A fairly common way to locate "open" devices on the Web is by visiting the Shodan search engine and entering some specific parameters. The rest is a matter of launching various attacks to access their configuration, which has led to a broad automation process in recent years. One of the most recent examples is AutoSploit, a tool that seeks to reduce the exploitation of remote hosts to a couple of clicks using a fusion of the aforementioned Shodan and several Metasploit modules.
The script kiddie problem
Computer security faces multiple risks, but one of the most important is manifested through the wide availability of tools with a high level of automation. That brings us to the concept of the script kiddie, an attacker who does not possess the necessary knowledge to understand what they are doing, and ends up causing much more damage than they initially calculated. If we add to that the poor security practices carried out by administrators and manufacturers around the world... let's say it's hard to be surprised when a mega malware campaign appears in the media.
AutoSploit: automation made easy
That leads us to AutoSploit, a project by a developer known as "NullArray" on GitHub. Its goal is none other than to automate the mass exploitation of remote hosts. This includes locating such hosts using the Shodan API and deploying a number of Metasploit modules. The user simply has to open the tool and type a reference in the search box (say "apache" or "webcam"). The Shodan API will present results that match the keyword, and then a list will appear with all the Metasploit modules that could attack the target.
Needless to say, security experts see nothing positive in a resource like AutoSploit, but the discussion polarized almost immediately, because its only role is to automate actions that have already been available on the Web for several years, at no cost. NullArray heard the criticisms and decided to publish the code anyway, which can be cloned or deployed via Docker.
