Cisco in iran (with no auth)

Writing custom malware seems like a lot of trouble when you can just search for cisco routers that don't require authentication in the target country...

http://www.shodanhq.com/search?q=%22cisco-ios%22+%22last-modified%22+country%3AIR
"cisco-ios" "last-modified" country:IR

Buy a shodan account if you need all the dirt.

89.184.203.82

Sahlan Computer

Added on 19.07.2012
Sahlan

Details 

HTTP/1.0 200 OK
Date: Thu, 04 Mar 1993 21:36:36 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Thu, 04 Mar 1993 21:36:36 GMT
Last-Modified: Thu, 04 Mar 1993 21:36:36 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

85.185.67.49

Added on 06.07.2012
Semnan

Details 

HTTP/1.0 200 OK
Date: Fri, 06 Jul 2012 09:11:03 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Fri, 06 Jul 2012 09:11:03 GMT
Last-Modified: Fri, 06 Jul 2012 09:11:03 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

217.219.41.161

Added on 30.06.2012
Ali Abad

Details 

HTTP/1.0 200 OK
Date: Sat, 30 Jun 2012 10:22:33 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Sat, 30 Jun 2012 10:22:33 GMT
Last-Modified: Sat, 30 Jun 2012 10:22:33 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

213.233.163.152

Added on 29.06.2012
Sharif

Details 

HTTP/1.0 200 OK
Date: Sat, 13 Mar 1993 12:36:55 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Sat, 13 Mar 1993 12:36:55 GMT
Last-Modified: Sat, 13 Mar 1993 12:36:55 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

213.233.163.151

Added on 24.06.2012
Sharif

Details 

HTTP/1.0 200 OK
Date: Mon, 08 Mar 1993 12:04:33 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Mon, 08 Mar 1993 12:04:33 GMT
Last-Modified: Mon, 08 Mar 1993 12:04:33 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

213.233.163.14

Added on 17.06.2012
Sharif

Details 

HTTP/1.0 200 OK
Date: Wed, 31 Mar 1993 14:13:56 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Wed, 31 Mar 1993 14:13:56 GMT
Last-Modified: Wed, 31 Mar 1993 14:13:56 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

213.233.163.147

Added on 15.06.2012
Sharif

Details 

HTTP/1.0 200 OK
Date: Tue, 30 Mar 1993 06:55:08 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 30 Mar 1993 06:55:08 GMT
Last-Modified: Tue, 30 Mar 1993 06:55:08 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

85.185.99.193

Added on 01.05.2012
Golestan

Details 

HTTP/1.0 200 OK
Date: Tue, 01 May 2012 10:46:31 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 01 May 2012 10:46:31 GMT
Last-Modified: Tue, 01 May 2012 10:46:31 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

85.185.101.177

Added on 10.04.2012
Azad

Details 

HTTP/1.0 200 OK
Date: Tue, 10 Apr 2012 22:10:36 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 10 Apr 2012 22:10:36 GMT
Last-Modified: Tue, 10 Apr 2012 22:10:36 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

81.31.189.127

Added on 05.04.2012
Sharif

Details 

HTTP/1.0 200 OK
Date: Tue, 04 May 1993 06:48:51 GMT
Server: cisco-IOS
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html
Expires: Tue, 04 May 1993 06:48:51 GMT
Last-Modified: Tue, 04 May 1993 06:48:51 GMT
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: none

MyLittleAdmin

First person who remembers default password for mylittle admin gets some juicy tables (might be in farsi)

myLittleAdmin for SQL Server 2005 and 2008, by myLittleTools

79.175.161.135

Windows XP

Added on 15.06.2012
Tehran

Details 

HTTP/1.0 200 OK
Date: Fri, 15 Jun 2012 16:10:09 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Pragma: no-cache
Set-Cookie: Skin=default; expires=Wed, 15-Jun-2112 16:10:09 GMT; path=/
Set-Cookie: CultureName=en-US; expires=Wed, 15-Jun-2112 16:10:09 GMT; path=/
Set-Cookie: CultureName=en-US; expires=Wed, 15-Jun-2112 16:10:09 GMT; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 10703...

Intelligent Security System eh?

Intelligent Digital Security System

85.9.81.86

Linux 2.6.x

Pishgaman Kavir Yazd

Added on 02.07.2012
Yazd

Details 

HTTP/1.0 200 OK
Date: Mon, 02 Jul 2012 19:53:58 GMT
Server: Boa/0.94.14rc21
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=10, max=1000
Content-Length: 1251
Last-Modified: Mon, 02 Jul 2012 19:53:58 GMT
Content-Type: text/html 

Search Engine Boredom

Bored?
Have a Shodan account?

Lets look for protected directories in iran on a web server!

http://www.shodanhq.com/search?q=country%3Air+port%3A80+title%3Aprotected

The search string is country:ir port:80 title:protected . Nifty, but mostly ADSL modems. Now go look on other ports for the more fun stuff.

Now lets look for internal server errors
http://www.shodanhq.com/search?q=country%3Air+port%3A80+title%3Aerror
country:ir port:80 title:error

Wonder what this means. Almost looks SCADA related...
-------------------------------------------------------------------------------------------------------------------------------

ERROR: Gateway Timeout

95.82.76.231

Added on 01.08.2012

Details 

HTTP/1.0 504 Gateway Timeout
Content-Length: 708
Content-Type: text/html
Date: Mon, 05 Jan 1970 07:53:28 GMT
Expires: Mon, 05 Jan 1970 07:53:28 GMT
Server: Mikrotik HttpProxy
Proxy-Connection: close 

ERROR: Gateway Timeout

188.253.16.68

Ghaem Ertebatat Rasavi

Added on 31.07.2012

Details 

HTTP/1.0 504 Gateway Timeout
Content-Length: 686
Content-Type: text/html
Date: Fri, 02 Jan 1970 06:57:00 GMT
Expires: Fri, 02 Jan 1970 06:57:00 GMT
Server: Mikrotik HttpProxy
Proxy-Connection: close

-------------------------------------------------------------------------------------------------------------

I'm sure they have their code squared away

Runtime Error

212.50.246.72

Rasaneh Esfahan Net

Added on 31.07.2012
Esfahan

Details 

HTTP/1.0 500 Internal Server Error
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Tue, 31 Jul 2012 06:59:42 GMT
Content-Length: 3030 

----------------------------------------------------------------------

Web Clock eh?

Ghadirco. Web Clock Application Error

77.36.254.55

IRIB

Added on 31.07.2012

Details 

HTTP/1.0 200 OK
Pragma: no-cache
Content-Length: 1820
Content-Type: text/html
Server: Microsoft-IIS/7.5
Date: Wed, 01 Aug 2012 05:14:08 GMT

----------------------------------------------------------------------------------------------------------------------------------

Nobody believes in updates anymore?

ERROR: The requested URL could not be retrieved

178.173.167.99

Linux 3.x

Shiraz Hamyar Co.

Added on 29.07.2012
Shiraz

Details 

HTTP/1.0 403 Forbidden
Server: squid
Mime-Version: 1.0
Date: Sun, 29 Jul 2012 23:11:02 GMT
Content-Type: text/html
Content-Length: 3084
X-Squid-Error: ERR_ACCESS_DENIED 0
Vary: Accept-Language
Content-Language: en
X-Cache: MISS from FIRE
X-Cache-Lookup: NONE from FIRE:3138
Via: 1.0 FIRE (squid)
Connection: keep-alive