Table of Contents
Introduction to Shodan
Getting Started with Shodan
Understanding Shodan Search Basics
Advanced Search Filters and Techniques
Practical OSINT/Recon Use Cases
Best Practices and Legal Considerations
Integrating Shodan into Your Workflow
Conclusion
1. Introduction to Shodan
What is Shodan?
Shodan is often referred to as "the search engine for hackers" or "the world's first search engine for internet-connected devices." Created by John Matherly in 2009, Shodan continuously scans the entire IPv4 address space, connecting to devices and services to collect banner information, metadata, and configuration details.
Why Use Shodan for OSINT/Recon?
Asset Discovery: Identify all internet-facing assets belonging to an organization
Vulnerability Assessment: Find devices running outdated or vulnerable software
Threat Intelligence: Monitor for exposed databases, misconfigured services, and security gaps
Competitive Intelligence: Understand competitor infrastructure and technology stack
Attack Surface Mapping: Visualize and document the complete external attack surface
2. Getting Started with Shodan
Creating a Shodan Account
Visit shodan.io and create a free account. While the free tier offers limited searches per month, it's sufficient for learning and basic reconnaissance.
Account Tiers:
Free Account: 1 result page per search, limited API queries
Membership ($59/month): Unlimited results, full API access, data export
Small Business/Enterprise: Custom solutions with additional features
Understanding the Shodan Interface
The Shodan web interface consists of several key sections:
Search Bar: Enter queries using IP addresses, domains, or search filters
Results Panel: Displays discovered devices with banner information
Filters Sidebar: Refine searches by country, organization, port, product, etc.
Maps View: Geographic visualization of discovered devices
Images: Screenshots of web services and interfaces
3. Understanding Shodan Search Basics
Simple IP and Domain Searches
Search by IP Address:
8.8.8.8
Search by Domain:
microsoft.com
Search by Hostname:
hostname:example.com
Banner Information
When Shodan connects to a device, it captures "banner" information - the initial response from the service. This typically includes:
Service type and version
Operating system details
Server software
SSL certificate information
HTTP headers
Device metadata
4. Advanced Search Filters and Techniques
Essential Shodan Filters
1. Network and Organization Filters
net:192.168.1.0/24
org:"Amazon"
asn:AS15169
2. Geographic Filters
country:US
city:"New York"
geo:40.7128,-74.0060,50
3. Port and Protocol Filters
port:22
port:80,443,8080
4. Product and Service Filters
product:Apache
product:"Microsoft IIS"
version:2.4.41
5. Operating System Filters
os:Windows
os:"Linux 3.x"
6. SSL/TLS Certificate Filters
ssl:"example.com"
ssl.cert.subject.cn:"*.example.com"
ssl.cert.expired:true
7. HTTP-Specific Filters
http.title:"Dashboard"
http.status:200
http.component:"WordPress"
8. Vulnerability Filters
vuln:CVE-2021-44228
has_screenshot:true
Combining Filters for Powerful Queries
Example 1: Find Exposed MongoDB Databases
product:MongoDB port:27017 -authentication
Example 2: Identify Vulnerable Apache Servers in a Specific Country
product:Apache version:2.4.49 country:US
Example 3: Locate Webcams by Manufacturer
"Server: SQ-WEBCAM" port:80
Example 4: Find Exposed RDP Services
port:3389 country:US
Example 5: Discover IoT Devices
"IoT" port:80 has_screenshot:true
5. Practical OSINT/Recon Use Cases
Use Case 1: Asset Discovery and Inventory
Objective: Identify all internet-facing assets for a target organization.
Approach:
Start with the organization name:
org:"Target Company Inc"
Identify IP ranges and ASNs:
asn:AS12345
Search for specific domains:
hostname:.targetcompany.com
Document all discovered services, ports, and technologies.
Use Case 2: Technology Stack Reconnaissance
Objective: Understand what technologies and software versions a target uses.
Queries:
hostname:targetcompany.com http.component:"nginx"
hostname:targetcompany.com product:"Apache"
ssl:"targetcompany.com"
Analysis Points:
Web servers and versions
SSL/TLS certificate details
CMS platforms (WordPress, Joomla, Drupal)
Cloud infrastructure (AWS, Azure, GCP)
CDN usage (Cloudflare, Akamai)
Use Case 3: Vulnerability Assessment
Objective: Identify potentially vulnerable systems.
Approach:
Search for known vulnerabilities:
vuln:CVE-2021-44228 org:"Target Company"
Find outdated software versions:
product:OpenSSH version:7.4 org:"Target Company"
Identify default credentials:
"default password" org:"Target Company"
Important: Always maintain ethical boundaries and report vulnerabilities responsibly.
Use Case 4: Exposed Database Detection
Objective: Find misconfigured databases exposed to the internet.
Common Queries:
product:MySQL port:3306 -authentication
product:PostgreSQL port:5432
product:MongoDB -authentication
product:Elasticsearch port:9200
product:Redis port:6379
Use Case 5: Industrial Control Systems (ICS) Research
Objective: Identify SCADA systems and ICS infrastructure.
Queries:
"Siemens SIMATIC"
port:502 country:US
"Modbus/TCP"
"DNP3"
⚠️ Warning: ICS systems control critical infrastructure. Never interact with these systems without explicit authorization.
Use Case 6: Security Misconfiguration Detection
Examples of Common Misconfigurations:
"Directory listing" port:80
http.title:"Index of /"
"phpMyAdmin" http.status:200
"Apache Server Status"
"Docker Remote API"
Use Case 7: Threat Intelligence Gathering
Monitor for:
Command and control (C2) servers
Malware distribution infrastructure
Phishing infrastructure
Compromised systems
Example Queries:
"CobaltStrike" country:RU
http.html:"<title>Hacked by"
product:"Metasploit"
6. Best Practices and Legal Considerations
Ethical Guidelines
DO:
Use Shodan for authorized security assessments
Perform reconnaissance on your own assets
Report vulnerabilities responsibly
Respect privacy and data protection laws
Stay within the bounds of your authorization
DON'T:
Access systems without permission
Download or exfiltrate data from discovered systems
Exploit vulnerabilities you discover
Interfere with critical infrastructure
Share sensitive information publicly
Legal Considerations
Key Legal Frameworks:
Computer Fraud and Abuse Act (CFAA) - United States
General Data Protection Regulation (GDPR) - European Union
Computer Misuse Act - United Kingdom
Local cybercrime laws - Vary by jurisdiction
Important: Simply viewing information on Shodan is generally legal as it's publicly available data. However, using that information to access systems without authorization is illegal in most jurisdictions.
Responsible Disclosure
If you discover vulnerabilities during OSINT/recon:
Document the vulnerability thoroughly
Contact the organization through appropriate channels
Allow reasonable time for remediation (typically 90 days)
Follow coordinated vulnerability disclosure practices
Consider using platforms like HackerOne or Bugcrowd
7. Integrating Shodan into Your Workflow
Using the Shodan API
The Shodan API allows you to automate reconnaissance and integrate Shodan into your security tools.
Basic API Usage (Python):
import shodan
api = shodan.Shodan('YOUR_API_KEY')
# Search Shodan
results = api.search('apache country:US')
# Print results
for result in results['matches']:
print(f"IP: {result['ip_str']}")
print(f"Port: {result['port']}")
print(f"Organization: {result.get('org', 'N/A')}")
print("---")
Shodan Command Line Interface
Install the Shodan CLI:
pip install shodan
shodan init YOUR_API_KEY
Useful CLI Commands:
# Search
shodan search --fields ip_str,port,org "apache"
# Get host information
shodan host 8.8.8.8
# Download search results
shodan download results.json.gz "product:nginx"
# Parse downloaded results
shodan parse --fields ip_str,port results.json.gz
Integration with Other Tools
Shodan + Maltego: Visualize relationships between assets
Shodan + Metasploit: Identify potential targets
Shodan + Nmap: Verify and expand on Shodan findings
Shodan + Recon-ng: Comprehensive OSINT framework integration
Automating Reconnaissance
Example Workflow:
Define scope (organizations, domains, IP ranges)
Use Shodan API to discover assets
Export results to CSV/JSON
Analyze for vulnerabilities and misconfigurations
Generate reports with findings
Set up monitoring for new assets or changes
Shodan Monitors and Alerts
Create monitors to track changes in your attack surface:
Navigate to Monitors in Shodan
Create a new monitor with your search query
Set up email alerts for new results
Review alerts regularly
8. Conclusion
Shodan is an invaluable tool for cybersecurity professionals performing OSINT and reconnaissance. Its ability to discover internet-connected devices and services makes it essential for:
Red Teams: Understanding the attack surface before engagements
Blue Teams: Monitoring for exposed assets and misconfigurations
Security Researchers: Identifying trends and emerging threats
Compliance Teams: Ensuring assets meet security standards
Threat Intelligence Analysts: Tracking adversary infrastructure
Key Takeaways:
Start Simple: Begin with basic searches and gradually incorporate advanced filters
Stay Legal: Always operate within legal and ethical boundaries
Combine Tools: Use Shodan alongside other reconnaissance tools for comprehensive results
Automate: Leverage the API to integrate Shodan into your workflow
Monitor Continuously: Set up alerts to track changes in your attack surface
Report Responsibly: If you find vulnerabilities, follow responsible disclosure practices
Next Steps:
Practice with your own infrastructure first
Explore Shodan's additional features (Images, Exploits, ICS Radar)
Join the security community and share knowledge responsibly
Stay updated on Shodan's new features and capabilities
Consider obtaining professional certifications in penetration testing and security assessment
Remember: With great power comes great responsibility. Use Shodan ethically, legally, and always with the goal of improving security rather than causing harm.
Connect With Me
Stay updated with the latest cybersecurity insights and threat intelligence:
🎥 YouTube: @cyberhawkconsultancy
🎵 TikTok: @cyberhawkthreatintel
🐦 X (Twitter): @cyberhawkintel
📱 Telegram: @cyberhawkthreatintel
#cyberhawkthreatintel #cyberhawkconsultancy
Disclaimer: This blog is for educational purposes only. Always ensure you have proper authorization before performing security assessments or accessing systems. The author and publisher assume no liability for misuse of this information.