Passive Reconnaissance: Shodan

Shodan is a search engine for internet-connected devices. Unlike Google (which indexes websites), Shodan scans the entire IPv4 address space and indexes servers, routers, IoT devices, industrial control systems, webcams, databases, and anything else exposed to the internet. It's called "the world's most dangerous search engine" because it reveals massive security exposures.

What You'll Learn

What Shodan is and how it works
Shodan search fundamentals and filters
Finding exposed services and devices
Discovering vulnerable systems
Using Shodan CLI and API
Shodan monitoring and alerts
Alternative tools (Censys, ZoomEye)
Defensive measures

What Is Shodan?

The Concept:

Traditional search engine (Google):
1. Crawls websites
2. Indexes content
3. Returns search results

Shodan:
1. Scans entire IPv4 space (all IPs)
2. Connects to services (HTTP, SSH, FTP, etc.)
3. Grabs banners (server responses)
4. Indexes service information
5. Makes it all searchable

What Shodan Reveals:

✗ Exposed databases (MongoDB, Elasticsearch, Redis)
✗ Webcams without authentication
✗ Industrial control systems (SCADA, PLC)
✗ Vulnerable servers (unpatched software)
✗ IoT devices (routers, smart TVs, thermostats)
✗ Default credentials
✗ Open ports and services
✗ Server locations (geolocation)
✗ SSL/TLS certificates
✗ Everything on the internet!

Shodan Basics

Access:

URL: https://www.shodan.io

Free account:
- Limited searches
- Basic filters
- 1 month data retention

Membership ($49/mo or $59/year):
- Unlimited searches
- Advanced filters
- Historical data
- API access
- Export results

How It Works:

Shodan's crawlers:
1. Scan all IPv4 addresses (4.3 billion)
2. Connect to common ports:
   - 21 (FTP)
   - 22 (SSH)
   - 23 (Telnet)
   - 80/443 (HTTP/HTTPS)
   - 1433 (MS SQL)
   - 3306 (MySQL)
   - 5432 (PostgreSQL)
   - 6379 (Redis)
   - 8080 (HTTP alt)
   - 9200 (Elasticsearch)
   - 27017 (MongoDB)
   - ... and many more

3. Grab banner (server response):
   Example:
   SSH-2.0-OpenSSH_7.4
   Server: Apache/2.4.41 (Ubuntu)
   MongoDB/4.2.3

4. Index the information
5. Make it searchable

Basic Shodan Searches

Simple Search:

Just type what you're looking for:

apache
= Apache web servers

mongodb
= MongoDB databases

webcam
= Webcams

default password
= Devices with default passwords

SSH-2.0-OpenSSH_7.4
= Specific OpenSSH version

Understanding Results:

Each result shows:
- IP address
- Port number
- Banner (service response)
- Organization (ISP/company)
- Location (country, city)
- Timestamp (last scan)
- Additional data (OS, hostname, etc.)

Click IP for full details:
- All open ports
- Services on each port
- Historical data
- Vulnerabilities
- Map location

Shodan Filters

Filters narrow results:

filter:value

Essential Filters:

1. Location Filters:

country:US
= United States

city:"Los Angeles"
= Specific city

geo:34.0522,-118.2437
= Exact coordinates (lat,long)

region:CA
= State/region

2. Network Filters:

net:192.168.1.0/24
= Specific network range

org:"Amazon"
= Organization name

asn:AS15169
= Autonomous System Number (e.g., Google)

isp:"Comcast"
= Internet Service Provider

3. Service Filters:

port:22
= Specific port

product:Apache
= Specific product/software

version:2.4.41
= Specific version

os:"Windows Server 2016"
= Operating system

4. Time Filters:

before:01/01/2023
= Results before date

after:01/01/2024
= Results after date

5. Special Filters:

vuln:CVE-2014-0160
= Specific CVE (vulnerability)

has_screenshot:true
= Devices with screenshots (VNC, RDP)

ssl:true
= Only SSL/TLS services

http.title:"Dashboard"
= Page title contains

http.status:200
= HTTP status code

Common Shodan Searches

Exposed Databases:

mongodb port:27017
= Open MongoDB instances

elasticsearch port:9200
= Elasticsearch clusters

mysql port:3306
= MySQL databases

redis port:6379
= Redis key-value stores

postgres port:5432
= PostgreSQL databases

Check if exposed:

Click result → Try accessing via command line:

mongo <IP>:27017
curl http://<IP>:9200
mysql -h <IP> -u root

If no authentication required = MASSIVE security issue!

Webcams:

has_screenshot:true webcam
= Webcams with preview images

http.title:"Live View"
= Common webcam title

"Server: SQ-WEBCAM"
= Specific webcam server

port:554 has_screenshot:true
= RTSP cameras

Industrial Control Systems (ICS/SCADA):

"SCADA"
= SCADA systems

"Siemens" port:102
= Siemens PLCs

"Modbus"
= Modbus industrial protocol

http.title:"Allen-Bradley"
= Allen-Bradley PLCs

"SCADA" country:US
= US SCADA systems

⚠️ WARNING: Accessing ICS without authorization can:

Disrupt critical infrastructure
Cause physical damage
Be highly illegal
Result in prison time

Remote Access:

port:3389 country:US
= RDP (Remote Desktop) exposed

port:22 "OpenSSH"
= SSH servers

port:23 "Telnet"
= Telnet (very insecure!)

port:5900 has_screenshot:true
= VNC remote access

Default Credentials:

"default password"
= Systems mentioning default passwords

http.title:"Dashboard" "default username"
= Admin panels with defaults

"admin:admin"
= Devices mentioning admin/admin

"password is"
= Systems exposing passwords

Vulnerable Systems:

vuln:CVE-2017-0143
= EternalBlue (WannaCry) vulnerability

vuln:CVE-2014-0160
= Heartbleed vulnerability

apache 2.4.29
= Specific vulnerable version

"IIS/7.5"
= Older IIS version

Shodan CLI

Installation:

pip install shodan

Setup:

# Get API key from Shodan account page
shodan init YOUR_API_KEY

Basic Commands:

1. Search:

# Basic search
shodan search apache

# With count
shodan count apache

# Specific filter
shodan search --fields ip_str,port,org --separator , apache

# Save to file
shodan search apache > results.txt

2. Host Information:

# Look up specific IP
shodan host 8.8.8.8

# Shows:
# - All open ports
# - Services
# - Vulnerabilities
# - Location
# - Organization

3. Download Data:

# Download results (requires membership)
shodan download results.json.gz "apache country:US"

# Parse downloaded data
shodan parse results.json.gz

4. Statistics:

# Get statistics
shodan stats --facets country "apache"

Shodan Python API

Installation:

pip install shodan

Basic Usage:

import shodan

# Initialize
SHODAN_API_KEY = "your_key_here"
api = shodan.Shodan(SHODAN_API_KEY)

# Basic search
try:
    results = api.search('apache')
    
    print(f"Results found: {results['total']}")
    
    for result in results['matches']:
        print(f"IP: {result['ip_str']}")
        print(f"Port: {result['port']}")
        print(f"Organization: {result.get('org', 'N/A')}")
        print(f"Location: {result.get('location', {}).get('country_name', 'N/A')}")
        print(f"Banner: {result['data'][:200]}")
        print('-' * 60)
        
except shodan.APIError as e:
    print(f'Error: {e}')

Host Lookup:

import shodan

api = shodan.Shodan('YOUR_API_KEY')

# Look up specific host
host = api.host('8.8.8.8')

print(f"IP: {host['ip_str']}")
print(f"Organization: {host.get('org', 'N/A')}")
print(f"Operating System: {host.get('os', 'N/A')}")

print("\nPorts:")
for item in host['data']:
    print(f"  Port: {item['port']}")
    print(f"  Banner: {item['data'][:100]}")

Advanced Search with Filters:

import shodan

api = shodan.Shodan('YOUR_API_KEY')

# Search with filters
query = 'apache country:US port:443'
results = api.search(query)

for result in results['matches']:
    if 'ssl' in result:
        ssl = result['ssl']
        print(f"IP: {result['ip_str']}")
        print(f"SSL Certificate: {ssl.get('cert', {}).get('subject', {}).get('CN', 'N/A')}")

Faceted Search (Statistics):

import shodan

api = shodan.Shodan('YOUR_API_KEY')

# Get statistics
facets = [
    'country',
    'org',
]

query = 'apache'
facet_results = api.count(query, facets=facets)

print(f"Total results: {facet_results['total']}")

# Countries
print("\nTop Countries:")
for facet in facet_results['facets']['country']:
    print(f"  {facet['value']}: {facet['count']}")

# Organizations
print("\nTop Organizations:")
for facet in facet_results['facets']['org']:
    print(f"  {facet['value']}: {facet['count']}")

Shodan Monitoring and Alerts

Monitor Your Network:

Shodan → Monitor → Create Alert

Monitor IP range:
192.168.1.0/24

Receive alerts when:
- New services detected
- Vulnerabilities found
- Configurations change

Use Cases:

1. Asset Discovery:
   Monitor your organization's IP ranges
   Discover shadow IT
   Find forgotten systems

2. Security Monitoring:
   Detect new exposures
   Identify misconfigurations
   Track vulnerability patching

3. Threat Intelligence:
   Monitor adversary infrastructure
   Track C2 servers
   Identify phishing infrastructure

Alternative Tools

Censys:

URL: https://search.censys.io

Similar to Shodan:
- Scans IPv4 space
- Indexes certificates
- Free tier available

Advantages:
- Better certificate search
- Free data exports
- Research-focused

Disadvantages:
- Fewer device types
- Less IoT coverage

Example Censys Searches:

services.port:22
services.http.response.body:"admin"
autonomous_system.asn:15169

ZoomEye:

URL: https://www.zoomeye.org

Chinese alternative to Shodan:
- Similar functionality
- Good coverage in Asia
- Free account available

Binary Edge:

URL: https://www.binaryedge.io

Internet scanning platform:
- Historical data
- Risk scoring
- API access

Defensive Measures

For Organizations:

1. Discover Your Exposure:

Search for your own assets:

org:"Your Company Name"
net:203.0.113.0/24

What's exposed?
- Databases without auth?
- Admin panels?
- Default credentials?
- Vulnerable versions?

2. Close Unnecessary Ports:

# Linux firewall (iptables)
iptables -A INPUT -p tcp --dport 27017 -j DROP

# Or UFW
ufw deny 27017

# Windows Firewall
New-NetFirewallRule -DisplayName "Block MongoDB" -Direction Inbound -Protocol TCP -LocalPort 27017 -Action Block

3. Require Authentication:

Never expose:
- Databases without auth
- Admin panels without login
- Management interfaces publicly

Always:
☑ Require strong authentication
☑ Use VPN for admin access
☑ Whitelist IP addresses
☑ Enable 2FA

4. Update and Patch:

Shodan reveals exposed services and version strings:
Apache/2.4.29 = investigate vendor advisories and distro backports

Keep software updated:
- Web servers
- Databases
- Operating systems
- Applications

5. Monitor Continuously:

Set up Shodan monitoring:
1. Create account
2. Add your IP ranges
3. Enable alerts
4. Review regularly

Proactive security!

For Individuals:

Protect home devices:
☑ Change default passwords
☑ Disable UPnP
☑ Update firmware
☑ Use firewall
☑ Segment IoT devices
☑ Check your exposure:
  shodan myip

Legal and Ethical Considerations

Legal:

✓ Searching Shodan is legal
✓ Viewing service information is legal
✓ Security research (authorized)

✗ Accessing systems without authorization = illegal
✗ Using found credentials = illegal
✗ Disrupting services = illegal
✗ Attacking ICS/SCADA = HIGHLY illegal

Ethical:

✓ Defensive use (check your own assets)
✓ Threat intelligence
✓ Research
✓ Authorized penetration testing

✗ Exploiting found vulnerabilities
✗ Accessing private data
✗ Disrupting critical infrastructure
✗ Malicious reconnaissance

Responsible Disclosure:

If you find a critical exposure:
1. Document (IP, port, service, screenshot)
2. Identify owner (WHOIS, contact info)
3. Notify privately ([email protected])
4. Allow time to remediate
5. Don't exploit or publicize immediately

Try It Yourself

Exercise 1: Basic Searches

Search on Shodan:
1. mongodb
   - How many exposed MongoDB instances?
   - Where are they located?

2. webcam has_screenshot:true
   - View some webcams
   - Are they secured?

3. "default password"
   - What devices mention this?

Note: Only view, don't access!

Exercise 2: Your Organization

If authorized:
1. org:"Your Company Name"
2. net:YOUR_IP_RANGE
3. Review all results
4. Identify exposures
5. Report to security team

Exercise 3: Vulnerability Search

Search for known vulnerabilities:
1. vuln:CVE-2017-0143
   - EternalBlue vulnerability
   - How many still exposed?

2. apache 2.4.29
   - Vulnerable Apache version
   - Where are they?

Exercise 4: Shodan CLI

# Install
pip install shodan

# Initialize
shodan init YOUR_API_KEY

# Search
shodan search apache country:US

# Host lookup
shodan host 8.8.8.8

# Count results
shodan count "default password"

Quick Reference

Shodan URL:
https://www.shodan.io

Common Filters:
country:US
city:"New York"
port:22
org:"Google"
net:192.168.1.0/24
product:Apache
vuln:CVE-2014-0160
has_screenshot:true

CLI Commands:
shodan search <query>
shodan host <IP>
shodan count <query>
shodan stats --facets country <query>

Python API:
pip install shodan
api = shodan.Shodan('KEY')
results = api.search('query')
host = api.host('IP')

Alternatives:
Censys: https://search.censys.io
ZoomEye: https://www.zoomeye.org

Resources

Shodan:

Shodan: https://www.shodan.io
Shodan CLI: pip install shodan
Shodan Python API: https://shodan.readthedocs.io

Alternatives:

Censys: https://search.censys.io
ZoomEye: https://www.zoomeye.org
Binary Edge: https://www.binaryedge.io

Learning:

Shodan Explore: https://www.shodan.io/explore
Shodan Blog: https://blog.shodan.io

Reading:

Complete Guide to Shodan - Book/guide
Shodan Pentesting Guide

Practice:

Search your own organization (authorized only)
Review Shodan Explore for examples
Never access systems without permission!

Next Steps

Create a Shodan account and explore
Search your organization's IP ranges (authorized!)
Set up monitoring for your assets
Learn the API for automation
Combine with other tools (nmap, vulnerability scanners)

Shodan is incredibly powerful for both offense and defense. Use it to strengthen security, not to exploit vulnerabilities!

"If you're not monitoring Shodan for your own assets, attackers already are."

Passive Reconnaissance: Shodan

What You'll Learn

What Is Shodan?

The Concept:

What Shodan Reveals:

Shodan Basics

Access:

How It Works:

Basic Shodan Searches

Simple Search:

Understanding Results:

Shodan Filters

Powerful Search Refinement:

Essential Filters:

Common Shodan Searches

Exposed Databases:

Webcams:

Industrial Control Systems (ICS/SCADA):

Remote Access:

Default Credentials:

Vulnerable Systems:

Shodan CLI

Installation:

Setup:

Basic Commands:

Shodan Python API

Installation:

Basic Usage:

Host Lookup:

Advanced Search with Filters:

Faceted Search (Statistics):

Shodan Monitoring and Alerts

Monitor Your Network:

Use Cases:

Alternative Tools

Censys:

ZoomEye:

Binary Edge:

Defensive Measures

For Organizations:

For Individuals:

Legal and Ethical Considerations

Legal:

Ethical:

Responsible Disclosure:

Try It Yourself

Exercise 1: Basic Searches

Exercise 2: Your Organization

Exercise 3: Vulnerability Search

Exercise 4: Shodan CLI

Quick Reference

Resources

Shodan:

Alternatives:

Learning:

Reading:

Practice:

Next Steps