989b087d0c9a42eef134a774bd0b2a0664d455af784bc08f4d0",
"68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b",
"d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef4"
],
"jarm": "2ad2ad0002ad2ad22c42d42d00000061cdb625ec378ec3fce160d347caef64",
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIRUTCCEDmgAwIBAgIRALPwTVpNEm50s5rtf/RAIEkwDQYJKoZIhvcNAQELBQAw\ngYYxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJERTETMBEGA1UEBxMKV2lsbWluZ3Rv\nbjEkMCIGA1UEChMbQ29ycG9yYXRpb24gU2VydmljZSBDb21wYW55MS8wLQYDVQQD\nEyZUcnVzdGVkIFNlY3VyZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgNTAeFw0yMTAx\nMTUwMDAwMDBaFw0yMjAyMTUyMzU5NTlaMIHNMQswCQYDVQQGEwJERTEOMAwGA1UE\nERMFNTEzNjgxHDAaBgNVBAgTE05vcmRyaGVpbi1XZXN0ZmFsZW4xEzARBgNVBAcT\nCkxldmVya3VzZW4xHzAdBgNVBAkTFkthaXNlci1XaWxoZWxtLUFsbGVlIDExETAP\nBgNVBAoTCEJheWVyIEFHMSUwIwYDVQQLExxCYXllciBCdXNpbmVzcyBTZXJ2aWNl\ncyBHbWJIMSAwHgYDVQQDExdwZnQuYmF5ZXJjcm9wc2NpZW5jZS51czCCASIwDQYJ\nKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMJuvlyHol6d+XOLgyI72qKzS3WDpfHM\nJ9eCiq7rI4fHipV7I6RvDhs798U0UycK4w+v7DpNeXfr3hp894gkPcTNPjmbSErJ\n5bEcBv+RSEESm1jlIYAtqLBjXgBA9U+MZbaKQWJ7YDtH3FkoCy/bNCQOxdMBV1yZ\ndjgVTDkOi8E+kOTJxq3gBXVAES7eEWMSuVPA83LbzQin6ceidxcw6z0XglFLvAy7\nk3IyCyRiWWF0p5nYY/Rl2hibggA92QYhcMKnvf6kgV9MHLCwx0GXeDYdEsyGAIN3\nm03e0RjtW2UOqSC9z+iQnr0KLak2Z9GoB3G17vL18CjYQYmOdlR1Af8CAwEAAaOC\nDW8wgg1rMB8GA1UdIwQYMBaAFPK7Ve78j8/QPxRoGpV+eQ6rFzD0MB0GA1UdDgQW\nBBS1flKkmb2EwtVxtskDDgInFOKkxDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/\nBAIwADAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwSwYDVR0gBEQwQjA2\nBgsrBgEEAbIxAQICCDAnMCUGCCsGAQUFBwIBFhlodHRwczovL2Nwcy51c2VydHJ1\nc3QuY29tMAgGBmeBDAECAjBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3JsLnVz\nZXJ0cnVzdC5jb20vVHJ1c3RlZFNlY3VyZUNlcnRpZmljYXRlQXV0aG9yaXR5NS5j\ncmwwgYIGCCsGAQUFBwEBBHYwdDBLBggrBgEFBQcwAoY/aHR0cDovL2NydC51c2Vy\ndHJ1c3QuY29tL1RydXN0ZWRTZWN1cmVDZXJ0aWZpY2F0ZUF1dGhvcml0eTUuY3J0\nMCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29tMIIBAwYKKwYB\nBAHWeQIEAgSB9ASB8QDvAHUARqVV63X6kSAwtaKJafTzfREsQXS+/Um4havy/HD+\nbUcAAAF3BQIGoAAABAMARjBEAiBacIci5y5rHCvYBpZfgJYa5cnFsMa5/trVAM+/\nLOpD+QIgVqDXtTaNPwhp7EsXc85UJ/4Y3fGEZSOA5QwqAIsva8kAdgDfpV6raIJP\nH2yt7rhfTj5a6s2iEqRqXo47EsAgRFwqcwAAAXcFAgbHAAAEAwBHMEUCIFOxIiQV\n9pHAsBaRIKFJhaAde4Sw+VnjSl4ZZ6I9ZOEJAiEAkouFkWT/y6YdRsgoqf+mab9Z\ncY5jAXu2qeXMM8Ih6OYwggq/BgNVHREEggq2MIIKsoIXcGZ0LmJheWVyY3JvcHNj\naWVuY2UudXOCFWFkbWluLmhvdC1wb3RhdG9lcy5jYYIRYWdyby5iYXllci1jYS5j\nb22CGGFsdW1uaS55b3V0aGFnc3VtbWl0LmNvbYIQYXBpLmJheWVyd2ViLmNvbYIZ\nYXBwcG9ydGZvbGlvLmJheWVyLmNvbS5icoIUYXByZW5kZWNvbi5iYXllci5jb22C\nGGNyb3BzY2llbmNlLmJheWVyLmNvbS5hcoIVZW5tb3ZpbWllbnRvLmJheWVyLmVz\nghNmb2N1cy5iYXllci1hZ3JpLmZyghdncmFudHM0dHJhaXRzLmJheWVyLmNvbYIT\naW1hZ2ViYW5rLmJheWVyLmNvbYIaaW5mby5jcm9wc2NpZW5jZS5iYXllci5jb22C\nD2xlYXBzLmJheWVyLmNvbYIRbWF2ZXJpY2suYmF5ZXIudXOCI21kbXdlYnNlcnZp\nY2UuY3JvcHNjaWVuY2UuYmF5ZXIuY29tghdtZWxhbmdlc3B1YmxpYy5iYXllci5m\ncoIbbW9iaWxlYXBpLmJhY2tlZGJ5YmF5ZXIuY29tgidtb2JpbGVhcGkuZW52aXJv\nbm1lbnRhbHNjaWVuY2UuYmF5ZXIudXOCHG5ld3NsZXR0ZXIueW91dGhhZ3N1bW1p\ndC5jb22CDW5wcy5iYXllci5jb22CFnBoeXRvYmFjLmJheWVyLWFncmkuZnKCG3Bo\neXRvcHJvZ3Jlc3MuYmF5ZXItYWdyaS5mcoIvcGxhdGZvcm1hZHlzdHJ5YnVjeWpu\nYS5jcm9wc2NpZW5jZS5iYXllci5jb20ucGyCE3BvbnRvcy5iYXllci5jb20uYnKC\nJnBwbWxvZ2luLmVudmlyb25tZW50YWxzY2llbmNlLmJheWVyLnVzgh5wcm9kMi5j\ncm9wc2NpZW5jZS5iYXllci5jb20ucHmCHnByb2QyLmNyb3BzY2llbmNlLmJheWVy\nLmNvbS51eYITcHJvdGVjbWFpcy5iYXllci5mcoIYcHJvdmVlZG9yZXMuYmF5ZXIu\nY29tLm14ghZwdWJsaWNoZWFsdGguYmF5ZXIuY29tghlwdWJsaWNoZWFsdGhtYWcu\nYmF5ZXIuY29tghZzdGFnZS5hcGkuYmF5ZXJ3ZWIuY29tgh1zdGFnZS5iYXllcmNy\nb3BzY2llbmNlLmNvbS5hcoIdc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20uY2+C\nHXN0YWdlLmJheWVyY3JvcHNjaWVuY2UuY29tLmVjgh1zdGFnZS5iYXllcmNyb3Bz\nY2llbmNlLmNvbS5weYIdc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20udmWCF3N0\nYWdlLmJlamEuYmF5ZXJ3ZWIuY29tghhzdGFnZS5iaWNhbmFkYS5iYXllci5jb22C\nHHN0YWdlLmNpcmN1bG8xMy5iYXllci5jb20ubXiCHnN0YWdlLmNyb3BzY2llbmNl\nLmJheWVyLmNvbS5hcoIec3RhZ2UuY3JvcHNjaWVuY2UuYmF5ZXIuY29tLmJvgh5z\ndGFnZS5jcm9wc2NpZW5jZS5iYXllci5jb20ucHmCHnN0YWdlLmNyb3BzY2llbmNl\nLmJheWVyLmNvbS51eYISc3RhZ2UuZmVlZGFiZWUuY29tgilzdGFnZS5tZG13ZWJz\nZXJ2aWNlLmNyb3BzY2llbmNlLmJheWVyLmNvbYIcc3RhZ2UubWljdWx0aXZvLmJh\neWVyLmNvbS5teIIYc3RhZ2UubWlwb3J0YWwuYmF5ZXIuY29tgiFzdGFnZS5tb2Jp\nbGVhcGkuYmFja2VkYnliYXllci5jb22CHnN0YWdlLnByb3ZlZWRvcmVzLmJheWVy\nLmNvbS5teIIbc3RhZ2Uuc2FsdWRhbWJpZW50YWwuY29tLm14giVzdGFnZS5zZWVk\ndGFnLmJheWVyY3JvcHNjaWVuY2UudXMuY29tgixzdGFnZS5zdGV3YXJkc2hpcG10\nZy5iYXllcmNyb3BzY2llbmNlLnVzLmNvbYIQc3RhcmRsLmJheWVyLmNvbYISc3Rh\ncmRscWEuYmF5ZXIuY29tghBzdGFycWEuYmF5ZXIuY29tgiJzdGV3YXJkc2hpcC5i\nYXllcmNyb3BzY2llbmNldXMuY29tgiZzdGV3YXJkc2hpcG10Zy5iYXllcmNyb3Bz\nY2llbmNlLnVzLmNvbYIbc3prb2xlbmlhLmFncm8uYmF5ZXIuY29tLnBsgil0ZXN0\nLmJjc2ZpZWxkYmlkcy5iYXllcmNyb3BzY2llbmNlLnVzLmNvbYIjdGVzdC5kaWdp\ndGFsLW1hcmtldGluZy5jcy5iYXllci5jb22CF3Rlc3QuaW50LmFncmFyLmJheWVy\nLmRlghx0ZXN0Lm5ldC5teWJheWVyc2VydmljZXMuY29tghV0ZXN0LnBmdC5iYXll\ncndlYi5jb22CDXd3dy5iYXlkaXIuY2yCEXd3dy5iYXllci1hZ3JpLmZyght3d3cu\nYmF5ZXJjcm9wc2NpZW5jZS5jb20uYXKCFHd3dy5iYXllcnRvb2xib3guY29tghB3\nd3cuYmF5ZXhwZXJ0LmN6ghB3d3cuYmF5ZXhwZXJ0LnNrghB3d3cuYmF5cHJvZml0\nLmN6ghB3d3cuYmF5cHJvZml0LnNrgih3d3cuYmNzZmllbGRiaWRzLmJheWVyY3Jv\ncHNjaWVuY2UudXMuY29tgiZ3d3cuYnVsa3JlcGFjay5iYXllcmNyb3BzY2llbmNl\nLnVzLmNvbYIWd3d3LmNvbHR1cmFlY3VsdHVyYS5pdIIYd3d3LmNvdm9pdHVyYWdl\nLmJheWVyLmZyghh3d3cuY3JvcHNjaWVuY2UuYmF5ZXIuY2yCHHd3dy5jcm9wc2Np\nZW5jZS5iYXllci5jb20ucHmCHHd3dy5jcm9wc2NpZW5jZS5iYXllci5jb20udXmC\nGHd3dy5jcm9wc2NpZW5jZS5iYXllci5yb4IYd3d3LmNyb3BzY2llbmNlLmJheWVy\nLnNrgg93d3cuY3NhdmF6YXMuaHWCInd3dy5kaWdpdGFsLW1hcmtldGluZy5jcy5i\nYXllci5jb22CJnd3dy5rYXRhbG9ncmFzdGl0ZWxuYXphc2h0aXRhLmJheWVyLmJn\nghV3d3cubW9tZW50b3MuYmF5ZXIubXiCHnd3dy5tb25pdG9yYWdnaW9jb2NjaW5p\nZ2xpYS5pdIIYd3d3Lm1vbm9ncmFmaWFzLmJheWVyLm14ghZ3d3cubXliYXllcmFj\nY291bnQuY29tghd3d3cubXliYXllcnNlcnZpY2VzLmNvbYIed3d3LnByb3RlY2Np\nb25hbWJpZW50YWwuY29tLmFyghx3d3cucHJvdmVlZG9yZXMuYmF5ZXIuY29tLm14\ngh13d3cucHVibGljaGVhbHRobWFnLmJheWVyLmNvbYIWd3d3LnNtYXJ0YWdyby5i\nYXllci5lY4Ihd3d3LnN0YWdlLmJheWVyY3JvcHNjaWVuY2UuY29tLmFygiF3d3cu\nc3RhZ2UuYmF5ZXJjcm9wc2NpZW5jZS5jb20udXmCFnd3dy50YXJpbS5iYXllci5j\nb20udHKCGnd3dy54bi0taDFhcGVoMWMueG4tLXAxYWNmMA0GCSqGSIb3DQEBCwUA\nA4IBAQA2mZ24FH7gy30Qjilz+YfzA+F2cmVUR+oPQZQ7iE+cWaMy3iDp8KCIlYx0\neaPVk7dggAA9smSwklA/K6+iKN1D6746CWQ5GByQX+5Wzm+rWqslhPj1izU4H+6R\nBqyX/QQ8lMcFYVcFSH6zTqPC5N7SOh9e60Kgps5kDTAWFYOhNcnZHT3eMobq90qY\n6RT26wWIUvIQjbnETAKO8mJYO/WwVJcRBXWP05uY/THV5MpHFx4xn2Tzc5KrZxJO\naTR2X2bzdgNAYKxk0j/duzulekB32vnPfYL5J9oatvkv28aiczOcZjq+UzyrWSjO\nfVvWpv/iYwvgQ3gOxP5FkRI2masF\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIGEjCCA/qgAwIBAgIRAPeCIneztajhC2LD+k4K+RwwDQYJKoZIhvcNAQEMBQAw\ngYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5MRQwEgYDVQQHEwtK\nZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMS4wLAYD\nVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE0\nMDkxMDAwMDAwMFoXDTI0MDkwOTIzNTk1OVowgYYxCzAJBgNVBAYTAlVTMQswCQYD\nVQQIEwJERTETMBEGA1UEBxMKV2lsbWluZ3RvbjEkMCIGA1UEChMbQ29ycG9yYXRp\nb24gU2VydmljZSBDb21wYW55MS8wLQYDVQQDEyZUcnVzdGVkIFNlY3VyZSBDZXJ0\naWZpY2F0ZSBBdXRob3JpdHkgNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\nggEBAI0GNgsj2QI1JOdYk8aNg/0JtkcQDJ8oVyVm1qosht+fd7UJuxnE+cfbrEiV\nheNHkCTUSAgHNYPAtMvTRpTW5SoXp5ywE9vstT+QEyTCh9hXe/Ix+9rHKaYiRV+H\nvfJapC9UmXHFP0V/eQPMRcS6kFjY/kLgGkpy/NmBblvAfw+BIqW7u1l+lxkJ9qOu\nSzcetveuGLsuekM9cc0bzChx5W3lc0kAbX/1KKiaByk/oMf3qHFkDf9q2KfrpY9A\n/KE4hgLdTC5hKrQrehazl7b+Epmx8G2MvsK28Vl7m1QD35vxtKHHiuDNOQdF5Ct4\nJtXfi2Kuzi1Q6bEVQymayy1DjwcCAwEAAaOCAXUwggFxMB8GA1UdIwQYMBaAFFN5\nv1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBTyu1Xu/I/P0D8UaBqVfnkOqxcw\n9DAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAU\nBggrBgEFBQcDAQYIKwYBBQUHAwIwIgYDVR0gBBswGTANBgsrBgEEAbIxAQICCDAI\nBgZngQwBAgIwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu\nY29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsG\nAQUFBwEBBGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29t\nL1VTRVJUcnVzdFJTQUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8v\nb2NzcC51c2VydHJ1c3QuY29tMA0GCSqGSIb3DQEBDAUAA4ICAQAGsUdhGf+feSte\n4SOKj+2XtTfw4uo5t21lm1kXoRPM/ObB8yzzuVscvwnZ8Dn8PXjQXlP3ycqtc91X\ng4i63y48TUjsrK1/d6IvWAuzMN7tkEzVbBVFWlZz9jxYMmeGhrZ5HFOIjYJRRduQ\n4jTYZFjX+cm5b8baZuS43nRqsYGARFYlsxIzUGSOITM6W0QZ7s15p6Nh7nRMGR/g\nm2qShUIzj2RDEz2XXDDTsVT9NnN7b2WhbBMmsXRxY7ERL/oZ6sZLzz7g0tdP/fOx\ngeY+CWp891EqIxQLd5HYdIyGXesILMu8EaX9zMY76kbahJ0HKL//f0+S2SKDaYe7\n6APSyu1jqjfEUeaBSlPlvP5pXbygHjr/gQDVPyFzre6+Di+qZSIvcWuqo/jV2jJk\nIxd1rieFcsdkepYyAPC5GxNzHg0eWG9N669bnSxpvVDvmEl6ztbp7gxM3ciisBQz\nOLApig0V1N+0+YUXUq5f/0lenGZ9cqN3cs0/8ClTp1p3o84ErzFhjWQCIaBTODTS\nhYvB1+z6Hf2ljqD50KHs/80KO4mQBsPZjod8rQQa2KP0W3yvCBR6Z7ZUKTGGB0FV\nQ29vl2FmGkHV80dWIIgWzkU6ajnQXygkTr46jKxNXqT+G5+FaY79d0Vpf9XNg+m1\nKw/4P1yG/5xtH6HrU2uqz3qOmM4yWg==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIFgTCCBGmgAwIBAgIQOXJEOvkit1HX02wQ3TE1lTANBgkqhkiG9w0BAQwFADB7\nMQswCQYDVQQGEwJHQjEbMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD\nVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UE\nAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTE5MDMxMjAwMDAwMFoXDTI4\nMTIzMTIzNTk1OVowgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpOZXcgSmVyc2V5\nMRQwEgYDVQQHEwtKZXJzZXkgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO\nZXR3b3JrMS4wLAYDVQQDEyVVU0VSVHJ1c3QgUlNBIENlcnRpZmljYXRpb24gQXV0\naG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgBJlFzYOw9sI\ns9CsVw127c0n00ytUINh4qogTQktZAnczomfzD2p7PbPwdzx07HWezcoEStH2jnG\nvDoZtF+mvX2do2NCtnbyqTsrkfjib9DsFiCQCT7i6HTJGLSR1GJk23+jBvGIGGqQ\nIjy8/hPwhxR79uQfjtTkUcYRZ0YIUcuGFFQ/vDP+fmyc/xadGL1RjjWmp2bIcmfb\nIWax1Jt4A8BQOujM8Ny8nkz+rwWWNR9XWrf/zvk9tyy29lTdyOcSOk2uTIq3XJq0\ntyA9yn8iNK5+O2hmAUTnAU5GU5szYPeUvlM3kHND8zLDU+/bqv50TmnHa4xgk97E\nxwzf4TKuzJM7UXiVZ4vuPVb+DNBpDxsP8yUmazNt925H+nND5X4OpWaxKXwyhGNV\nicQNwZNUMBkTrNN9N6frXTpsNVzbQdcS2qlJC9/YgIoJk2KOtWbPJYjNhLixP6Q5\nD9kCnusSTJV882sFqV4Wg8y4Z+LoE53MW4LTTLPtW//e5XOsIzstAL81VXQJSdhJ\nWBp/kjbmUZIO8yZ9HE0XvMnsQybQv0FfQKlERPSZ51eHnlAfV1SoPv10Yy+xUGUJ\n5lhCLkMaTLTwJUdZ+gQek9QmRkpQgbLevni3/GcV4clXhB4PY9bpYrrWX1Uu6lzG\nKAgEJTm4Diup8kyXHAc/DVL17e8vgg8CAwEAAaOB8jCB7zAfBgNVHSMEGDAWgBSg\nEQojPpbxB+zirynvgqV/0DCktDAdBgNVHQ4EFgQUU3m/WqorSs9UgOHYm8Cd8rID\nZsswDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wEQYDVR0gBAowCDAG\nBgRVHSAAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29t\nL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDQGCCsGAQUFBwEBBCgwJjAkBggr\nBgEFBQcwAYYYaHR0cDovL29jc3AuY29tb2RvY2EuY29tMA0GCSqGSIb3DQEBDAUA\nA4IBAQAYh1HcdCE9nIrgJ7cz0C7M7PDmy14R3iJvm3WOnnL+5Nb+qh+cli3vA0p+\nrvSNb3I8QzvAP+u431yqqcau8vzY7qN7Q/aGNnwU4M309z/+3ri0ivCRlv79Q2R+\n/czSAaF9ffgZGclCKxO/WIu6pKJmBHaIkU4MiRTOok3JMrO66BQavHHxW/BBC5gA\nCiIDEOUMsfnNkjcZ7Tvx5Dq2+UUTJnWvu6rvP3t3O9LEApE9GQDTF1w52z97GA1F\nzZOFli9d31kWTz9RvdVFGD/tSo7oBmF0Ixa1DVBzJ0RHfxBdiSprhTEUxOipakyA\nvGp4z7h/jnZymQyd/teRCBaho1+V\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb\nMBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow\nGAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj\nYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL\nMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE\nBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM\nGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP\nADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua\nBtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe\n3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4\nYgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR\nrOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm\nez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU\noBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF\nMAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v\nQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t\nb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF\nAAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q\nGE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz\nRt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2\nG9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi\nl2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3\nsmPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==\n-----END CERTIFICATE-----\n"
],
"dhparams": null,
"versions": [
"TLSv1",
"-SSLv2",
"-SSLv3",
"TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"tlsext": [
{
"id": 65281,
"name": "renegotiation_info"
},
{
"id": 11,
"name": "ec_point_formats"
},
{
"id": 35,
"name": "session_ticket"
}
],
"ja3s": "e35df3e00ca4ef31d42b34bebaa2f86e",
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20210115000000Z",
"expires": "20220215235959Z",
"expired": false,
"version": 2,
"extensions": [
{
"data": "0\\x16\\x80\\x14\\xf2\\xbbU\\xee\\xfc\\x8f\\xcf\\xd0?\\x14h\\x1a\\x95~y\\x0e\\xab\\x170\\xf4",
"name": "authorityKeyIdentifier"
},
{
"data": "\\x04\\x14\\xb5~R\\xa4\\x99\\xbd\\x84\\xc2\\xd5q\\xb6\\xc9\\x03\\x0e\\x02\\'\\x14\\xe2\\xa4\\xc4",
"name": "subjectKeyIdentifier"
},
{
"critical": true,
"data": "\\x03\\x02\\x05\\xa0",
"name": "keyUsage"
},
{
"critical": true,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage"
},
{
"data": "0B06\\x06\\x0b+\\x06\\x01\\x04\\x01\\xb21\\x01\\x02\\x02\\x080\\'0%\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x19https://cps.usertrust.com0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x02",
"name": "certificatePolicies"
},
{
"data": "0G0E\\xa0C\\xa0A\\x86?http://crl.usertrust.com/TrustedSecureCertificateAuthority5.crl",
"name": "crlDistributionPoints"
},
{
"data": "0t0K\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86?http://crt.usertrust.com/TrustedSecureCertificateAuthority5.crt0%\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x19http://ocsp.usertrust.com",
"name": "authorityInfoAccess"
},
{
"data": "\\x04\\x81\\xf1\\x00\\xef\\x00u\\x00F\\xa5U\\xebu\\xfa\\x91 0\\xb5\\xa2\\x89i\\xf4\\xf3}\\x11,At\\xbe\\xfdI\\xb8\\x85\\xab\\xf2\\xfcp\\xfemG\\x00\\x00\\x01w\\x05\\x02\\x06\\xa0\\x00\\x00\\x04\\x03\\x00F0D\\x02 Zp\\x87\"\\xe7.k\\x1c+\\xd8\\x06\\x96_\\x80\\x96\\x1a\\xe5\\xc9\\xc5\\xb0\\xc6\\xb9\\xfe\\xda\\xd5\\x00\\xcf\\xbf,\\xeaC\\xf9\\x02 V\\xa0\\xd7\\xb56\\x8d?\\x08i\\xecK\\x17s\\xceT\\'\\xfe\\x18\\xdd\\xf1\\x84e#\\x80\\xe5\\x0c*\\x00\\x8b/k\\xc9\\x00v\\x00\\xdf\\xa5^\\xabh\\x82O\\x1fl\\xad\\xee\\xb8_N>Z\\xea\\xcd\\xa2\\x12\\xa4j^\\x8e;\\x12\\xc0 D\\\\*s\\x00\\x00\\x01w\\x05\\x02\\x06\\xc7\\x00\\x00\\x04\\x03\\x00G0E\\x02 S\\xb1\"$\\x15\\xf6\\x91\\xc0\\xb0\\x16\\x91 \\xa1I\\x85\\xa0\\x1d{\\x84\\xb0\\xf9Y\\xe3J^\\x19g\\xa2=d\\xe1\\t\\x02!\\x00\\x92\\x8b\\x85\\x91d\\xff\\xcb\\xa6\\x1dF\\xc8(\\xa9\\xff\\xa6i\\xbfYq\\x8ec\\x01{\\xb6\\xa9\\xe5\\xcc3\\xc2!\\xe8\\xe6",
"name": "ct_precert_scts"
},
{
"data": "0\\x82\\n\\xb2\\x82\\x17pft.bayercropscience.us\\x82\\x15admin.hot-potatoes.ca\\x82\\x11agro.bayer-ca.com\\x82\\x18alumni.youthagsummit.com\\x82\\x10api.bayerweb.com\\x82\\x19appportfolio.bayer.com.br\\x82\\x14aprendecon.bayer.com\\x82\\x18cropscience.bayer.com.ar\\x82\\x15enmovimiento.bayer.es\\x82\\x13focus.bayer-agri.fr\\x82\\x17grants4traits.bayer.com\\x82\\x13imagebank.bayer.com\\x82\\x1ainfo.cropscience.bayer.com\\x82\\x0fleaps.bayer.com\\x82\\x11maverick.bayer.us\\x82#mdmwebservice.cropscience.bayer.com\\x82\\x17melangespublic.bayer.fr\\x82\\x1bmobileapi.backedbybayer.com\\x82\\'mobileapi.environmentalscience.bayer.us\\x82\\x1cnewsletter.youthagsummit.com\\x82\\rnps.bayer.com\\x82\\x16phytobac.bayer-agri.fr\\x82\\x1bphytoprogress.bayer-agri.fr\\x82/platformadystrybucyjna.cropscience.bayer.com.pl\\x82\\x13pontos.bayer.com.br\\x82&ppmlogin.environmentalscience.bayer.us\\x82\\x1eprod2.cropscience.bayer.com.py\\x82\\x1eprod2.cropscience.bayer.com.uy\\x82\\x13protecmais.bayer.fr\\x82\\x18proveedores.bayer.com.mx\\x82\\x16publichealth.bayer.com\\x82\\x19publichealthmag.bayer.com\\x82\\x16stage.api.bayerweb.com\\x82\\x1dstage.bayercropscience.com.ar\\x82\\x1dstage.bayercropscience.com.co\\x82\\x1dstage.bayercropscience.com.ec\\x82\\x1dstage.bayercropscience.com.py\\x82\\x1dstage.bayercropscience.com.ve\\x82\\x17stage.beja.bayerweb.com\\x82\\x18stage.bicanada.bayer.com\\x82\\x1cstage.circulo13.bayer.com.mx\\x82\\x1estage.cropscience.bayer.com.ar\\x82\\x1estage.cropscience.bayer.com.bo\\x82\\x1estage.cropscience.bayer.com.py\\x82\\x1estage.cropscience.bayer.com.uy\\x82\\x12stage.feedabee.com\\x82)stage.mdmwebservice.cropscience.bayer.com\\x82\\x1cstage.micultivo.bayer.com.mx\\x82\\x18stage.miportal.bayer.com\\x82!stage.mobileapi.backedbybayer.com\\x82\\x1estage.proveedores.bayer.com.mx\\x82\\x1bstage.saludambiental.com.mx\\x82%stage.seedtag.bayercropscience.us.com\\x82,stage.stewardshipmtg.bayercropscience.us.com\\x82\\x10stardl.bayer.com\\x82\\x12stardlqa.bayer.com\\x82\\x10starqa.bayer.com\\x82\"stewardship.bayercropscienceus.com\\x82&stewardshipmtg.bayercropscience.us.com\\x82\\x1bszkolenia.agro.bayer.com.pl\\x82)test.bcsfieldbids.bayercropscience.us.com\\x82#test.digital-marketing.cs.bayer.com\\x82\\x17test.int.agrar.bayer.de\\x82\\x1ctest.net.mybayerservices.com\\x82\\x15test.pft.bayerweb.com\\x82\\rwww.baydir.cl\\x82\\x11www.bayer-agri.fr\\x82\\x1bwww.bayercropscience.com.ar\\x82\\x14www.bayertoolbox.com\\x82\\x10www.bayexpert.cz\\x82\\x10www.bayexpert.sk\\x82\\x10www.bayprofit.cz\\x82\\x10www.bayprofit.sk\\x82(www.bcsfieldbids.bayercropscience.us.com\\x82&www.bulkrepack.bayercropscience.us.com\\x82\\x16www.colturaecultura.it\\x82\\x18www.covoiturage.bayer.fr\\x82\\x18www.cropscience.bayer.cl\\x82\\x1cwww.cropscience.bayer.com.py\\x82\\x1cwww.cropscience.bayer.com.uy\\x82\\x18www.cropscience.bayer.ro\\x82\\x18www.cropscience.bayer.sk\\x82\\x0fwww.csavazas.hu\\x82\"www.digital-marketing.cs.bayer.com\\x82&www.katalograstitelnazashtita.bayer.bg\\x82\\x15www.momentos.bayer.mx\\x82\\x1ewww.monitoraggiococciniglia.it\\x82\\x18www.monografias.bayer.mx\\x82\\x16www.mybayeraccount.com\\x82\\x17www.mybayerservices.com\\x82\\x1ewww.proteccionambiental.com.ar\\x82\\x1cwww.proveedores.bayer.com.mx\\x82\\x1dwww.publichealthmag.bayer.com\\x82\\x16www.smartagro.bayer.ec\\x82!www.stage.bayercropscience.com.ar\\x82!www.stage.bayercropscience.com.uy\\x82\\x16www.tarim.bayer.com.tr\\x82\\x1awww.xn--h1apeh1c.xn--p1acf",
"name": "subjectAltName"
}
],
"fingerprint": {
"sha256": "555a575d447769003b96bc6b6849ffecc710831ccf648082dbcb0a6e81f0037f",
"sha1": "39c0a00060c1a0df4b9dea017c8d87950fe0250a"
},
"serial": 2.3917953139147504e+38,
"subject": {
"C": "DE",
"CN": "pft.bayercropscience.us",
"L": "Leverkusen",
"O": "Bayer AG",
"ST": "Nordrhein-Westfalen",
"street": "Kaiser-Wilhelm-Allee 1",
"postalCode": "51368",
"OU": "Bayer Business Services GmbH"
},
"pubkey": {
"type": "rsa",
"bits": 2048
},
"issuer": {
"C": "US",
"L": "Wilmington",
"CN": "Trusted Secure Certificate Authority 5",
"O": "Corporation Service Company",
"ST": "DE"
}
},
"cipher": {
"version": "TLSv1/SSLv3",
"bits": 256,
"name": "ECDHE-RSA-AES256-GCM-SHA384"
},
"trust": {
"revoked": false,
"browser": {
"mozilla": true,
"apple": true,
"microsoft": true
}
},
"alpn": [
"http/1.1",
"http/1.0"
],
"ocsp": {}
},
"hostnames": [
"a23-8-80-84.deploy.static.akamaitechnologies.com"
],
"org": "Akamai Technologies",
"data": "HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 05:05:47 GMT\r\nDate: Thu, 28 Jan 2021 05:05:47 GMT\r\nConnection: close\r\n\r\n",
"port": 443,
"transport": "tcp",
"info": "Akamai's HTTP Acceleration & Mirror service",
"isp": "Akamai Technologies",
"asn": "AS16625",
"location": {
"country_code3": null,
"city": "Adelaide",
"region_code": "SA",
"postal_code": null,
"longitude": 138.6005,
"country_code": "AU",
"latitude": -34.9274,
"country_name": "Australia",
"area_code": null,
"dma_code": null
},
"ip": 386420820,
"domains": [
"akamaitechnologies.com"
],
"ip_str": "23.8.80.84",
"_id": "95d23749-3a9f-40fb-aa32-5e64fe763da7",
"os": null,
"_shodan": {
"crawler": "91597136eb9b132d7cc954511e0d9cbe7ce2e377",
"options": {},
"id": "7d720834-91ea-42dc-8b41-0100933116f1",
"module": "https",
"ptr": true
},
"opts": {
"vulns": [],
"heartbleed": "2021/01/28 05:06:04 23.8.80.84:443 - SAFE\n"
}
}
{
"hash": -1180342095,
"product": "Microsoft IIS httpd",
"http": {
"robots_hash": null,
"redirects": [],
"securitytxt": null,
"title": "Object moved",
"sitemap_hash": null,
"robots": null,
"server": "Microsoft-IIS/10.0",
"host": "104.208.220.204",
"html": "
Object moved \r\nObject moved to here.
\r\n\r\n",
"location": "/",
"components": {},
"html_hash": -1401938847,
"sitemap": null,
"securitytxt_hash": null
},
"tags": [
"cloud"
],
"timestamp": "2021-01-28T05:06:00.832166",
"ssl": {
"chain_sha256": [
"9e9296f5bdfafaa18ded4e605b4bde781d7e6ed3120ea3c7f4d6a2a2ad82c926",
"04eeea8e50b4775b3c24797262917ee50002ec4c75b56cdf3ee1c18cfca5ba52",
"16af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb"
],
"jarm": "2ad2ad0000000000002ad2ad2ad2ad0f0dcb2ae084f34cae790be1eab88c30",
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIHyTCCBbGgAwIBAgITawAAR4RWz3h/fZyp4QAAAABHhDANBgkqhkiG9w0BAQsF\nADBPMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u\nMSAwHgYDVQQDExdNaWNyb3NvZnQgUlNBIFRMUyBDQSAwMTAeFw0yMDEwMDExODA1\nNDlaFw0yMTEwMDExODA1NDlaMCgxJjAkBgNVBAMTHXBvZHMuZWRvZy5vZmZpY2Vh\ncHBzLmxpdmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyxtb\njXVQXjqmR22C+arRPNFo2geQs1RXh5r3XwRc6n5+rW34dpPMOHJ+n37JL32IN4KT\nq8DLiI63K41Z3KX5+AkxWg+PvlYWQZe0TmYYTTXiWkIcLWoEjwZknT8A5PQ4cmqh\nn/WWwAh7pNesKLveJIUp7t29JUG2xDVNL7OOqk0/C/tLcEhbe3XqresGMesWZ6Ka\nxm19rRSwRUnz6wlfsn1Qg+pPXkMrPyQUDwbS8LBWDeZDLInFFIA8G/J0Rkwk9Wnt\nxhnOXsEr14PXyWxP/mEb3fMXSTKiZBkm/MifyKyTaftFP6QU7v3syfRC9pj/OOUr\nUzCRt8EOYkRPyd9lsQIDAQABo4IDwzCCA78wggEFBgorBgEEAdZ5AgQCBIH2BIHz\nAPEAdwD2XJQv0XcwIhRUGAgwlFaO400TGTO/3wwvIAvMTvFk4wAAAXTlYLMIAAAE\nAwBIMEYCIQDhMKCTjFF/NWefgai00VKkTuFewZYqx6hp+KEW0UCsugIhAMO0nsg7\nvRWO+tslhGaqwQp6QZhw+YzoKDU0zZ10ZHzpAHYARJRlLrDuzq/EQAfYqP4owNrm\ngr7YyzG1P9MzlrW2gagAAAF05WCzBwAABAMARzBFAiEAiCCq6PTFY/YQ79qIxBrP\nUd+94xuM83qS5WlhDzNrngACIDOdkaZ+lekAK3MIPR9qAwgu+86nxe01r+lXc2C6\nGsIeMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwEwCgYIKwYBBQUHAwIwPgYJ\nKwYBBAGCNxUHBDEwLwYnKwYBBAGCNxUIh9qGdYPu2QGCyYUbgbWeYYX062CBXYWG\njkGHwphQAgFkAgElMIGHBggrBgEFBQcBAQR7MHkwUwYIKwYBBQUHMAKGR2h0dHA6\nLy93d3cubWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL01pY3Jvc29mdCUyMFJTQSUy\nMFRMUyUyMENBJTIwMDEuY3J0MCIGCCsGAQUFBzABhhZodHRwOi8vb2NzcC5tc29j\nc3AuY29tMB0GA1UdDgQWBBS6YxlUnWNuzh6qN4Z396dACGJKfjALBgNVHQ8EBAMC\nBLAwSQYDVR0RBEIwQIIdcG9kcy5lZG9nLm9mZmljZWFwcHMubGl2ZS5jb22CHyou\ncG9kcy5lZG9nLm9mZmljZWFwcHMubGl2ZS5jb20wgbAGA1UdHwSBqDCBpTCBoqCB\nn6CBnIZNaHR0cDovL21zY3JsLm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcmwv\nTWljcm9zb2Z0JTIwUlNBJTIwVExTJTIwQ0ElMjAwMS5jcmyGS2h0dHA6Ly9jcmwu\nbWljcm9zb2Z0LmNvbS9wa2kvbXNjb3JwL2NybC9NaWNyb3NvZnQlMjBSU0ElMjBU\nTFMlMjBDQSUyMDAxLmNybDBXBgNVHSAEUDBOMEIGCSsGAQQBgjcqATA1MDMGCCsG\nAQUFBwIBFidodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL21zY29ycC9jcHMw\nCAYGZ4EMAQIBMB8GA1UdIwQYMBaAFLV2DDARzseSQk1Mx1wsyKkM6AtkMB0GA1Ud\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0BAQsFAAOCAgEAi7Hk\nhCBIqlXo1RKiz4zrhuFjduHehfcM+DJAPyWX5yqu6rkVykMDK9q8eGg6LDJ4BsZC\nPR2RaUy8UbMTiJSD6LpZd9p3EwupxYA4p8wuz8SHahKpy0Ou0Kv0cv/ge6NwE6XB\n/yv62Wmrhr0ZYe3Opcaus0xTn8ToxO3lQpa2xgdH30oVzVNQw/sGdPlO2dxUfggC\ngHhZH9lFM0JKlJj63mYw8/nNzfO0rbJic38EPESdV8O7KW+5TRKBOVW4fNlCveXa\nqyfP3COfbjtCMIcxRxi1YpQ2QvG4G7UaegShpfcfDDNFO6teV6x8Ft208wjSkiEQ\nzTiEkmPmBQo8QZsy5fJRkuVFzAqBmCgKnd2dhP67IQqzpx9I5iKg8YCo0dRniJt+\nBJn/NPZWYkBtWVJQL5y5RhH40FcGKwa3D6uNfqIm2JQInPOKxXoEzvtxyuuvXhOb\n9tLOOjijwnEz0Flz6yBRivIB37Kv0+e6uTs/MYsT/GVLGAlpKgpuK4SGoPDPOr1i\nmi+AiLXHDuTmMGVOtSEMXNr5l0on6coEUFpBf3TmYud2ZJ3JZdGbsreES4qQwDhp\nRQDUobsFXHYq4wmXyvMPICH7JYlm4aiYTGwN/HKpDfTke1h/Mw5dW/cxUHWCS+cs\nvmvOoX+Uqrupd8sFyF5Alhzt3wfofG+lqREYmYQ=\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIFWjCCBEKgAwIBAgIQDxSWXyAgaZlP1ceseIlB4jANBgkqhkiG9w0BAQsFADBa\nMQswCQYDVQQGEwJJRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJl\nclRydXN0MSIwIAYDVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTIw\nMDcyMTIzMDAwMFoXDTI0MTAwODA3MDAwMFowTzELMAkGA1UEBhMCVVMxHjAcBgNV\nBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEgMB4GA1UEAxMXTWljcm9zb2Z0IFJT\nQSBUTFMgQ0EgMDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCqYnfP\nmmOyBoTzkDb0mfMUUavqlQo7Rgb9EUEf/lsGWMk4bgj8T0RIzTqk970eouKVuL5R\nIMW/snBjXXgMQ8ApzWRJCZbar879BV8rKpHoAW4uGJssnNABf2n17j9TiFy6BWy+\nIhVnFILyLNK+W2M3zK9gheiWa2uACKhuvgCca5Vw/OQYErEdG7LBEzFnMzTmJcli\nW1iCdXby/vI/OxbfqkKD4zJtm45DJvC9Dh+hpzqvLMiK5uo/+aXSJY+SqhoIEpz+\nrErHw+uAlKuHFtEjSeeku8eR3+Z5ND9BSqc6JtLqb0bjOHPm5dSRrgt4nnil75bj\nc9j3lWXpBb9PXP9Sp/nPCK+nTQmZwHGjUnqlO9ebAVQD47ZisFonnDAmjrZNVqEX\nF3p7laEHrFMxttYuD81BdOzxAbL9Rb/8MeFGQjE2Qx65qgVfhH+RsYuuD9dUw/3w\nZAhq05yO6nk07AM9c+AbNtRoEcdZcLCHfMDcbkXKNs5DJncCqXAN6LhXVERCw/us\nG2MmCMLSIx9/kwt8bwhUmitOXc6fpT7SmFvRAtvxg84wUkg4Y/Gx++0j0z6StSeN\n0EJz150jaHG6WV4HUqaWTb98Tm90IgXAU4AW2GBOlzFPiU5IY9jt+eXC2Q6yC/Zp\nTL1LAcnL3Qa/OgLrHN0wiw1KFGD51WRPQ0Sh7QIDAQABo4IBJTCCASEwHQYDVR0O\nBBYEFLV2DDARzseSQk1Mx1wsyKkM6AtkMB8GA1UdIwQYMBaAFOWdWTCCR1jMrPoI\nVDaGezq1BE3wMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggrBgEFBQcDAQYI\nKwYBBQUHAwIwEgYDVR0TAQH/BAgwBgEB/wIBADA0BggrBgEFBQcBAQQoMCYwJAYI\nKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTA6BgNVHR8EMzAxMC+g\nLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vT21uaXJvb3QyMDI1LmNybDAq\nBgNVHSAEIzAhMAgGBmeBDAECATAIBgZngQwBAgIwCwYJKwYBBAGCNyoBMA0GCSqG\nSIb3DQEBCwUAA4IBAQCfK76SZ1vae4qt6P+dTQUO7bYNFUHR5hXcA2D59CJWnEj5\nna7aKzyowKvQupW4yMH9fGNxtsh6iJswRqOOfZYC4/giBO/gNsBvwr8uDW7t1nYo\nDYGHPpvnpxCM2mYfQFHq576/TmeYu1RZY29C4w8xYBlkAA8mDJfRhMCmehk7cN5F\nJtyWRj2cZj/hOoI45TYDBChXpOlLZKIYiG1giY16vhCRi6zmPzEwv+tk156N6cGS\nVm44jTQ/rs1sa0JSYjzUaYngoFdZC4OfxnIkQvUIA4TOFmPzNPEFdjcZsgbeEz4T\ncGHTBPK4R28F44qIMCtHRV55VMX53ev6P3hRddJb\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ\nRTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD\nVQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX\nDTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y\nZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy\nVHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr\nmD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr\nIZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK\nmpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu\nXmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy\ndc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye\njl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1\nBE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3\nDQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92\n9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx\njkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0\nEpn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz\nksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS\nR9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp\n-----END CERTIFICATE-----\n"
],
"dhparams": null,
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"-TLSv1.3"
],
"acceptable_cas": [],
"tlsext": [
{
"id": 5,
"name": "status_request"
},
{
"id": 65281,
"name": "renegotiation_info"
}
],
"ja3s": "1d9c3e8c45ab7a2112263449a3ad9ece",
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20201001180549Z",
"expires": "20211001180549Z",
"expired": false,
"version": 2,
"extensions": [
{
"data": "\\x04\\x81\\xf3\\x00\\xf1\\x00w\\x00\\xf6\\\\\\x94/\\xd1w0\"\\x14T\\x18\\x080\\x94V\\x8e\\xe3M\\x13\\x193\\xbf\\xdf\\x0c/ \\x0b\\xccN\\xf1d\\xe3\\x00\\x00\\x01t\\xe5`\\xb3\\x08\\x00\\x00\\x04\\x03\\x00H0F\\x02!\\x00\\xe10\\xa0\\x93\\x8cQ\\x7f5g\\x9f\\x81\\xa8\\xb4\\xd1R\\xa4N\\xe1^\\xc1\\x96*\\xc7\\xa8i\\xf8\\xa1\\x16\\xd1@\\xac\\xba\\x02!\\x00\\xc3\\xb4\\x9e\\xc8;\\xbd\\x15\\x8e\\xfa\\xdb%\\x84f\\xaa\\xc1\\nzA\\x98p\\xf9\\x8c\\xe8(54\\xcd\\x9dtd|\\xe9\\x00v\\x00D\\x94e.\\xb0\\xee\\xce\\xaf\\xc4@\\x07\\xd8\\xa8\\xfe(\\xc0\\xda\\xe6\\x82\\xbe\\xd8\\xcb1\\xb5?\\xd33\\x96\\xb5\\xb6\\x81\\xa8\\x00\\x00\\x01t\\xe5`\\xb3\\x07\\x00\\x00\\x04\\x03\\x00G0E\\x02!\\x00\\x88 \\xaa\\xe8\\xf4\\xc5c\\xf6\\x10\\xef\\xda\\x88\\xc4\\x1a\\xcfQ\\xdf\\xbd\\xe3\\x1b\\x8c\\xf3z\\x92\\xe5ia\\x0f3k\\x9e\\x00\\x02 3\\x9d\\x91\\xa6~\\x95\\xe9\\x00+s\\x08=\\x1fj\\x03\\x08.\\xfb\\xce\\xa7\\xc5\\xed5\\xaf\\xe9Ws`\\xba\\x1a\\xc2\\x1e",
"name": "ct_precert_scts"
},
{
"data": "0\\x180\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x010\\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "UNDEF"
},
{
"data": "0/\\x06\\'+\\x06\\x01\\x04\\x01\\x827\\x15\\x08\\x87\\xda\\x86u\\x83\\xee\\xd9\\x01\\x82\\xc9\\x85\\x1b\\x81\\xb5\\x9ea\\x85\\xf4\\xeb`\\x81]\\x85\\x86\\x8eA\\x87\\xc2\\x98P\\x02\\x01d\\x02\\x01%",
"name": "UNDEF"
},
{
"data": "0y0S\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86Ghttp://www.microsoft.com/pki/mscorp/Microsoft%20RSA%20TLS%20CA%2001.crt0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x16http://ocsp.msocsp.com",
"name": "authorityInfoAccess"
},
{
"data": "\\x04\\x14\\xbac\\x19T\\x9dcn\\xce\\x1e\\xaa7\\x86w\\xf7\\xa7@\\x08bJ~",
"name": "subjectKeyIdentifier"
},
{
"data": "\\x03\\x02\\x04\\xb0",
"name": "keyUsage"
},
{
"data": "0@\\x82\\x1dpods.edog.officeapps.live.com\\x82\\x1f*.pods.edog.officeapps.live.com",
"name": "subjectAltName"
},
{
"data": "0\\x81\\xa50\\x81\\xa2\\xa0\\x81\\x9f\\xa0\\x81\\x9c\\x86Mhttp://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20RSA%20TLS%20CA%2001.crl\\x86Khttp://crl.microsoft.com/pki/mscorp/crl/Microsoft%20RSA%20TLS%20CA%2001.crl",
"name": "crlDistributionPoints"
},
{
"data": "0N0B\\x06\\t+\\x06\\x01\\x04\\x01\\x827*\\x010503\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\'http://www.microsoft.com/pki/mscorp/cps0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
"name": "certificatePolicies"
},
{
"data": "0\\x16\\x80\\x14\\xb5v\\x0c0\\x11\\xce\\xc7\\x92BML\\xc7\\\\,\\xc8\\xa9\\x0c\\xe8\\x0bd",
"name": "authorityKeyIdentifier"
},
{
"data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage"
}
],
"fingerprint": {
"sha256": "9e9296f5bdfafaa18ded4e605b4bde781d7e6ed3120ea3c7f4d6a2a2ad82c926",
"sha1": "9fa0354d790576aa30f02f21b16612fbb8773b21"
},
"serial": 2.3861798313051083e+45,
"subject": {
"CN": "pods.edog.officeapps.live.com"
},
"pubkey": {
"type": "rsa",
"bits": 2048
},
"issuer": {
"C": "US",
"CN": "Microsoft RSA TLS CA 01",
"O": "Microsoft Corporation"
}
},
"cipher": {
"version": "TLSv1/SSLv3",
"bits": 256,
"name": "ECDHE-RSA-AES256-GCM-SHA384"
},
"trust": {
"revoked": false,
"browser": {
"mozilla": true,
"apple": true,
"microsoft": true
}
},
"alpn": [],
"ocsp": {}
},
"cloud": {
"region": "useast2",
"service": null,
"provider": "Azure"
},
"hostnames": [],
"org": "Microsoft Azure",
"data": "HTTP/1.1 302 Found\r\nCache-Control: private\r\nContent-Type: text/html; charset=utf-8\r\nLocation: http://www.office.com/\r\nServer: Microsoft-IIS/10.0\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Expose-Headers: si, esid, X-EndSession, X-CorrelationID, X-OfficeFE, X-NewKey, X-OfficeCluster, Pid, SlideWidth, SlideHeight, ErrorCode, ErrorCategory, X-ErrorCode\r\nX-OfficeVersion: 16.0.13727.40505\r\nX-CorrelationId: 1f0ef74d-9cfc-4c22-a17e-8ef12d06ae9f\r\nX-UserSessionId: 1f0ef74d-9cfc-4c22-a17e-8ef12d06ae9f\r\nX-OfficeCluster: eus2-000.PODS.edog.officeapps.live.com\r\nX-AspNet-Version: 4.0.30319\r\nX-Powered-By: ASP.NET\r\nDate: Thu, 28 Jan 2021 05:06:00 GMT\r\nContent-Length: 139\r\n\r\n",
"port": 443,
"cpe23": [
"cpe:2.3:a:microsoft:internet_information_server:10.0",
"cpe:2.3:o:microsoft:windows"
],
"isp": "Microsoft Corporation",
"transport": "tcp",
"cpe": [
"cpe:/a:microsoft:internet_information_server:10.0",
"cpe:/o:microsoft:windows"
],
"asn": "AS8075",
"version": "10.0",
"location": {
"country_code3": null,
"city": "Boydton",
"region_code": "VA",
"postal_code": null,
"longitude": -78.375,
"country_code": "US",
"latitude": 36.6534,
"country_name": "United States",
"area_code": null,
"dma_code": 560
},
"ip": 1758518476,
"domains": [],
"ip_str": "104.208.220.204",
"_id": "7c29cbd8-51d2-44ed-ade2-d2f75eb6617a",
"os": null,
"_shodan": {
"crawler": "cdd92e2d835a37d2798fa6c7105171f4d214012f",
"options": {},
"id": "d31f59c7-6d19-4277-b89d-3f1b8413e5bf",
"module": "https",
"ptr": true
},
"opts": {
"vulns": [],
"heartbleed": "2021/01/28 05:06:08 104.208.220.204:443 - ERROR: write tcp 104.208.220.204:443: broken pipe\n"
}
}
...
$ shodan stream --ports 22,443
62.99.208.114 22 62-99-208-114.static.upcbusiness.at SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC+cCt9g0zdS4Wd7Kvuej6D118thiH1SdVeaFVYq5KbpTuf\ngHVhQYTaBtwH4jufBgluo2m0qxSogICTvzytQha/m+H8BOH6ujm/6feubcux6tDC/pE/fxmj0+5R\nNl+Cd4vdjXaMMxxuXW6zrHOBw41bjjflW+YES7kZXzbvbEExz0YOsBbhmucolXl/O0cuTuo6K8jy\nKYnb0USYqO5gnGzdIl9QhbJWHsaAgXaUtRK2OPGJl2SwM1tNmTQ6faMPHiV4a75LvxKMQEsYINj+\npDIGnKkoBsP21W4oG47JOMwffxTMgjv3k2SRR65Hal8obu0sEf6vLp4oWiCxB43ZdxQL\nFingerprint: 63:2a:85:f1:a7:b2:c3:e7:dc:0c:65:0f:8c:c4:87:b6\n\nKex Algorithms:\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tssh-dss\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
104.65.190.207 443 a104-65-190-207.deploy.static.akamaitechnologies.com HTTP/1.0 400 Bad Request\r\nServer: AkamaiGHost\r\nMime-Version: 1.0\r\nContent-Type: text/html\r\nContent-Length: 208\r\nExpires: Thu, 28 Jan 2021 05:12:33 GMT\r\nDate: Thu, 28 Jan 2021 05:12:33 GMT\r\nConnection: close\r\n\r\n
13.94.230.88 443 HTTP/1.1 404 Not Found\r\nDate: Thu, 28 Jan 2021 05:11:55 GMT\r\nServer: *\r\nStrict-Transport-Security: max-age=15724800\r\nAccept-Ranges: bytes\r\nContent-Type: text/html\r\nVary: User-Agent\r\nTransfer-Encoding: chunked\r\n\r\n
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.ports(ports=[22, 443], raw=False, timeout=None):
print(banner)
{
"hash": 1394961798,
"product": "Apache httpd",
"http": {
"robots_hash": None,
"redirects": [],
"securitytxt": None,
"title": "301 Moved Permanently",
"sitemap_hash": None,
"robots": None,
"server": "Apache",
"host": "oasissinks.com",
"html": '\n\n301 Moved Permanently \n\nMoved Permanently
\nThe document has moved here.
\n\n',
"location": "/",
"components": {},
"html_hash": 565781495,
"sitemap": None,
"securitytxt_hash": None,
},
"tags": [
"cloud"
],
"timestamp": "2021-01-28T05:13:42.379509",
"ssl": {
"chain_sha256": [
"ad5781f7f03081cb44d28641803a76ef6297f237510f71d804b18024ce1f5483",
"730c1bdcd85f57ce5dc0bba733e5f1ba5a925b2a771d640a26f7a454224dad3b",
"0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739",
],
"jarm": "07d14d16d21d21d00042d43d00000076e5b3c488a88e5790970b78ffb8afc2",
"chain": [
"-----BEGIN CERTIFICATE-----\nMIIFNjCCBB6gAwIBAgISBHnuPOJ9vokyFdA0YbgbtYsmMA0GCSqGSIb3DQEBCwUA\nMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\nEwJSMzAeFw0yMDEyMjExNzE4NTVaFw0yMTAzMjExNzE4NTVaMBsxGTAXBgNVBAMM\nECoub2FzaXNzaW5rcy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB\nAQCmXulskkbVDiq2t6WEegtPqjS4N8C9GiffdzhI5Raq8lL7Gt7mkvkOVKerFAZe\ngvOwZRI2LyRRHeuHGDObGJf2vEvAC4+EcJHBLnOibB8h3PvCkVV/Rb+1NtmkfKyv\nUyIP894uB5Zgsr6ldjWByLB951H7QybFbOpefFuj7q+r39D2FuTTAYFizWeyEjeo\neSIKwjvIY4siHeTjwG6gw6Q4QFwWGyK2O9AXm/bIPoDcFd9lKKapldcLtY+2n7NX\n+xLnrM67OKn8rttLrg43Pw+1+O8lFyF/+TpEwCUVweBpDx57VmulEpJ0m3vDSrf+\nGIxYdOI3HXn4Mc4CE2SDxaLPAgMBAAGjggJbMIICVzAOBgNVHQ8BAf8EBAMCBaAw\nHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD\nVR0OBBYEFIDJe2I/SDZT6mluR0P5SzVRfrlhMB8GA1UdIwQYMBaAFBQusxe3WFbL\nrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDov\nL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMuaS5sZW5jci5v\ncmcvMCsGA1UdEQQkMCKCECoub2FzaXNzaW5rcy5jb22CDm9hc2lzc2lua3MuY29t\nMEwGA1UdIARFMEMwCAYGZ4EMAQIBMDcGCysGAQQBgt8TAQEBMCgwJgYIKwYBBQUH\nAgEWGmh0dHA6Ly9jcHMubGV0c2VuY3J5cHQub3JnMIIBBAYKKwYBBAHWeQIEAgSB\n9QSB8gDwAHYARJRlLrDuzq/EQAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAF2hoaT\nGAAABAMARzBFAiBsoIuKHURakuYlI5tewVqDShto6C7aknnZhaVL/5/nHgIhAPB3\n6lsQg3nCZ0yZk/YFr2R47ZvKP3BhWnCnutmZDpy0AHYA9lyUL9F3MCIUVBgIMJRW\njuNNExkzv98MLyALzE7xZOMAAAF2hoaS/QAABAMARzBFAiAuIXOoAkur7UOxhaZ1\n6LCmpy/oZlZcvaDQjr46ZLqMqgIhAJzz/QSMwgrZAH608S9A1UQ8IG030JU6h11w\nNs0AFyIeMA0GCSqGSIb3DQEBCwUAA4IBAQAnkfvFcXrCdQ5SOa4ovN2ninWWQeOk\nQmLg2Tu0t+Fs72zbQj2+pvabqDpGdFAZeK3ZIgQxjwig2HmdVy292qxp53AOiZeZ\nrTyl/KLV4kjy9pB8KJTCG6nSpRaEOqLiTMWC+iuz8hBTJTXCLPu2/MXVTaQJjIFi\n3IMMREK56Nn4Pfq4iqtfYpcQWm15BjVPq0jF4p4EeyoicOE9wCks+zBUCxLN0lSF\n6XmvNH7xi3Rb8fY55KhcyocRJTelxhk3ndGs7ULcXe1Xw8nFJgwT0SkmDPkAoO43\n6qtOLW0O7QMA79CBDSk5Lo4gc5JmSt/nWgDrla1HNKsTNoJHglLmSKm1\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIEZTCCA02gAwIBAgIQQAF1BIMUpMghjISpDBbN3zANBgkqhkiG9w0BAQsFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTIwMTAwNzE5MjE0MFoXDTIxMDkyOTE5MjE0MFow\nMjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxCzAJBgNVBAMT\nAlIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuwIVKMz2oJTTDxLs\njVWSw/iC8ZmmekKIp10mqrUrucVMsa+Oa/l1yKPXD0eUFFU1V4yeqKI5GfWCPEKp\nTm71O8Mu243AsFzzWTjn7c9p8FoLG77AlCQlh/o3cbMT5xys4Zvv2+Q7RVJFlqnB\nU840yFLuta7tj95gcOKlVKu2bQ6XpUA0ayvTvGbrZjR8+muLj1cpmfgwF126cm/7\ngcWt0oZYPRfH5wm78Sv3htzB2nFd1EbjzK0lwYi8YGd1ZrPxGPeiXOZT/zqItkel\n/xMY6pgJdz+dU/nPAeX1pnAXFK9jpP+Zs5Od3FOnBv5IhR2haa4ldbsTzFID9e1R\noYvbFQIDAQABo4IBaDCCAWQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E\nBAMCAYYwSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5p\nZGVudHJ1c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTE\np7Gkeyxx+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEE\nAYLfEwEBATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2Vu\nY3J5cHQub3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0\nLmNvbS9EU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYf\nr52LFMLGMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjANBgkqhkiG9w0B\nAQsFAAOCAQEA2UzgyfWEiDcx27sT4rP8i2tiEmxYt0l+PAK3qB8oYevO4C5z70kH\nejWEHx2taPDY/laBL21/WKZuNTYQHHPD5b1tXgHXbnL7KqC401dk5VvCadTQsvd8\nS8MXjohyc9z9/G2948kLjmE6Flh9dDYrVYA9x2O+hEPGOaEOa1eePynBgPayvUfL\nqjBstzLhWVQLGAkXXmNs+5ZnPBxzDJOLxhF2JIbeQAcH5H0tZrUlo5ZYyOqA7s9p\nO5b85o3AM/OJ+CktFBQtfvBhcJVd9wvlwPsk+uyOy2HI7mNxKKgsBTt375teA2Tw\nUdHkhVNcsAKX1H7GNNLOEADksd86wuoXvg==\n-----END CERTIFICATE-----\n",
"-----BEGIN CERTIFICATE-----\nMIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow\nPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD\nEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\nAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O\nrz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq\nOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b\nxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw\n7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD\naeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV\nHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG\nSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69\nikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr\nAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz\nR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5\nJDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo\nOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ\n-----END CERTIFICATE-----\n",
],
"dhparams": {
"prime": "ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74020bbea63b139b22514a08798e3404ddef9519b3cd3a431b302b0a6df25f14374fe1356d6d51c245e485b576625e7ec6f44c42e9a637ed6b0bff5cb6f406b7edee386bfb5a899fa5ae9f24117c4b1fe649286651ece45b3dc2007cb8a163bf0598da48361c55d39a69163fa8fd24cf5f83655d23dca3ad961c62f356208552bb9ed529077096966d670c354e4abc9804f1746c08ca18217c32905e462e36ce3be39e772c180e86039b2783a2ec07a28fb5c55df06f4c52c9de2bcbf6955817183995497cea956ae515d2261898fa051015728e5a8aacaa68ffffffffffffffff",
"public_key": "23dca7ad62f0a9647f00262a5da160dfbc8b473f6828644c2680e635b7c995db67f0e537f911e45e6990a3fbfa4d542c0f462c946b6435f6fba2ab24996dda89f9bca6263fd6e77f4141e1ed45087aa4a0797101b17c1c450bd3c2e57cc30df5acbf75da0211ea1a08ed64e3a97dfdc230e312ec9c8cddaa8fd33367d8a66d216483478f9c6bc8be72fdcadcc50ef6a8d5a0c6c486a80f38307c5a78d6f7e6ba5dd7d3290de51aedcaab5405329d1c9344766a8a75af7080af025c82bb8e3fe01d3b1b6cc1775ca3162d38b86ec466e61b196475c2d65f90a77ab595e0de8801e60098760af62a61979c60429966d2e78ee85e34f53d73499fff3632978bf1af",
"bits": 2048,
"generator": 2,
"fingerprint": "RFC3526/Oakley Group 14",
},
"versions": [
"-TLSv1",
"-SSLv2",
"-SSLv3",
"-TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"acceptable_cas": [],
"tlsext": [
{
"id": 65281,
"name": "renegotiation_info"
},
{
"id": 11,
"name": "ec_point_formats"
},
{
"id": 35,
"name": "session_ticket"
},
{
"id": 5,
"name": "status_request"
},
],
"ja3s": "452c3b3abf0ed48df1b925f6977db72b",
"cert": {
"sig_alg": "sha256WithRSAEncryption",
"issued": "20201221171855Z",
"expires": "20210321171855Z",
"expired": False,
"version": 2,
"extensions": [
{
"critical": True,
"data": "\\x03\\x02\\x05\\xa0",
"name": "keyUsage"
},
{
"data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
"name": "extendedKeyUsage",
},
{
"critical": True,
"data": "0\\x00",
"name": "basicConstraints"
},
{
"data": "\\x04\\x14\\x80\\xc9{b?H6S\\xeainGC\\xf9K5Q~\\xb9a",
"name": "subjectKeyIdentifier",
},
{
"data": "0\\x16\\x80\\x14\\x14.\\xb3\\x17\\xb7XV\\xcb\\xaeP\\t@\\xe6\\x1f\\xaf\\x9d\\x8b\\x14\\xc2\\xc6",
"name": "authorityKeyIdentifier",
},
{
"data": '0G0!\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x15http: //r3.o.lencr.org0"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://r3.i.lencr.org/',
"name": "authorityInfoAccess",
},
{
"data": '0"\\x82\\x10*.oasissinks.com\\x82\\x0eoasissinks.com',
"name": "subjectAltName",
},
{
"data": "0C0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x0107\\x06\\x0b+\\x06\\x01\\x04\\x01\\x82\\xdf\\x13\\x01\\x01\\x010(0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttp://cps.letsencrypt.org",
"name": "certificatePolicies",
},
{
"data": '\\x04\\x81\\xf2\\x00\\xf0\\x00v\\x00D\\x94e.\\xb0\\xee\\xce\\xaf\\xc4@\\x07\\xd8\\xa8\\xfe(\\xc0\\xda\\xe6\\x82\\xbe\\xd8\\xcb1\\xb5?\\xd33\\x96\\xb5\\xb6\\x81\\xa8\\x00\\x00\\x01v\\x86\\x86\\x93\\x18\\x00\\x00\\x04\\x03\\x00G0E\\x02 l\\xa0\\x8b\\x8a\\x1dDZ\\x92\\xe6%#\\x9b^\\xc1Z\\x83J\\x1bh\\xe8.\\xda\\x92y\\xd9\\x85\\xa5K\\xff\\x9f\\xe7\\x1e\\x02!\\x00\\xf0w\\xea[\\x10\\x83y\\xc2gL\\x99\\x93\\xf6\\x05\\xafdx\\xed\\x9b\\xca?paZp\\xa7\\xba\\xd9\\x99\\x0e\\x9c\\xb4\\x00v\\x00\\xf6\\\\\\x94/\\xd1w0"\\x14T\\x18\\x080\\x94V\\x8e\\xe3M\\x13\\x193\\xbf\\xdf\\x0c/ \\x0b\\xccN\\xf1d\\xe3\\x00\\x00\\x01v\\x86\\x86\\x92\\xfd\\x00\\x00\\x04\\x03\\x00G0E\\x02 .!s\\xa8\\x02K\\xab\\xedC\\xb1\\x85\\xa6u\\xe8\\xb0\\xa6\\xa7/\\xe8fV\\\\\\xbd\\xa0\\xd0\\x8e\\xbe:d\\xba\\x8c\\xaa\\x02!\\x00\\x9c\\xf3\\xfd\\x04\\x8c\\xc2\\n\\xd9\\x00~\\xb4\\xf1/@\\xd5D< m7\\xd0\\x95:\\x87]p6\\xcd\\x00\\x17"\\x1e',
"name": "ct_precert_scts",
},
],
"fingerprint": {
"sha256": "ad5781f7f03081cb44d28641803a76ef6297f237510f71d804b18024ce1f5483",
"sha1": "f6b44d2c688e03f9d42acd0cfe253c106c079426",
},
"serial": 389939982519069921483757352690759710903078,
"subject": {
"CN": "*.oasissinks.com"
},
"pubkey": {
"type": "rsa",
"bits": 2048
},
"issuer": {
"C": "US",
"CN": "R3",
"O": "Let's Encrypt"
},
},
"cipher": {
"version": "TLSv1/SSLv3",
"bits": 256,
"name": "ECDHE-RSA-AES256-GCM-SHA384",
},
"trust": {
"revoked": False,
"browser": {
"mozilla": True,
"apple": True,
"microsoft": True
},
},
"alpn": [],
"ocsp": {
"version": "1",
"response_status": "successful",
"responder_id": "C = US, O = Let's Encrypt, CN = R3",
"cert_status": "good",
"produced_at": "2021-01-26 18:18:00",
"signature_algorithm": "sha256WithRSAEncryption",
"next_update": "2021-02-02 18:00:00",
"this_update": "2021-01-26 18:00:00",
"certificate_id": {
"hash_algorithm": "sha1",
"issuer_name_hash": "48DAC9A0FB2BD32D4FF0DE68D2F567B735F9B3C4",
"issuer_name_key": "142EB317B75856CBAE500940E61FAF9D8B14C2C6",
"serial_number": "03A1663F117331B98AFCA0DEB4B02739C3BA",
},
},
},
"cloud": {
"region": None,
"service": None,
"provider": "Linode"
},
"hostnames": [
"chemcore.com"
],
"org": "Linode",
"data": "HTTP/1.1 301 Moved Permanently\r\nDate: Thu, 28 Jan 2021 05:13:36 GMT\r\nServer: Apache\r\nLocation: http://www.chemcore.com\r\nContent-Length: 231\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n",
"port": 443,
"cpe23": [
"cpe:2.3:a:apache:http_server"
],
"isp": "Linode",
"transport": "tcp",
"cpe": [
"cpe:/a:apache:http_server"
],
"asn": "AS63949",
"location": {
"country_code3": None,
"city": "Richardson",
"region_code": "TX",
"postal_code": None,
"longitude": -96.7028,
"country_code": "US",
"latitude": 32.9473,
"country_name": "United States",
"area_code": None,
"dma_code": 623,
},
"ip": 1208922770,
"domains": [
"chemcore.com"
],
"ip_str": "72.14.178.146",
"_id": "5299001e-fb7e-4da4-b78e-9b468b398982",
"os": None,
"_shodan": {
"crawler": "1bab892ab6866024db9a99b462f1ef21bb739f5c",
"options": {
"hostname": "oasissinks.com",
"scan": "FlKR9617YSIozzg3"
},
"id": "18cefda1-2b9c-4b92-b431-d92032e9ba99",
"module": "https",
"ptr": True,
},
"opts": {
"vulns": [],
"heartbleed": "2021/01/28 05:13:54 72.14.178.146:443 - SAFE\n",
},
}
}
{
"product": "OpenSSH",
"hash": -620132291,
"timestamp": "2021-01-28T05:21:09.281831",
"hostnames": [
"ns3053083.ip-149-202-222.eu"
],
"ssh": {
"hassh": "b12d2871a1189eff20364cf5333619ee",
"fingerprint": "ce:2c:92:a4:77:4d:f9:c2:d5:ef:4f:ce:99:07:ae:49",
"mac": "hmac-sha2-256",
"cipher": "aes128-ctr",
"key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQC6JDa9LOkPFyvBTRufDWJr0nUBPaHbcdgL2pLRp7gu9kSJ\n5gSMdpZrAlhWrBnCCGzKeyItrgXzhlEDpD+tDA3jOTYk5faRxnsIAG5x0Y2PPAhmJsk79nApW7f1\nuNv5UoRFd5ZJEMP2P8uqGJU6hAGA628t4GYhlMcJrzrRh3WC+D6+jrRENUyl+s6i9ixvUr5nRWoV\n3bZNLTvvRxDkzqdLlltYv5YnT04rhfepOo7osp4l7/jsDlCdyH6eC7WCLTyBpwXxh9WPjINsrcVa\nqdffWY3kt91YY4zRqVCCMhhQDndn/86KC5B2WTCZPiTBcZqNPHpPJf7XziuFwuvFjtA9\n",
"kex": {
"languages": [
""
],
"server_host_key_algorithms": [
"ssh-rsa",
"rsa-sha2-512",
"rsa-sha2-256",
"ecdsa-sha2-nistp256",
"ssh-ed25519",
],
"encryption_algorithms": [
"chacha20-poly1305@openssh.com",
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
],
"kex_follows": False,
"unused": 0,
"kex_algorithms": [
"curve25519-sha256",
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group16-sha512",
"diffie-hellman-group18-sha512",
"diffie-hellman-group14-sha256",
"diffie-hellman-group14-sha1",
],
"compression_algorithms": [
"none",
"zlib@openssh.com"
],
"mac_algorithms": [
"umac-64-etm@openssh.com",
"umac-128-etm@openssh.com",
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-sha1-etm@openssh.com",
"umac-64@openssh.com",
"umac-128@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-sha1",
],
},
"type": "ssh-rsa",
},
"org": "OVH SAS",
"data": "SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC6JDa9LOkPFyvBTRufDWJr0nUBPaHbcdgL2pLRp7gu9kSJ\n5gSMdpZrAlhWrBnCCGzKeyItrgXzhlEDpD+tDA3jOTYk5faRxnsIAG5x0Y2PPAhmJsk79nApW7f1\nuNv5UoRFd5ZJEMP2P8uqGJU6hAGA628t4GYhlMcJrzrRh3WC+D6+jrRENUyl+s6i9ixvUr5nRWoV\n3bZNLTvvRxDkzqdLlltYv5YnT04rhfepOo7osp4l7/jsDlCdyH6eC7WCLTyBpwXxh9WPjINsrcVa\nqdffWY3kt91YY4zRqVCCMhhQDndn/86KC5B2WTCZPiTBcZqNPHpPJf7XziuFwuvFjtA9\nFingerprint: ce:2c:92:a4:77:4d:f9:c2:d5:ef:4f:ce:99:07:ae:49\n\nKex Algorithms:\n\tcurve25519-sha256\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group16-sha512\n\tdiffie-hellman-group18-sha512\n\tdiffie-hellman-group14-sha256\n\tdiffie-hellman-group14-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\trsa-sha2-512\n\trsa-sha2-256\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
"port": 22,
"transport": "tcp",
"info": "protocol 2.0",
"isp": "OVH SAS",
"cpe23": [
"cpe:2.3:a:openbsd:openssh:7.6p1 Ubuntu-4ubuntu0.3"
],
"cpe": [
"cpe:/a:openbsd:openssh:7.6p1 Ubuntu-4ubuntu0.3"
],
"asn": "AS16276",
"version": "7.6p1 Ubuntu-4ubuntu0.3",
"location": {
"country_code3": None,
"city": None,
"region_code": None,
"postal_code": None,
"longitude": 2.3387,
"country_code": "FR",
"latitude": 48.8582,
"country_name": "France",
"area_code": None,
"dma_code": None,
},
"ip": 2513100291,
"domains": [
"ip-149-202-222.eu"
],
"ip_str": "149.202.222.3",
"_id": "050f8982-a306-4f4e-bb29-8a32dc6d157a",
"os": "Ubuntu",
"_shodan": {
"crawler": "91597136eb9b132d7cc954511e0d9cbe7ce2e377",
"options": {},
"id": "b9885570-c914-41b5-a6d3-0755be1b4f92",
"module": "ssh",
"ptr": True,
},
"opts": {},
}
...
Only returns banner data for the list of specified vulnerabilities. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in a specific list of vulnerabilities.
https://stream.shodan.io/shodan/vulns/{vulns}?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/vulns/CVE-2017-7679,CVE-2018-15919?key={YOUR_API_KEY}"
{
"hash": -286560,
"product": "Apache httpd",
"http": {
"status": 400,
"robots_hash": -1022729730,
"redirects": [
{
"host": "136.243.203.117",
"html": "\n\n\n\t\n\t\n\n\n",
"data": "HTTP/1.1 200 OK\r\nDate: Sun, 26 Dec 2021 13:50:37 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sat, 02 May 2020 19:49:04 GMT\r\nETag: \"9c-5a4af97139ebf\"\r\nAccept-Ranges: bytes\r\nContent-Length: 156\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n",
"location": "/"
}
],
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": "User-agent: *\nDisallow: /\n",
"server": "Apache/2.4.25 (Debian)",
"host": "136.243.203.117",
"html": "\n\n\n\t\n\t\n\n\n",
"location": "/index.php",
"components": {
"PHP": {
"categories": []
}
},
"html_hash": 823453261,
"sitemap": null,
"securitytxt_hash": null
},
"vulns": {
"CVE-2019-0196": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4.39",
"http://www.openwall.com/lists/oss-security/2019/04/02/1",
"http://www.securityfocus.com/bid/107669",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/97a1c58e138ed58a364513b58d807a802e72bf6079ff81a10948ef7c@%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTJPHI3E3OKW7OT7COQXVG7DE7IDQ2OT/",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.netapp.com/advisory/ntap-20190617-0002/",
"https://support.f5.com/csp/article/K44591505",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422"
],
"cvss": "5.0",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly."
},
"CVE-2017-7679": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99170",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
"https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header."
},
"CVE-2017-7659": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.securityfocus.com/bid/99132",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a@%3Cannounce.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "5.0",
"summary": "A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process."
},
"CVE-2017-9788": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3913",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99569",
"http://www.securitytracker.com/id/1038906",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:2708",
"https://access.redhat.com/errata/RHSA-2017:2709",
"https://access.redhat.com/errata/RHSA-2017:2710",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://httpd.apache.org/security/vulnerabilities_22.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb@%3Cannounce.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20170911-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "6.4",
"summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service."
},
"CVE-2017-9798": {
"verified": false,
"references": [
"http://openwall.com/lists/oss-security/2017/09/18/2",
"http://www.debian.org/security/2017/dsa-3980",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"http://www.securityfocus.com/bid/100872",
"http://www.securityfocus.com/bid/105598",
"http://www.securitytracker.com/id/1039387",
"https://access.redhat.com/errata/RHSA-2017:2882",
"https://access.redhat.com/errata/RHSA-2017:2972",
"https://access.redhat.com/errata/RHSA-2017:3018",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
"https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
"https://github.com/apache/httpd/commit/29afdd2550b3d30a8defece2b95ae81edcf66ac9",
"https://github.com/hannob/optionsbleed",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
"https://security-tracker.debian.org/tracker/CVE-2017-9798",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0003/",
"https://support.apple.com/HT208331",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
"https://www.exploit-db.com/exploits/42745/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"cvss": "5.0",
"summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c."
},
"CVE-2018-11763": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
"http://www.securityfocus.com/bid/105414",
"http://www.securitytracker.com/id/1041713",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.netapp.com/advisory/ntap-20190204-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"cvss": "4.3",
"summary": "In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol."
},
"CVE-2017-3167": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99135",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed."
},
"CVE-2018-1312": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/7",
"http://www.securityfocus.com/bid/103524",
"http://www.securitytracker.com/id/1040571",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://access.redhat.com/errata/RHSA-2019:1898",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "6.8",
"summary": "In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection."
},
"CVE-2018-1333": {
"verified": false,
"references": [
"http://www.securitytracker.com/id/1041402",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180926-0007/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/"
],
"cvss": "5.0",
"summary": "By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33)."
},
"CVE-2017-3169": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99134",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
"https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port."
},
"CVE-2019-0197": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.openwall.com/lists/oss-security/2019/04/02/2",
"http://www.securityfocus.com/bid/107665",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://security.netapp.com/advisory/ntap-20190617-0002/",
"https://support.f5.com/csp/article/K44591505"
],
"cvss": "4.9",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue."
},
"CVE-2019-0220": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.openwall.com/lists/oss-security/2019/04/02/6",
"http://www.securityfocus.com/bid/107670",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2019/04/msg00008.html",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.netapp.com/advisory/ntap-20190625-0007/",
"https://support.f5.com/csp/article/K44591505",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422"
],
"cvss": "5.0",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them."
},
"CVE-2019-0211": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html",
"http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html",
"http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4.39",
"http://www.openwall.com/lists/oss-security/2019/04/02/3",
"http://www.securityfocus.com/bid/107666",
"https://access.redhat.com/errata/RHBA-2019:0959",
"https://access.redhat.com/errata/RHSA-2019:0746",
"https://access.redhat.com/errata/RHSA-2019:0980",
"https://access.redhat.com/errata/RHSA-2019:1296",
"https://access.redhat.com/errata/RHSA-2019:1297",
"https://access.redhat.com/errata/RHSA-2019:1543",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa@%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://seclists.org/bugtraq/2019/Apr/16",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.gentoo.org/glsa/201904-20",
"https://security.netapp.com/advisory/ntap-20190423-0001/",
"https://support.f5.com/csp/article/K32957101",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422",
"https://www.exploit-db.com/exploits/46676/",
"https://www.synology.com/security/advisory/Synology_SA_19_14"
],
"cvss": "7.2",
"summary": "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected."
},
"CVE-2017-15710": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/8",
"http://www.securityfocus.com/bid/103512",
"http://www.securitytracker.com/id/1040569",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "5.0",
"summary": "In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all."
},
"CVE-2018-1283": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/4",
"http://www.securityfocus.com/bid/103520",
"http://www.securitytracker.com/id/1040568",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "3.5",
"summary": "In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications."
},
"CVE-2017-7668": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99137",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "7.5",
"summary": "The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value."
},
"CVE-2017-15715": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/6",
"http://www.securityfocus.com/bid/103525",
"http://www.securitytracker.com/id/1040570",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "6.8",
"summary": "In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename."
},
"CVE-2018-17199": {
"verified": false,
"references": [
"http://www.securityfocus.com/bid/106742",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2019/01/msg00024.html",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.gentoo.org/glsa/201903-21",
"https://security.netapp.com/advisory/ntap-20190125-0001/",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
],
"cvss": "5.0",
"summary": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded."
}
},
"timestamp": "2021-12-26T13:50:38.138557",
"hostnames": [
"cloud.sata.support.de"
],
"org": null,
"data": "HTTP/1.1 400 Bad Request\r\nDate: Sun, 26 Dec 2021 13:50:38 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'nonce-Uzg3RlR0SGV4eWk2ZkVQTzRYVHVweUl5Y2x0MVFuRUF5WGlhSmlKa0Rvcz06SkxTY0llR3RsMmZ5UkNTbXF5T2RrRlp4SWc4Z0lVQm9peW5VVkdNSU4rND0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\nReferrer-Policy: no-referrer\r\nX-Content-Type-Options: nosniff\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-Permitted-Cross-Domain-Policies: none\r\nX-Robots-Tag: none\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: ocywvd3d4ksh=eva1s52oicv8tdeb7g0b7e66bc; path=/; HttpOnly\r\nSet-Cookie: oc_sessionPassphrase=turMN1jcd3qqiI4qFzrzqLVxkULQrAqmYaBNYHnPK0glR4ABkZKVi1TWtcxL9p%2Fp3XJi9UE35rkiewLJaoKAb5d%2B74HSEZZI4GpPVWWasb7X6YAeC5MncH8FVtfFNS7O; path=/; HttpOnly\r\nSet-Cookie: nc_sameSiteCookielax=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax\r\nSet-Cookie: nc_sameSiteCookiestrict=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n",
"port": 80,
"transport": "tcp",
"info": "(Debian)",
"isp": "Hetzner Online GmbH",
"cpe23": [
"cpe:2.3:a:php:php",
"cpe:2.3:a:apache:http_server:2.4.25"
],
"cpe": [
"cpe:/a:php:php",
"cpe:/a:apache:http_server:2.4.25"
],
"asn": "AS24940",
"version": "2.4.25",
"location": {
"city": "Oberdorla",
"region_code": "TH",
"area_code": null,
"longitude": 10.42163,
"latitude": 51.16585,
"country_code": "DE",
"country_name": "Germany"
},
"ip": 2297678709,
"domains": [
"support.de"
],
"ip_str": "136.243.203.117",
"os": null,
"_shodan": {
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
"options": {},
"id": "bb74aed0-dd93-4d4b-a51e-dd3bb2e10e04",
"module": "http",
"ptr": true
},
"opts": {}
}
...
$ shodan stream --vulns cve-2017-7679,cve-2018-15919
173.249.157.11 2202 server2.creationforce.com SSH-2.0-OpenSSH_7.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQCo5K7Ppgnaz5UNC/Lp2SpUWWQ5cH+dH0flWuWhfOKVuGjo\nZMAu/bMxYaKVgNUMb9Egd6uMcFJkdvTCSPr5mhb0jEEAV9lxTDwrJ+dHXU4u4g7YSUQACLF7IxDo\nzNcsNqZmiFdJh0Cv+njtEf+iBQkg0P7dLUP6EC4v+OayAZEUUaPqSQCh1++o1Od37UgMj1zAn9WC\neZ31p5hGNFrvLg0e7tYnnaQlukgTkJQ3IJ+E9s2/Id4dnKTqK9GBqsH2Co3La1/1TtxkUWVVCIrE\npY5LoTGkwJk+QQeo6CtYPpRvT62umNlbkTuCB/IF5BYPjZSnHxThmCtMB3dLylarEF1R\nFingerprint: 5d:c2:51:b0:e4:d0:07:a3:e9:58:65:da:f4:22:86:04\n\nKex Algorithms:\n\tcurve25519-sha256\n\tcurve25519-sha256@libssh.org\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group16-sha512\n\tdiffie-hellman-group18-sha512\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha256\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\trsa-sha2-512\n\trsa-sha2-256\n\tecdsa-sha2-nistp256\n\tssh-ed25519\n\nEncryption Algorithms:\n\tchacha20-poly1305@openssh.com\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\taes192-cbc\n\taes256-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\t3des-cbc\n\nMAC Algorithms:\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-sha1\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
193.16.14.153 80 concatenating.heldcallip.com HTTP/1.1 200 OK\r\nDate: Wed, 22 Dec 2021 03:23:27 GMT\r\nServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16\r\nX-Powered-By: PHP/5.4.16\r\nContent-Length: 162\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n
154.81.173.155 22 SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDG5PsqtH+nVoWThZJ39Bd0ej//JkdyAFAv9zZa/sZv+B19\nuhmZdWC3bu/T0GctnbmiirzdFvc03VOs4AVoud7/94ULB+seVjXoTVLRT/IeeScLygHAvogc9lKH\nnJQN6nou1Jv5qiyUvLbpA1kGo3KMF08aAkcQnYidvf8PgEltJCAjNEpCLyDLe0XqkIfNDYosz2Zt\nD/SMv5qFKvUkyVx29MXwrrVZjCveJ6Z0MT2G7muOasv+qLxG0yJllfEnKKqRYq/emLRjlPbtBMmC\nZrqE5xrNVqlxgp6vp4p9uuESRzgNFiw/GIg9/OnvIIb2yoSzdTXmBDarlnvExUQvQS/t\nFingerprint: 3d:53:eb:43:88:8b:7c:58:37:f4:79:2c:42:68:51:32\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.vulns(countries=['CVE-2017-7679', 'CVE-2018-15919'], raw=False, timeout=None):
print(banner)
{
"hash": -286560,
"product": "Apache httpd",
"http": {
"status": 400,
"robots_hash": -1022729730,
"redirects": [
{
"host": "136.243.203.117",
"html": "\n\n\n\t\n\t\n\n\n",
"data": "HTTP/1.1 200 OK\r\nDate: Sun, 26 Dec 2021 13:50:37 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nLast-Modified: Sat, 02 May 2020 19:49:04 GMT\r\nETag: \"9c-5a4af97139ebf\"\r\nAccept-Ranges: bytes\r\nContent-Length: 156\r\nVary: Accept-Encoding\r\nContent-Type: text/html\r\n\r\n",
"location": "/"
}
],
"securitytxt": null,
"title": null,
"sitemap_hash": null,
"robots": "User-agent: *\nDisallow: /\n",
"server": "Apache/2.4.25 (Debian)",
"host": "136.243.203.117",
"html": "\n\n\n\t\n\t\n\n\n",
"location": "/index.php",
"components": {
"PHP": {
"categories": []
}
},
"html_hash": 823453261,
"sitemap": null,
"securitytxt_hash": null
},
"vulns": {
"CVE-2019-0196": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4.39",
"http://www.openwall.com/lists/oss-security/2019/04/02/1",
"http://www.securityfocus.com/bid/107669",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/97a1c58e138ed58a364513b58d807a802e72bf6079ff81a10948ef7c@%3Ccvs.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTJPHI3E3OKW7OT7COQXVG7DE7IDQ2OT/",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.netapp.com/advisory/ntap-20190617-0002/",
"https://support.f5.com/csp/article/K44591505",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422"
],
"cvss": "5.0",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly."
},
"CVE-2017-7679": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99170",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-7679",
"https://lists.apache.org/thread.html/f4515e580dfb6eeca589a5cdebd4c4c709ce632b12924f343c3b7751@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header."
},
"CVE-2017-7659": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.securityfocus.com/bid/99132",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a@%3Cannounce.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "5.0",
"summary": "A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process."
},
"CVE-2017-9788": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3913",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99569",
"http://www.securitytracker.com/id/1038906",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:2708",
"https://access.redhat.com/errata/RHSA-2017:2709",
"https://access.redhat.com/errata/RHSA-2017:2710",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://httpd.apache.org/security/vulnerabilities_22.html",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb@%3Cannounce.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20170911-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "6.4",
"summary": "In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service."
},
"CVE-2017-9798": {
"verified": false,
"references": [
"http://openwall.com/lists/oss-security/2017/09/18/2",
"http://www.debian.org/security/2017/dsa-3980",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
"http://www.securityfocus.com/bid/100872",
"http://www.securityfocus.com/bid/105598",
"http://www.securitytracker.com/id/1039387",
"https://access.redhat.com/errata/RHSA-2017:2882",
"https://access.redhat.com/errata/RHSA-2017:2972",
"https://access.redhat.com/errata/RHSA-2017:3018",
"https://access.redhat.com/errata/RHSA-2017:3113",
"https://access.redhat.com/errata/RHSA-2017:3114",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3239",
"https://access.redhat.com/errata/RHSA-2017:3240",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html",
"https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch",
"https://github.com/apache/httpd/commit/29afdd2550b3d30a8defece2b95ae81edcf66ac9",
"https://github.com/hannob/optionsbleed",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798",
"https://security-tracker.debian.org/tracker/CVE-2017-9798",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0003/",
"https://support.apple.com/HT208331",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch",
"https://www.exploit-db.com/exploits/42745/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"cvss": "5.0",
"summary": "Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c."
},
"CVE-2018-11763": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html",
"http://www.securityfocus.com/bid/105414",
"http://www.securitytracker.com/id/1041713",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://security.netapp.com/advisory/ntap-20190204-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
],
"cvss": "4.3",
"summary": "In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol."
},
"CVE-2017-3167": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99135",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://lists.apache.org/thread.html/8409e41a8f7dd9ded37141c38df001be930115428c3d64f70bbdb8b4@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed."
},
"CVE-2018-1312": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/7",
"http://www.securityfocus.com/bid/103524",
"http://www.securitytracker.com/id/1040571",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://access.redhat.com/errata/RHSA-2019:1898",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "6.8",
"summary": "In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection."
},
"CVE-2018-1333": {
"verified": false,
"references": [
"http://www.securitytracker.com/id/1041402",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180926-0007/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3783-1/"
],
"cvss": "5.0",
"summary": "By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33)."
},
"CVE-2017-3169": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99134",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2478",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://access.redhat.com/errata/RHSA-2017:3195",
"https://access.redhat.com/errata/RHSA-2017:3475",
"https://access.redhat.com/errata/RHSA-2017:3476",
"https://access.redhat.com/errata/RHSA-2017:3477",
"https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169",
"https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us",
"https://www.nomachine.com/SU08O00185"
],
"cvss": "7.5",
"summary": "In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port."
},
"CVE-2019-0197": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.openwall.com/lists/oss-security/2019/04/02/2",
"http://www.securityfocus.com/bid/107665",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@%3Cdev.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://security.netapp.com/advisory/ntap-20190617-0002/",
"https://support.f5.com/csp/article/K44591505"
],
"cvss": "4.9",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue."
},
"CVE-2019-0220": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://www.openwall.com/lists/oss-security/2019/04/02/6",
"http://www.securityfocus.com/bid/107670",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2019/04/msg00008.html",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.netapp.com/advisory/ntap-20190625-0007/",
"https://support.f5.com/csp/article/K44591505",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422"
],
"cvss": "5.0",
"summary": "A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them."
},
"CVE-2019-0211": {
"verified": false,
"references": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html",
"http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html",
"http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html",
"http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html",
"http://www.apache.org/dist/httpd/CHANGES_2.4.39",
"http://www.openwall.com/lists/oss-security/2019/04/02/3",
"http://www.securityfocus.com/bid/107666",
"https://access.redhat.com/errata/RHBA-2019:0959",
"https://access.redhat.com/errata/RHSA-2019:0746",
"https://access.redhat.com/errata/RHSA-2019:0980",
"https://access.redhat.com/errata/RHSA-2019:1296",
"https://access.redhat.com/errata/RHSA-2019:1297",
"https://access.redhat.com/errata/RHSA-2019:1543",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa@%3Cusers.httpd.apache.org%3E",
"https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e@%3Cdev.community.apache.org%3E",
"https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac@%3Ccvs.httpd.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/",
"https://seclists.org/bugtraq/2019/Apr/16",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.gentoo.org/glsa/201904-20",
"https://security.netapp.com/advisory/ntap-20190423-0001/",
"https://support.f5.com/csp/article/K32957101",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422",
"https://www.exploit-db.com/exploits/46676/",
"https://www.synology.com/security/advisory/Synology_SA_19_14"
],
"cvss": "7.2",
"summary": "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected."
},
"CVE-2017-15710": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/8",
"http://www.securityfocus.com/bid/103512",
"http://www.securitytracker.com/id/1040569",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://usn.ubuntu.com/3937-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "5.0",
"summary": "In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all."
},
"CVE-2018-1283": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/4",
"http://www.securityfocus.com/bid/103520",
"http://www.securitytracker.com/id/1040568",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "3.5",
"summary": "In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a \"Session\" header. This comes from the \"HTTP_SESSION\" variable name used by mod_session to forward its data to CGIs, since the prefix \"HTTP_\" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications."
},
"CVE-2017-7668": {
"verified": false,
"references": [
"http://www.debian.org/security/2017/dsa-3896",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
"http://www.securityfocus.com/bid/99137",
"http://www.securitytracker.com/id/1038711",
"https://access.redhat.com/errata/RHSA-2017:2479",
"https://access.redhat.com/errata/RHSA-2017:2483",
"https://access.redhat.com/errata/RHSA-2017:3193",
"https://access.redhat.com/errata/RHSA-2017:3194",
"https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b@%3Cdev.httpd.apache.org%3E",
"https://security.gentoo.org/glsa/201710-32",
"https://security.netapp.com/advisory/ntap-20180601-0002/",
"https://support.apple.com/HT208221",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us"
],
"cvss": "7.5",
"summary": "The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value."
},
"CVE-2017-15715": {
"verified": false,
"references": [
"http://www.openwall.com/lists/oss-security/2018/03/24/6",
"http://www.securityfocus.com/bid/103525",
"http://www.securitytracker.com/id/1040570",
"https://access.redhat.com/errata/RHSA-2018:3558",
"https://access.redhat.com/errata/RHSA-2019:0366",
"https://access.redhat.com/errata/RHSA-2019:0367",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E",
"https://security.netapp.com/advisory/ntap-20180601-0004/",
"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us",
"https://usn.ubuntu.com/3627-1/",
"https://usn.ubuntu.com/3627-2/",
"https://www.debian.org/security/2018/dsa-4164"
],
"cvss": "6.8",
"summary": "In Apache httpd 2.4.0 to 2.4.29, the expression specified in could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename."
},
"CVE-2018-17199": {
"verified": false,
"references": [
"http://www.securityfocus.com/bid/106742",
"https://httpd.apache.org/security/vulnerabilities_24.html",
"https://lists.debian.org/debian-lts-announce/2019/01/msg00024.html",
"https://seclists.org/bugtraq/2019/Apr/5",
"https://security.gentoo.org/glsa/201903-21",
"https://security.netapp.com/advisory/ntap-20190125-0001/",
"https://usn.ubuntu.com/3937-1/",
"https://www.debian.org/security/2019/dsa-4422",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
],
"cvss": "5.0",
"summary": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded."
}
},
"timestamp": "2021-12-26T13:50:38.138557",
"hostnames": [
"cloud.sata.support.de"
],
"org": null,
"data": "HTTP/1.1 400 Bad Request\r\nDate: Sun, 26 Dec 2021 13:50:38 GMT\r\nServer: Apache/2.4.25 (Debian)\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nContent-Security-Policy: default-src 'self'; script-src 'self' 'nonce-Uzg3RlR0SGV4eWk2ZkVQTzRYVHVweUl5Y2x0MVFuRUF5WGlhSmlKa0Rvcz06SkxTY0llR3RsMmZ5UkNTbXF5T2RrRlp4SWc4Z0lVQm9peW5VVkdNSU4rND0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';\r\nReferrer-Policy: no-referrer\r\nX-Content-Type-Options: nosniff\r\nX-Download-Options: noopen\r\nX-Frame-Options: SAMEORIGIN\r\nX-Permitted-Cross-Domain-Policies: none\r\nX-Robots-Tag: none\r\nX-XSS-Protection: 1; mode=block\r\nSet-Cookie: ocywvd3d4ksh=eva1s52oicv8tdeb7g0b7e66bc; path=/; HttpOnly\r\nSet-Cookie: oc_sessionPassphrase=turMN1jcd3qqiI4qFzrzqLVxkULQrAqmYaBNYHnPK0glR4ABkZKVi1TWtcxL9p%2Fp3XJi9UE35rkiewLJaoKAb5d%2B74HSEZZI4GpPVWWasb7X6YAeC5MncH8FVtfFNS7O; path=/; HttpOnly\r\nSet-Cookie: nc_sameSiteCookielax=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax\r\nSet-Cookie: nc_sameSiteCookiestrict=true; path=/; httponly;expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict\r\nConnection: close\r\nTransfer-Encoding: chunked\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n",
"port": 80,
"transport": "tcp",
"info": "(Debian)",
"isp": "Hetzner Online GmbH",
"cpe23": [
"cpe:2.3:a:php:php",
"cpe:2.3:a:apache:http_server:2.4.25"
],
"cpe": [
"cpe:/a:php:php",
"cpe:/a:apache:http_server:2.4.25"
],
"asn": "AS24940",
"version": "2.4.25",
"location": {
"city": "Oberdorla",
"region_code": "TH",
"area_code": null,
"longitude": 10.42163,
"latitude": 51.16585,
"country_code": "DE",
"country_name": "Germany"
},
"ip": 2297678709,
"domains": [
"support.de"
],
"ip_str": "136.243.203.117",
"os": null,
"_shodan": {
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
"options": {},
"id": "bb74aed0-dd93-4d4b-a51e-dd3bb2e10e04",
"module": "http",
"ptr": true
},
"opts": {}
}
...
Only returns banner data for the specified query. This stream provides a filtered, bandwidth-saving view of the Banners stream in case you are only interested in banners matching a specific query. It generally follows the query syntax of the main search engine except that here the query is case-sensitive! The list of available keys can be found at Search Filters. Put a "-" or "!" before the key to negate the filter terms.
https://stream.shodan.io/shodan/custom/query={query}?key={YOUR_API_KEY}
$ curl -G --data-urlencode "query=port:22 SSH-2.0-OpenSSH_6.4" "https://stream.shodan.io/shodan/custom?key={YOUR_API_KEY}"
{
"product": "OpenSSH",
"hash": -1029792425,
"timestamp": "2021-12-27T18:21:53.120661",
"hostnames": [],
"org": "PEG TECH INC",
"data": "SSH-2.0-OpenSSH_6.4\\r\\n",
"port": 22,
"transport": "tcp",
"info": "protocol 2.0",
"isp": "PEG TECH INC",
"cpe23": [
"cpe:2.3:a:openbsd:openssh:6.4\\r\\n"
],
"cpe": [
"cpe:/a:openbsd:openssh:6.4\\r\\n"
],
"asn": "AS54600",
"version": "6.4\\r\\n",
"location": {
"city": "San Jose",
"region_code": "CA",
"area_code": null,
"longitude": -121.89496,
"latitude": 37.33939,
"country_code": "US",
"country_name": "United States"
},
"ip": 1804948851,
"domains": [],
"ip_str": "107.149.85.115",
"os": null,
"_shodan": {
"crawler": "ada8582d54117e5eb7c72186882e76f0854a54ae",
"options": {},
"id": "37f17a39-b456-4dbf-85ea-6dfd2d3f362f",
"module": "auto",
"ptr": true
},
"opts": {
"raw": "5353482d322e302d4f70656e5353485f362e340d0a"
}
}
{
"product": "OpenSSH",
"hash": -1400530513,
"vulns": {
"CVE-2014-2532": {
"verified": false,
"references": [
"http://advisories.mageia.org/MGASA-2014-0143.html",
"http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
"http://rhn.redhat.com/errata/RHSA-2014-1552.html",
"http://secunia.com/advisories/59855",
"http://www.debian.org/security/2014/dsa-2894",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
"http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"http://www.securityfocus.com/bid/66355",
"http://www.securitytracker.com/id/1029925",
"http://www.ubuntu.com/usn/USN-2155-1",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
"https://support.apple.com/HT205267"
],
"cvss": 5.8,
"summary": "sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character."
},
"CVE-2018-15919": {
"verified": false,
"references": [
"http://seclists.org/oss-sec/2018/q3/180",
"http://www.securityfocus.com/bid/105163",
"https://security.netapp.com/advisory/ntap-20181221-0001/"
],
"cvss": "5.0",
"summary": "Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or \"oracle\") as a vulnerability.'"
},
"CVE-2017-15906": {
"verified": false,
"references": [
"http://www.securityfocus.com/bid/101552",
"https://access.redhat.com/errata/RHSA-2018:0980",
"https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
"https://security.gentoo.org/glsa/201801-05",
"https://security.netapp.com/advisory/ntap-20180423-0004/",
"https://www.openssh.com/txt/release-7.6"
],
"cvss": 5,
"summary": "The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files."
},
"CVE-2014-1692": {
"verified": false,
"references": [
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://openwall.com/lists/oss-security/2014/01/29/10",
"http://openwall.com/lists/oss-security/2014/01/29/2",
"http://secunia.com/advisories/60184",
"http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
"http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h",
"http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
"http://www.securityfocus.com/bid/65230",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/90819"
],
"cvss": 7.5,
"summary": "The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition."
},
"CVE-2014-2653": {
"verified": false,
"references": [
"http://advisories.mageia.org/MGASA-2014-0166.html",
"http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://openwall.com/lists/oss-security/2014/03/26/7",
"http://rhn.redhat.com/errata/RHSA-2014-1552.html",
"http://rhn.redhat.com/errata/RHSA-2015-0425.html",
"http://secunia.com/advisories/59855",
"http://www.debian.org/security/2014/dsa-2894",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
"http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.securityfocus.com/bid/66459",
"http://www.ubuntu.com/usn/USN-2164-1",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513"
],
"cvss": 5.8,
"summary": "The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate."
},
"CVE-2016-10708": {
"verified": false,
"references": [
"http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
"http://www.securityfocus.com/bid/102780",
"https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
"https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
"https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
"https://security.netapp.com/advisory/ntap-20180423-0003/",
"https://usn.ubuntu.com/3809-1/",
"https://www.openssh.com/releasenotes.html"
],
"cvss": "5.0",
"summary": "sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."
},
"CVE-2016-0777": {
"verified": false,
"references": [
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175592.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175676.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
"http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
"http://seclists.org/fulldisclosure/2016/Jan/44",
"http://www.debian.org/security/2016/dsa-3446",
"http://www.openssh.com/txt/release-7.1p2",
"http://www.openwall.com/lists/oss-security/2016/01/14/7",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/archive/1/537295/100/0/threaded",
"http://www.securityfocus.com/bid/80695",
"http://www.securitytracker.com/id/1034671",
"http://www.ubuntu.com/usn/USN-2869-1",
"https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
"https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
"https://bto.bluecoat.com/security-advisory/sa109",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:07.openssh.asc",
"https://security.gentoo.org/glsa/201601-01",
"https://support.apple.com/HT206167"
],
"cvss": "4.0",
"summary": "The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key."
},
"CVE-2016-0778": {
"verified": false,
"references": [
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
"http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
"http://seclists.org/fulldisclosure/2016/Jan/44",
"http://www.debian.org/security/2016/dsa-3446",
"http://www.openssh.com/txt/release-7.1p2",
"http://www.openwall.com/lists/oss-security/2016/01/14/7",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/archive/1/537295/100/0/threaded",
"http://www.securityfocus.com/bid/80698",
"http://www.securitytracker.com/id/1034671",
"http://www.ubuntu.com/usn/USN-2869-1",
"https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
"https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
"https://bto.bluecoat.com/security-advisory/sa109",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://security.gentoo.org/glsa/201601-01",
"https://support.apple.com/HT206167"
],
"cvss": "4.6",
"summary": "The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings."
}
},
"timestamp": "2021-12-27T18:21:39.929427",
"hostnames": [],
"ssh": {
"hassh": "cca34b641961a75a15b91d1f1a13a3fb",
"fingerprint": "03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1",
"mac": "hmac-sha2-256",
"cipher": "aes128-ctr",
"key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\n",
"kex": {
"languages": [
""
],
"server_host_key_algorithms": [
"ssh-rsa",
"ecdsa-sha2-nistp256"
],
"encryption_algorithms": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"arcfour256",
"arcfour128",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
"aes128-cbc",
"3des-cbc",
"blowfish-cbc",
"cast128-cbc",
"aes192-cbc",
"aes256-cbc",
"arcfour",
"rijndael-cbc@lysator.liu.se"
],
"kex_follows": false,
"unused": 0,
"kex_algorithms": [
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1"
],
"compression_algorithms": [
"none",
"zlib@openssh.com"
],
"mac_algorithms": [
"hmac-md5-etm@openssh.com",
"hmac-sha1-etm@openssh.com",
"umac-64-etm@openssh.com",
"umac-128-etm@openssh.com",
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-ripemd160-etm@openssh.com",
"hmac-sha1-96-etm@openssh.com",
"hmac-md5-96-etm@openssh.com",
"hmac-md5",
"hmac-sha1",
"umac-64@openssh.com",
"umac-128@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-ripemd160",
"hmac-ripemd160@openssh.com",
"hmac-sha1-96",
"hmac-md5-96"
]
},
"type": "ssh-rsa"
},
"org": "Henan Telcom Union Technology Co., LTD",
"data": "SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\nFingerprint: 03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
"port": 22,
"cpe23": [
"cpe:2.3:a:openbsd:openssh:6.4"
],
"info": "protocol 2.0",
"isp": "Zhengzhou Fastidc Technology Co.,Ltd.",
"transport": "tcp",
"cpe": [
"cpe:/a:openbsd:openssh:6.4"
],
"asn": "AS56005",
"version": "6.4",
"location": {
"city": "Tianjin",
"region_code": "TJ",
"area_code": null,
"longitude": 117.17667,
"latitude": 39.14222,
"country_code": "CN",
"country_name": "China"
},
"ip": 707994107,
"domains": [],
"ip_str": "42.51.33.251",
"os": null,
"_shodan": {
"crawler": "49217c0cdcbcebaf23c2979ae16d4eba64180b1f",
"options": {},
"id": "202965c3-78b2-4938-936f-6899d2cec8e4",
"module": "ssh",
"ptr": true
},
"opts": {}
}
...
$ shodan stream --custom "port:22 SSH-2.0-OpenSSH_6.4"
137.175.113.46 22 SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQCqhhK+6gyE1MdcL8lqwLw10BBpj9k++QaHi6oCXPXVJbbJ\nW1AUhdk4tKiWVtyYWS9EZ4jQ9vGIWtQxxlqBp9iD8ffpiibFHYefhjfU/0QFwVTYoSx63CQzXO7+\n6zSnqVDUVmlSriGeBK3EyuiWWJYbgxag2BmVdluIWgktppAeWYkBcYv2BRW9AIM8JvGPFXJllSrs\n8jzRh+WWRnjC+Q5+kqN6urrVvugHzOWXBmwXOKD8bOVLiXxy15WIzBKmYSKeoKsU5J1tfb8wjT4Q\nDEcwEwvPd2ZH3W3OACZbHw7JhcEXw+1Qxz/wrxFA6xouKadz4OnB4Ct06HcEvp7avMrD\nFingerprint: 17:fc:ff:f7:e8:04:a1:c2:e6:d0:0c:7d:3f:7a:50:93\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
192.74.224.154 22 SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQC0X2KQh7lXH9T3892mIbHxM7iVB4znBK3DYWMZ1pjZuzmY\ndCKT6grznVBMI6C76xpev81c+9CEhDunEv6mr3tWOuOk7qNZ5YvBziaXfM7FYM+1TpauX2DsxBAd\nZHOfd2ryRkULJYwhhSeZL1Ll/zlrxIkhWChRIb4PPnwWcoIeFDY9OlbQBaWeJKexxLnhTx0PLOX5\n8dOC2q24v8SUOXMuus+vOsz1LtnZRWGcOCfmMccGWwtgj2c4P1035A+kLrTbpq6eRaS/a9JlNJlG\n/UwzAeL3FAH3QlNIKEUBUG46VRadQ6GsfBmaWCMpRPXuBen6gqwGemNvRkf5e6qwUoWT\nFingerprint: 4e:e3:af:75:1f:ab:b2:39:ff:4f:f9:4f:81:ee:78:b2\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
23.95.27.143 22 23-95-27-143-host.colocrossing.com SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDb0/uGkFtis2b+Bq0O9LKijxUqyumtJ1KW0FNcTm8z9Vik\nMobyt61lX1nSbFDs6mQkS34mfSahdPd0RpwmVCr62MQB3xPwqPyURPEz9ZO17VNeqvzyI9Oo8sA4\n3VizuJLv6bkZ/DZxYXKOBgmWwWmwiSq+Chj5GXGuCYM/FXnkEnhBFBO6dyuPz+tUO/nIULpyTZ5b\nhMD9ABvErm6vDXFFnCR3BEdi5zPjYir0mZzkBE1enlMOCYbLgaS0L2JER1Ote4AtBlexxhj6/6Ry\n4IRdJlgqymVfVq0KgpLGJN1VnF4I0KC2si52fTy3KSsi65xZcYnZrLeIkgf4Vm2ee5oz\nFingerprint: fd:1b:0c:49:c9:aa:07:1b:b2:ae:20:e5:2a:6b:43:f8\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.custom(query="port:22 SSH-2.0-OpenSSH_6.4", raw=False, timeout=None):
print(banner)
{
"product": "OpenSSH",
"hash": -1029792425,
"timestamp": "2021-12-27T18:21:53.120661",
"hostnames": [],
"org": "PEG TECH INC",
"data": "SSH-2.0-OpenSSH_6.4\\r\\n",
"port": 22,
"transport": "tcp",
"info": "protocol 2.0",
"isp": "PEG TECH INC",
"cpe23": [
"cpe:2.3:a:openbsd:openssh:6.4\\r\\n"
],
"cpe": [
"cpe:/a:openbsd:openssh:6.4\\r\\n"
],
"asn": "AS54600",
"version": "6.4\\r\\n",
"location": {
"city": "San Jose",
"region_code": "CA",
"area_code": null,
"longitude": -121.89496,
"latitude": 37.33939,
"country_code": "US",
"country_name": "United States"
},
"ip": 1804948851,
"domains": [],
"ip_str": "107.149.85.115",
"os": null,
"_shodan": {
"crawler": "ada8582d54117e5eb7c72186882e76f0854a54ae",
"options": {},
"id": "37f17a39-b456-4dbf-85ea-6dfd2d3f362f",
"module": "auto",
"ptr": true
},
"opts": {
"raw": "5353482d322e302d4f70656e5353485f362e340d0a"
}
}
{
"product": "OpenSSH",
"hash": -1400530513,
"vulns": {
"CVE-2014-2532": {
"verified": false,
"references": [
"http://advisories.mageia.org/MGASA-2014-0143.html",
"http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
"http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2",
"http://rhn.redhat.com/errata/RHSA-2014-1552.html",
"http://secunia.com/advisories/59855",
"http://www.debian.org/security/2014/dsa-2894",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
"http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html",
"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
"http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html",
"http://www.securityfocus.com/bid/66355",
"http://www.securitytracker.com/id/1029925",
"http://www.ubuntu.com/usn/USN-2155-1",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/91986",
"https://support.apple.com/HT205267"
],
"cvss": 5.8,
"summary": "sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character."
},
"CVE-2018-15919": {
"verified": false,
"references": [
"http://seclists.org/oss-sec/2018/q3/180",
"http://www.securityfocus.com/bid/105163",
"https://security.netapp.com/advisory/ntap-20181221-0001/"
],
"cvss": "5.0",
"summary": "Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. NOTE: the discoverer states 'We understand that the OpenSSH developers do not want to treat such a username enumeration (or \"oracle\") as a vulnerability.'"
},
"CVE-2017-15906": {
"verified": false,
"references": [
"http://www.securityfocus.com/bid/101552",
"https://access.redhat.com/errata/RHSA-2018:0980",
"https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
"https://security.gentoo.org/glsa/201801-05",
"https://security.netapp.com/advisory/ntap-20180423-0004/",
"https://www.openssh.com/txt/release-7.6"
],
"cvss": 5,
"summary": "The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files."
},
"CVE-2014-1692": {
"verified": false,
"references": [
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://marc.info/?l=bugtraq&m=144050155601375&w=2",
"http://openwall.com/lists/oss-security/2014/01/29/10",
"http://openwall.com/lists/oss-security/2014/01/29/2",
"http://secunia.com/advisories/60184",
"http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637",
"http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9;r2=1.10;f=h",
"http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10",
"http://www.securityfocus.com/bid/65230",
"https://exchange.xforce.ibmcloud.com/vulnerabilities/90819"
],
"cvss": 7.5,
"summary": "The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition."
},
"CVE-2014-2653": {
"verified": false,
"references": [
"http://advisories.mageia.org/MGASA-2014-0166.html",
"http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html",
"http://marc.info/?l=bugtraq&m=141576985122836&w=2",
"http://openwall.com/lists/oss-security/2014/03/26/7",
"http://rhn.redhat.com/errata/RHSA-2014-1552.html",
"http://rhn.redhat.com/errata/RHSA-2015-0425.html",
"http://secunia.com/advisories/59855",
"http://www.debian.org/security/2014/dsa-2894",
"http://www.mandriva.com/security/advisories?name=MDVSA-2014:068",
"http://www.mandriva.com/security/advisories?name=MDVSA-2015:095",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.securityfocus.com/bid/66459",
"http://www.ubuntu.com/usn/USN-2164-1",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513"
],
"cvss": 5.8,
"summary": "The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate."
},
"CVE-2016-10708": {
"verified": false,
"references": [
"http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html",
"http://www.securityfocus.com/bid/102780",
"https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737",
"https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
"https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html",
"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html",
"https://security.netapp.com/advisory/ntap-20180423-0003/",
"https://usn.ubuntu.com/3809-1/",
"https://www.openssh.com/releasenotes.html"
],
"cvss": "5.0",
"summary": "sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."
},
"CVE-2016-0777": {
"verified": false,
"references": [
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175592.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175676.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
"http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
"http://seclists.org/fulldisclosure/2016/Jan/44",
"http://www.debian.org/security/2016/dsa-3446",
"http://www.openssh.com/txt/release-7.1p2",
"http://www.openwall.com/lists/oss-security/2016/01/14/7",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/archive/1/537295/100/0/threaded",
"http://www.securityfocus.com/bid/80695",
"http://www.securitytracker.com/id/1034671",
"http://www.ubuntu.com/usn/USN-2869-1",
"https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
"https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
"https://bto.bluecoat.com/security-advisory/sa109",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-16:07.openssh.asc",
"https://security.gentoo.org/glsa/201601-01",
"https://support.apple.com/HT206167"
],
"cvss": "4.0",
"summary": "The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key."
},
"CVE-2016-0778": {
"verified": false,
"references": [
"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734",
"http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176516.html",
"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176349.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00006.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00007.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00013.html",
"http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00014.html",
"http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html",
"http://seclists.org/fulldisclosure/2016/Jan/44",
"http://www.debian.org/security/2016/dsa-3446",
"http://www.openssh.com/txt/release-7.1p2",
"http://www.openwall.com/lists/oss-security/2016/01/14/7",
"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html",
"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html",
"http://www.securityfocus.com/archive/1/537295/100/0/threaded",
"http://www.securityfocus.com/bid/80698",
"http://www.securitytracker.com/id/1034671",
"http://www.ubuntu.com/usn/USN-2869-1",
"https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/",
"https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/",
"https://bto.bluecoat.com/security-advisory/sa109",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680",
"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722",
"https://security.gentoo.org/glsa/201601-01",
"https://support.apple.com/HT206167"
],
"cvss": "4.6",
"summary": "The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings."
}
},
"timestamp": "2021-12-27T18:21:39.929427",
"hostnames": [],
"ssh": {
"hassh": "cca34b641961a75a15b91d1f1a13a3fb",
"fingerprint": "03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1",
"mac": "hmac-sha2-256",
"cipher": "aes128-ctr",
"key": "AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\n",
"kex": {
"languages": [
""
],
"server_host_key_algorithms": [
"ssh-rsa",
"ecdsa-sha2-nistp256"
],
"encryption_algorithms": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"arcfour256",
"arcfour128",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
"aes128-cbc",
"3des-cbc",
"blowfish-cbc",
"cast128-cbc",
"aes192-cbc",
"aes256-cbc",
"arcfour",
"rijndael-cbc@lysator.liu.se"
],
"kex_follows": false,
"unused": 0,
"kex_algorithms": [
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1"
],
"compression_algorithms": [
"none",
"zlib@openssh.com"
],
"mac_algorithms": [
"hmac-md5-etm@openssh.com",
"hmac-sha1-etm@openssh.com",
"umac-64-etm@openssh.com",
"umac-128-etm@openssh.com",
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-ripemd160-etm@openssh.com",
"hmac-sha1-96-etm@openssh.com",
"hmac-md5-96-etm@openssh.com",
"hmac-md5",
"hmac-sha1",
"umac-64@openssh.com",
"umac-128@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-ripemd160",
"hmac-ripemd160@openssh.com",
"hmac-sha1-96",
"hmac-md5-96"
]
},
"type": "ssh-rsa"
},
"org": "Henan Telcom Union Technology Co., LTD",
"data": "SSH-2.0-OpenSSH_6.4\nKey type: ssh-rsa\nKey: AAAAB3NzaC1yc2EAAAADAQABAAABAQDFwCWAOWfK2UouwmiJ1pm4iXTNwvqhEPHtnR1Pc6wI5SiE\nEhGI/ckuGstLUTIBLbgO6jz+B94MKt+SQqMzamaZd/khexavl2bzYq4YtF79o42V1/im7qw/lBXq\ncUuyTYWakhxQUlOyz75Kw8G87O5Fl0Mgwp2bN9aRAKJpsjFCX3n/d8p6NKNZRdmvl+aimjhDAeKF\nopxIRHlfSUruY9XHVIqI9XxE1IH3c7Ean7QkRI4hKTUC6BCLqGOW2lPtetFsbaFICYBugxSKGJkd\nm/7DAakoYm9bTZsGexUFRz9P+h7pTXSMKmW3H2/ioqcarmvs2e+6QeTBOV9VTq2baOop\nFingerprint: 03:b2:2e:ab:88:bc:48:67:d0:54:3e:4d:f4:bb:5c:d1\n\nKex Algorithms:\n\tecdh-sha2-nistp256\n\tecdh-sha2-nistp384\n\tecdh-sha2-nistp521\n\tdiffie-hellman-group-exchange-sha256\n\tdiffie-hellman-group-exchange-sha1\n\tdiffie-hellman-group14-sha1\n\tdiffie-hellman-group1-sha1\n\nServer Host Key Algorithms:\n\tssh-rsa\n\tecdsa-sha2-nistp256\n\nEncryption Algorithms:\n\taes128-ctr\n\taes192-ctr\n\taes256-ctr\n\tarcfour256\n\tarcfour128\n\taes128-gcm@openssh.com\n\taes256-gcm@openssh.com\n\taes128-cbc\n\t3des-cbc\n\tblowfish-cbc\n\tcast128-cbc\n\taes192-cbc\n\taes256-cbc\n\tarcfour\n\trijndael-cbc@lysator.liu.se\n\nMAC Algorithms:\n\thmac-md5-etm@openssh.com\n\thmac-sha1-etm@openssh.com\n\tumac-64-etm@openssh.com\n\tumac-128-etm@openssh.com\n\thmac-sha2-256-etm@openssh.com\n\thmac-sha2-512-etm@openssh.com\n\thmac-ripemd160-etm@openssh.com\n\thmac-sha1-96-etm@openssh.com\n\thmac-md5-96-etm@openssh.com\n\thmac-md5\n\thmac-sha1\n\tumac-64@openssh.com\n\tumac-128@openssh.com\n\thmac-sha2-256\n\thmac-sha2-512\n\thmac-ripemd160\n\thmac-ripemd160@openssh.com\n\thmac-sha1-96\n\thmac-md5-96\n\nCompression Algorithms:\n\tnone\n\tzlib@openssh.com\n\n",
"port": 22,
"cpe23": [
"cpe:2.3:a:openbsd:openssh:6.4"
],
"info": "protocol 2.0",
"isp": "Zhengzhou Fastidc Technology Co.,Ltd.",
"transport": "tcp",
"cpe": [
"cpe:/a:openbsd:openssh:6.4"
],
"asn": "AS56005",
"version": "6.4",
"location": {
"city": "Tianjin",
"region_code": "TJ",
"area_code": null,
"longitude": 117.17667,
"latitude": 39.14222,
"country_code": "CN",
"country_name": "China"
},
"ip": 707994107,
"domains": [],
"ip_str": "42.51.33.251",
"os": null,
"_shodan": {
"crawler": "49217c0cdcbcebaf23c2979ae16d4eba64180b1f",
"options": {},
"id": "202965c3-78b2-4938-936f-6899d2cec8e4",
"module": "ssh",
"ptr": true
},
"opts": {}
}
...
These streams provide a Private Firehose that contain information about the networks that you're monitoring. Use the REST API to create/ delete/ update the list of networks that you want Shodan to monitor.
Subscribe to banners discovered on all IP ranges described in the network alerts. The network alerts are renewed periodically every 1 hour.
https://stream.shodan.io/shodan/alert?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/alert?key={YOUR_API_KEY}"
{
"hash": -553166942,
"timestamp": "2021-01-28T05:39:12.152185",
"hostnames": ["dns.google"],
"org": "Google",
"data": "\nRecursion: enabled",
"port": 53,
"transport": "udp",
"isp": "Google",
"asn": "AS15169",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": null,
"dma_code": null,
},
"dns": {
"resolver_hostname": null,
"recursive": true,
"resolver_id": null,
"software": null,
},
"ip": 134744072,
"domains": ["dns.google"],
"ip_str": "8.8.8.8",
"_id": "23c49fa8-0c87-4b67-91b7-ab50d493ed7f",
"os": null,
"_shodan": {
"crawler": "308515b6113c0645034fb8122d0ff0d5194e7e72",
"options": {},
"id": "0e055a10-9a16-4a8b-ae00-54ae10dd7f16",
"module": "dns-udp",
"ptr": true,
"alert": {
"id": "NKXOVKN5W4SPTOF2",
"name": "scan 8.8.8.8",
},
},
"opts": {"raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"},
}
{
"hash": 1977582756,
"timestamp": "2021-01-28T05:39:16.231331",
"hostnames": ["one.one.one.one"],
"org": "Mountain View Communications",
"data": "\nRecursion: enabled\nResolver ID: VIE",
"port": 53,
"transport": "udp",
"isp": "Mountain View Communications",
"asn": "AS13335",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": 143.2104,
"country_code": "AU",
"latitude": -33.494,
"country_name": "Australia",
"area_code": null,
"dma_code": null,
},
"dns": {
"resolver_hostname": null,
"recursive": true,
"resolver_id": "VIE",
"software": null,
},
"ip": 16843009,
"domains": ["one.one"],
"ip_str": "1.1.1.1",
"_id": "08d364c6-fb2a-4a88-9369-e831b53509d1",
"os": null,
"_shodan": {
"crawler": "3901cdc9c9a3b8554f02333e2779a8659643ad15",
"options": {},
"id": "52fc8643-5a7d-45d8-9c2e-8b79bd9f6f27",
"module": "dns-udp",
"ptr": true,
"alert": {
"id": "TOZN4UUSGPMOYEAI",
"name": "one one one one",
},
},
"opts": {"raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"},
}
...
$ shodan stream --alert all
8.8.8.8 53 dns.google \nRecursion: enabled
1.1.1.1 53 one.one.one.one \nRecursion: enabled\nResolver ID: AMS
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.alert(aid=None, timeout=None, raw=False):
print(banner)
{
"hash": 1592421393,
"timestamp": "2021-01-28T05:51:32.330798",
"hostnames": [
"one.one.one.one"
],
"org": "Mountain View Communications",
"data": "\nRecursion: enabled\nResolver ID: AMS",
"port": 53,
"transport": "udp",
"isp": "Mountain View Communications",
"asn": "AS13335",
"location": {
"country_code3": None,
"city": None,
"region_code": None,
"postal_code": None,
"longitude": 143.2104,
"country_code": "AU",
"latitude": -33.494,
"country_name": "Australia",
"area_code": None,
"dma_code": None,
},
"dns": {
"resolver_hostname": None,
"recursive": True,
"resolver_id": "AMS",
"software": None,
},
"ip": 16843009,
"domains": [
"one.one"
],
"ip_str": "1.1.1.1",
"_id": "9ac8f44b-91e7-4c08-9191-000569361d7e",
"os": None,
"_shodan": {
"crawler": "bf213bc419cc8491376c12af31e32623c1b6f467",
"options": {},
"id": "a5bde924-d263-4493-adf0-c0fa54eca1a2",
"module": "dns-udp",
"ptr": True,
"alert": {
"id": "TOZN4UUSGPMOYEAI",
"name": "one one one one",
},
},
"opts": {
"raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
},
}
{
"hash": -553166942,
"timestamp": "2021-01-28T05:51:33.887203",
"hostnames": [
"dns.google"
],
"org": "Google",
"data": "\nRecursion: enabled",
"port": 53,
"transport": "udp",
"isp": "Google",
"asn": "AS15169",
"location": {
"country_code3": None,
"city": None,
"region_code": None,
"postal_code": None,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": None,
"dma_code": None,
},
"dns": {
"resolver_hostname": None,
"recursive": True,
"resolver_id": None,
"software": None,
},
"ip": 134744072,
"domains": [
"dns.google"
],
"ip_str": "8.8.8.8",
"_id": "75beec02-a928-4d2e-ab25-87234ff6b369",
"os": None,
"_shodan": {
"crawler": "e69d8d673faaa42bde0e9c7ce075d3c7146e67d0",
"options": {},
"id": "1db7cf0d-b3a0-4772-981c-2d09bafa0c81",
"module": "dns-udp",
"ptr": True,
"alert": {
"id": "NKXOVKN5W4SPTOF2",
"name": "scan 8.8.8.8",
},
},
"opts": {
"raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
},
}
...
Subscribe to banners discovered on the IP range defined in a specific network alert. The network alert is renewed periodically every 1 hour.
https://stream.shodan.io/shodan/alert/{id}?key={YOUR_API_KEY}
$ curl -X GET "https://stream.shodan.io/shodan/alert/OYPRB8IR9Z35AZPR?key={YOUR_API_KEY}"
{
"hash": 1592421393,
"timestamp": "2021-01-28T05:45:56.563794",
"hostnames": [
"one.one.one.one"
],
"org": "Mountain View Communications",
"data": "\nRecursion: enabled\nResolver ID: AMS",
"port": 53,
"transport": "udp",
"isp": "Mountain View Communications",
"asn": "AS13335",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": 143.2104,
"country_code": "AU",
"latitude": -33.494,
"country_name": "Australia",
"area_code": null,
"dma_code": null
},
"dns": {
"resolver_hostname": null,
"recursive": true,
"resolver_id": "AMS",
"software": null
},
"ip": 16843009,
"domains": [
"one.one"
],
"ip_str": "1.1.1.1",
"_id": "8e231550-6f50-440d-b5da-46cc49b2243a",
"os": null,
"_shodan": {
"crawler": "78039f81a0245caa8ab71c98182f0eff0ce52aab",
"options": {},
"id": "58ad7d05-7afd-4769-aabb-3045c498f770",
"module": "dns-udp",
"ptr": true,
"alert": {
"id": "TOZN4UUSGPMOYEAI",
"name": "one one one one",
},
},
"opts": {
"raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
}
}
{
"hash": -553166942,
"timestamp": "2021-01-28T05:46:06.018756",
"hostnames": [
"dns.google"
],
"org": "Google",
"data": "\nRecursion: enabled",
"port": 53,
"transport": "udp",
"isp": "Google",
"asn": "AS15169",
"location": {
"country_code3": null,
"city": null,
"region_code": null,
"postal_code": null,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": null,
"dma_code": null
},
"dns": {
"resolver_hostname": null,
"recursive": true,
"resolver_id": null,
"software": null
},
"ip": 134744072,
"domains": [
"dns.google"
],
"ip_str": "8.8.8.8",
"_id": "e26af2fa-dbcc-4a36-9631-33a46e505b91",
"os": null,
"_shodan": {
"crawler": "44ad81631af4ebeda49a419b8565d5fcd7ac4d2e",
"options": {},
"id": "2db17089-b705-459e-9a44-f53ca3b42df1",
"module": "dns-udp",
"ptr": true,
"alert": {
"id": "NKXOVKN5W4SPTOF2",
"name": "scan 8.8.8.8",
},
},
"opts": {
"raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
}
}
...
$ shodan stream --alert OYPRB8IR9Z35AZPR
1.1.1.1 53 one.one.one.one \nRecursion: enabled\nResolver ID: LAX
8.8.8.8 53 dns.google \nRecursion: enabled
...
from shodan import Shodan
api = Shodan('{YOUR_API_KEY}')
for banner in api.stream.alert(aid='OYPRB8IR9Z35AZPR', timeout=None, raw=False):
print(banner)
{
"hash": -553166942,
"timestamp": "2021-01-28T05:48:02.676422",
"hostnames": [
"dns.google"
],
"org": "Google",
"data": "\nRecursion: enabled",
"port": 53,
"transport": "udp",
"isp": "Google",
"asn": "AS15169",
"location": {
"country_code3": None,
"city": None,
"region_code": None,
"postal_code": None,
"longitude": -97.822,
"country_code": "US",
"latitude": 37.751,
"country_name": "United States",
"area_code": None,
"dma_code": None,
},
"dns": {
"resolver_hostname": None,
"recursive": True,
"resolver_id": None,
"software": None,
},
"ip": 134744072,
"domains": [
"dns.google"
],
"ip_str": "8.8.8.8",
"_id": "f27ed718-1870-4b6a-b856-2a3ecc462e45",
"os": None,
"_shodan": {
"crawler": "487814a778c983e2dcef234806292d88c5cbf3ec",
"options": {},
"id": "679127cc-dcc3-4c69-84f4-0011d3cf801c",
"module": "dns-udp",
"ptr": True,
"alert": {
"id": "NKXOVKN5W4SPTOF2",
"name": "scan 8.8.8.8",
},
},
"opts": {
"raw": "34ef818200010000000000000776657273696f6e0462696e640000100003"
},
}
{
"hash": 1592421393,
"timestamp": "2021-01-28T05:48:03.020873",
"hostnames": [
"one.one.one.one"
],
"org": "Mountain View Communications",
"data": "\nRecursion: enabled\nResolver ID: AMS",
"port": 53,
"transport": "udp",
"isp": "Mountain View Communications",
"asn": "AS13335",
"location": {
"country_code3": None,
"city": None,
"region_code": None,
"postal_code": None,
"longitude": 143.2104,
"country_code": "AU",
"latitude": -33.494,
"country_name": "Australia",
"area_code": None,
"dma_code": None,
},
"dns": {
"resolver_hostname": None,
"recursive": True,
"resolver_id": "AMS",
"software": None,
},
"ip": 16843009,
"domains": [
"one.one"
],
"ip_str": "1.1.1.1",
"_id": "767063ae-26a1-4d61-8af9-1aaec9cfb9f3",
"os": None,
"_shodan": {
"crawler": "d905ab419aeb10e9c57a336c7e1aa9629ae4a733",
"options": {},
"id": "ac7ada46-5c59-414f-939e-7b48afbcfe20",
"module": "dns-udp",
"ptr": True,
"alert": {
"id": "TOZN4UUSGPMOYEAI",
"name": "one one one one",
},
},
"opts": {
"raw": "34ef818500010000000000000776657273696f6e0462696e640000100003"
},
}
...