Karma v2 Tool for Advanced Attack Surface Discovery

June 6, 2024

Karma v2 is an automated reconnaissance tool designed to help information security researchers, penetration testers, and bug bounty hunters investigate an organization’s external attack surface. Built around the Shodan API, it collects information about internet-facing assets, exposed services, infrastructure relationships, and potentially sensitive public exposures.

The tool uses Shodan search queries, commonly known as Shodan dorks, to identify systems matching specific technical characteristics. Its results can include IP addresses, open ports, service banners, SSL/TLS certificate details, associated vulnerabilities, and infrastructure information. Karma v2 also organizes its findings into screen output and local files or directories for further analysis.

A Shodan Premium API key is required to use the automation. Researchers should review Shodan’s subscription options and API documentation before configuring the tool. Its results should be treated as reconnaissance leads rather than confirmation that a system is vulnerable.

Key Features of Karma v2

Karma v2 combines several reconnaissance techniques to provide a broader view of an organization’s externally visible infrastructure. Its features include:

Shodan-based discovery: Uses flexible Shodan dorks to search for internet-facing assets and services.
SSL certificate analysis: Searches using SSL SHA-1 fingerprints and checks certificate issuer information against configurable regular expressions.
Scope filtering: Separates in-scope and out-of-scope IP addresses to help researchers organize authorized assessments.
Port enumeration: Identifies commonly used, uncommon, and dynamic ports reported by Shodan.
CVE discovery: Collects vulnerability information associated with discovered targets.
Service identification: Retrieves available banners and details about products, operating systems, services, and organizations.
Favicon analysis: Collects favicon information, generates hashes with Python’s mmh3 module, and supports technology identification through custom Nuclei templates.
ASN reconnaissance: Retrieves ASN-related information, BGP neighbours, and associated IPv4 and IPv6 prefixes.

Public Exposure and Misconfiguration Discovery

One of Karma v2’s notable capabilities is searching for potentially exposed services, administrative interfaces, and publicly accessible resources. Its detection categories cover a wide range of technologies and infrastructure components.

Examples include exposed SMB and FTP services, directory indexing, login and registration portals, OAuth and SSO endpoints, VPN gateways, Citrix environments, cloud storage, and publicly accessible dashboards. It also searches for technology-specific exposures involving Jenkins, Kubernetes, GitLab, MongoDB, Elasticsearch, Grafana, RabbitMQ, Kibana, Prometheus, and other platforms.

Additional search categories include default-password indicators, exposed configuration files, protected objects, database services, DNS recursion, and potentially exposed secret keys. These findings can help security teams prioritize further investigation. However, a matching search result does not automatically establish unauthorized access or a confirmed data leak.

Installing Karma v2

Karma v2 depends on several command-line utilities and Python modules. Prepare a compatible Linux environment and review the project’s installation instructions before proceeding.

1. Clone the Repository

git clone https://github.com/Dheerajmadhukar/karma_v2.git
cd karma_v2

2. Install Python Dependencies

Install the Shodan client and mmh3 module required for API access and favicon hash generation.

python3 -m pip install shodan mmh3

3. Install jq

The jq utility processes JSON data returned by APIs and other command-line tools.

sudo apt install jq -y

4. Install httprobe

Karma v2 uses httprobe, developed by tomnomnom, to identify HTTP and HTTPS services among discovered hosts. Install it using Go:

go install -v github.com/tomnomnom/httprobe@master

5. Install Interlace

Interlace, developed by Codingo, supports multithreaded execution of command-line tasks. Clone its repository and follow the project’s installation instructions:

git clone https://github.com/codingo/Interlace.git

Ensure the required dependencies are installed and the relevant executables are available in your system’s PATH.

Requirements and Responsible Use

A Shodan Premium API key is necessary for the automation. Researchers should configure their API access according to Shodan’s documentation and verify that their environment meets the requirements of each dependency.

Use Karma v2 only for assets covered by explicit authorization, such as approved penetration tests, bug bounty programs, and internal security assessments. Keep scope restrictions in place, validate potential exposures manually, and avoid accessing or collecting sensitive information without permission. Shodan data can also become outdated, so verify important findings before reporting them.

For additional reconnaissance techniques, explore WhatWeb, a technology identification tool that can complement an authorized web assessment.