• Stars
    star
    165
  • Rank 228,906 (Top 5 %)
  • Language
    Python
  • License
    BSD 3-Clause "New...
  • Created about 8 years ago
  • Updated almost 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A simple script for discovery and analysis of UPnP servers

upnp_info.py

Purpose

This script was written so that anyone can easily find the UPnP servers on their network. While tools like this have and do exist, none are as simple as downloading a file and executing it via Python.

Dependencies

This script depends on 'requests'. You can install requests via pip:

pip install requests

Usage

The script takes no input and is simply executed via python:

python upnp_info.py

Troubleshooting

upnp_info.py needs to be able access UDP port 1900. If you aren't getting any results but you think you should be then check your firewall.

Features

upnp_info.py discovers all UPnP servers within multicast range

$ python upnp_info.py 
[+] Discovering UPnP locations
[+] Discovery complete
[+] 11 locations found:
	-> http://192.168.0.254:49152/wps_device.xml
	-> http://192.168.1.217:49153/description.xml
	-> http://192.168.1.217:35848/rootDesc.xml
	-> http://192.168.1.217:32469/DeviceDescription.xml
	-> http://192.168.1.217:49152/tvdevicedesc.xml
	-> http://192.168.1.217:35439/rootDesc.xml
	-> http://192.168.1.251:49451/luaupnp.xml
	-> http://192.168.1.1:45973/rootDesc.xml
	-> http://192.168.1.1:1990/WFADevice.xml
	-> http://192.168.1.1:1901/root.xml
	-> http://192.168.1.217:8200/rootDesc.xml

It parses the service's XML and displays it for the user:

[+] Loading http://192.168.1.217:49153/description.xml...
	-> Server String: Linux/4.4.0-36-generic, UPnP/1.0, MediaTomb/0.12.2
	==== XML Attributes ===
	-> Device Type: urn:schemas-upnp-org:device:MediaServer:1
	-> Friendly Name: MediaTomb
	-> Manufacturer: (c) 2005-2008 Gena Batyan <[email protected]>, Sergey Bostandzhyan <[email protected]>, Leonhard Wimmer <[email protected]>
	-> Manufacturer URL: http://mediatomb.cc/
	-> Model Description: Free UPnP AV MediaServer, GNU GPL
	-> Model Name: MediaTomb
	-> Model Number: 0.12.2
	-> Services:
		=> Service Type: urn:schemas-upnp-org:service:ConnectionManager:1
		=> Control: /upnp/control/cm
		=> Events: /upnp/event/cm
		=> API: http://192.168.1.217:49153/cm.xml
			- GetCurrentConnectionIDs
			- GetCurrentConnectionInfo
			- GetProtocolInfo
		=> Service Type: urn:schemas-upnp-org:service:ContentDirectory:1
		=> Control: /upnp/control/cds
		=> Events: /upnp/event/cds
		=> API: http://192.168.1.217:49153/cds.xml
			- Browse
			- GetSearchCapabilities
			- GetSortCapabilities
			- GetSystemUpdateID

It can browse file shares:

[+] Content browsing available. Looking up base directories...
		Storage Folder: PC Directory
		Storage Folder: Photos
		Storage Folder: wat

It can show port mappings:

[+] IGD port mapping available. Looking up current mappings...
		[UDP] *:60579 => 192.168.1.186:60579 | Desc: None

License

The license is BSD 3-clause. See the LICENSE file for details.

More Repositories

1

terrascan

Detect compliance and security violations across Infrastructure as Code to mitigate risk before provisioning cloud native infrastructure.
Go
4,701
star
2

poc

Proof of Concepts
Python
1,210
star
3

routeros

RouterOS Security Research Tooling and Proof of Concepts
C++
866
star
4

nessrest

A python library for using the new Nessus REST API.
Python
386
star
5

awesome-llm-cybersecurity-tools

A curated list of large language model tools for cybersecurity research.
379
star
6

pyTenable

Python Library for interfacing into Tenable's platform APIs
Python
350
star
7

ghidra_tools

A collection of Ghidra scripts, including the GPT-3 powered code analyser and annotator, G-3PO.
Python
293
star
8

cnappgoat

CNAPPgoat is an open source project designed to modularly provision vulnerable-by-design components in cloud environments.
Go
265
star
9

access-undenied-aws

Access Undenied parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable remediation steps. Open-sourced by Ermetic.
Python
255
star
10

pi_sniffer

The pocket-sized wireless sniffer
C++
204
star
11

router_badusb

BadUSB in Routers
Shell
190
star
12

esp32_image_parser

A toolkit for helping you reverse engineer ESP32 firmware.
Python
159
star
13

DiscordClient

Python
98
star
14

EscalateGPT

An AI-powered tool for discovering privilege escalation opportunities in AWS IAM configurations.
Python
93
star
15

KaiMonkey

KaiMonkey provides vulnerable infrastructure as code (IaC) to help explore and understand common cloud security threats exposed via IaC.
HCL
93
star
16

Burp-extension-for-GPT

an extension for Burp Suite to allow researchers to utilize GPT for analys is of HTTP requests and responses
Python
90
star
17

Posh-Nessus

PowerShell Module for automating Tenable Nessus Vulnerability Scanner.
PowerShell
88
star
18

Tenable.io-SDK-for-Python

Tenable.io SDK offers a scalable and safe way to integrate with the Tenable.io platform.
Python
83
star
19

audit_scripts

Scripts to help work with configuration audit files
Python
79
star
20

integration-jira-cloud

Python
68
star
21

yara-rules

Repository of yara rules
YARA
60
star
22

terrascan-action

Terrascan GitHub action. Scan infrastructure as code including Terraform, Kubernetes, Helm, and Kustomize file for security best practices.
Shell
49
star
23

nasl

A parser for NASL.
Ruby
44
star
24

flask-logging-demo

Demo files for 'The Boring Stuff - Flask Logging' blog post
Python
34
star
25

mIDA

C++
33
star
26

audit_files

Nessus Audit files
30
star
27

Security-Hub

For use in our Tenable.IO to AWS Security Hub integration
Python
27
star
28

terrascan-rego-editor

Visual Studio Code extension for writing Terrascan Rego policies
TypeScript
20
star
29

hidden-services-revealer

Python
20
star
30

nasldoc

A documentation generator for NASL.
Ruby
17
star
31

cnappgoat-scenarios

This repository provides a comprehensive collection of Pulumi scenarios utilized by cnappgoat
Go
17
star
32

accurics-action

The Accurics GitHub Action scans Infrastructure as Code files checked into the respository to help ensure that cloud resources are secure and compliant from creation.
Shell
14
star
33

pedant

A static analysis framework for NASL.
Ruby
14
star
34

sublimetext-nasl

13
star
35

Kastle

A purely functional, effectful, resource-safe, kafka library for Scala
Scala
12
star
36

csup

Tenable.io Container Security Uploading and Reporting Commandline Tool
Python
11
star
37

microfrontend-demo-app

JavaScript
11
star
38

SinCity

Python
11
star
39

integration-asc

Python
10
star
40

vim-nasl

Vim extensions for programming in NASL
Vim Script
9
star
41

runterrascan.io

CSS
8
star
42

cloud-security-training

HCL
7
star
43

golden-ami-pipeline-with-tenable-sample

The golden AMI pipeline enables creation, distribution, verification, launch-compliance, and decommissioning of the golden AMI out of the box. This version of the pipeline integrates with Tenable.io for vulnerability assessments.
6
star
44

container-security-action

Tenable's Container security action which helps scan docker images.
Python
6
star
45

cloud-security-actions

Shell
6
star
46

notepadpp-nasl

5
star
47

integration-cef

Python
5
star
48

was-action

Github action to trigger WAS
Python
5
star
49

entra-id-federation-abuse-research-required-roles

PowerShell
5
star
50

cloud-snapshot-automation

Templates for creating Cloud Snapshots
HCL
4
star
51

splunk-app-pvs

This app provides Splunk dashboards and reporting for Tenable PVS
HTML
4
star
52

integrations-ibm-cloudpak-for-security

Python
4
star
53

Tenable.ad-EventsLogs-Subscriber

Tenable.ad IOA module event logs listener
Rust
4
star
54

emacs-nasl

Emacs Lisp
4
star
55

UncoverDCShadow

PowerShell
3
star
56

integration-cscc

Tenable.io to Google Cloud Security Command Center Bridge
Python
3
star
57

tenablecs_demo

HCL
2
star
58

WSUSpendu

PowerShell
2
star
59

asm-python-examples

Bit Discovery REST API scripts
Python
2
star
60

labs

1
star
61

asm-asset-importer

Scripts to integrate BitDiscovery data with Tenable
Python
1
star
62

accurics-vscode

TypeScript
1
star
63

nasl-layer

Spacemacs layer for NASL
1
star
64

atom-grammar-nessuskb

Grammar file for Nessus KB files.
CoffeeScript
1
star
65

accurics-orb

The Accurics CircleCI Orb scans IaC (Infrastructure as Code) to help identify vulnerabilities prior to cloud deployment.
Shell
1
star
66

helm-charts

Smarty
1
star