GO KALI FREE
IntermediateOSINT

Shodan Guide: Searching the Internet of Things

Learn to use Shodan for discovering internet-connected devices, analyzing exposed services, and identifying vulnerable systems through search queries.

#Shodan#OSINT#IoT#Attack Surface#Network Discovery

Internet-Wide Reconnaissance

Shodan is a methodology for intelligence gathering across the entire internet. Unlike search engines that index web pages, Shodan scans IP addresses and indexes service banners, response headers, and device metadata — turning the global network of connected devices into a searchable intelligence database. This approach reveals exposed services, unsecured infrastructure, and the digital footprint of any organization connected to the internet.

Prerequisites

Before studying Shodan, you should understand:

  • **Networking Basics** — Ports, protocols, IP addressing
  • **OSINT Introduction** — Information gathering methodology
  • **Nmap Beginner Tutorial** — Service fingerprinting concepts
  • **Amass Guide** — Attack surface mapping

    • Shodan Search Filters

    Basic Filters

    # Search by service/port
port:80
port:22
port:443

# Search by protocol
protocol:ssh
protocol:http
protocol:mysql

# Search by country
country:US
country:JP
country:DE

# Search by city
city:"San Francisco"
city:London

# Search by organization
org:"Google"
org:"Microsoft"

    Advanced Filters

    # Operating system
os:"Windows 10"
os:"Linux"

# Product and version
product:Apache
product:nginx
product:"Microsoft IIS"
version:2.4.49

# Hostname
hostname:target.com
hostname:*.target.com

# Network range
net:192.168.1.0/24
net:10.0.0.0/8

# SSL/TLS certificate
ssl.cert.subject.cn:target.com
ssl.cert.issuer.cn:"Let's Encrypt"

    Practical Shodan Queries

    Finding Vulnerable Systems

    # Apache 2.4.49 (vulnerable to CVE-2021-41773)
apache version:2.4.49

# EternalBlue (SMBv1)
port:445 os:"Windows 7"

# Default credentials
"220" "VSFTPd" "ready"

# Unsecured Redis
product:Redis port:6379 "NOAUTH"

# Unsecured MongoDB
product:MongoDB port:27017 -authentication

# Open Elasticsearch
product:Elasticsearch port:9200

    Discovering IoT Devices

    # Webcams
webcam
"webcamxp" port:8080
"ip camera" port:80

# Industrial control systems
"modbus" port:502
"siemens" port:102
"bacnet" port:47808

# Network printers
"printer" port:9100
"JetDirect"

# Routers
"router" os:"Linux"
product: "MikroTik"

    Organization-Specific Queries

    # All services for an organization
org:"Target Corporation"

# SSL certificates for a domain
ssl.cert.subject.cn:target.com

# Subdomains
hostname:*.target.com

# All devices in a network
net:203.0.113.0/24

    Using the Shodan CLI

    Installation

    # Install Shodan CLI
pip install shodan

# Initialize with API key
shodan init YOUR_API_KEY

    Command Line Searches

    # Basic search
shodan search "apache"

# Search with count
shodan count "nginx"

# Get host information
shodan host 8.8.8.8

# Download search results
shodan download results.txt "product:nginx"

# Parse downloaded results
shodan parse --fields ip_str,port,org results.txt.json.gz

# Get my IP info
shodan myip

    Port Scanning with Shodan

    # Use Shodan's scan infrastructure
shodan scan submit 203.0.113.0/28

# Check scan status
shodan scan status SCAN_ID

# List protocols Shodan can scan
shodan protocols

    Using the Shodan API

    import shodan

api = shodan.Shodan('YOUR_API_KEY')

# Search for devices
def search_devices(query):
    try:
        results = api.search(query)
        for result in results['matches'][:10]:
            ip = result['ip_str']
            port = result['port']
            org = result.get('org', 'N/A')
            print(f"{ip}:{port} - {org}")
    except shodan.APIError as e:
        print(f"Error: {e}")

# Get host details
def get_host(ip):
    try:
        host = api.host(ip)
        print(f"IP: {host['ip_str']}")
        print(f"Organization: {host.get('org', 'N/A')}")
        print(f"OS: {host.get('os', 'N/A')}")
        for item in host['data']:
            print(f"Port {item['port']}: {item['product']}")
    except shodan.APIError as e:
        print(f"Error: {e}")

search_devices("apache")

    Shodan Monitor

    Shodan Monitor provides continuous monitoring of your network:

    # Create a monitor network
shodan monitor add "My Network" 203.0.113.0/24

# List monitored networks
shodan monitor list

# Get alerts
shodan alert

    Real-World Use Cases

    Exposure Assessment

    # Find all exposed databases in your organization
shodan search "org:YourCompany port:5432,3306,6379,27017"

# Check for end-of-life software
shodan search "org:YourCompany windows 7"
shodan search "org:YourCompany apache 2.2"

    Incident Response

    # During breach investigation, check attacker infrastructure
shodan host ATTACKER_IP

# Find other systems using the same SSH key
shodan search "ssh fingerprint:KEY_HASH"

    Competitive Intelligence

    # Map competitor's exposure
shodan search "org:Competitor port:3389"
shodan search "org:Competitor product:mysql"

    Common Mistakes

    Using free tier only: The free Shodan tier shows limited results and filters. A paid account is needed for serious work.

    Ignoring rate limits: API calls are rate-limited. Batch processing requires pagination.

    Not filtering results: Shodan can return thousands of results. Use specific filters to narrow down.

    Forgetting about false positives: Shodan banners may not reflect current state. Verify findings directly.

    Best Practices

  • **Use specific filters** — Narrow results by port, product, and location
  • **Combine queries** — Use multiple filters for precise targeting
  • **Verify findings** — Confirm Shodan results with direct connection
  • **Use Shodan Monitor** — Track your own organization's exposure
  • **Integrate with other tools** — Pipe Shodan results into Nmap, Metasploit
  • **Respect legal boundaries** — Only scan authorized systems

    • Related Tools

  • **Censys** — Alternative internet scanning search engine
  • **ZoomEye** — Chinese equivalent of Shodan
  • **BinaryEdge** — Threat intelligence and attack surface monitoring
  • **Nmap** — Scan specific targets discovered via Shodan

    • Related Articles

  • OSINT Introduction
  • Amass Guide
  • Reconnaissance Workflow
  • Nmap Advanced Techniques

    • Summary

    Shodan is a search engine for internet-connected devices that indexes service banners and metadata. Using filters for ports, products, organizations, and locations, security professionals can discover exposed services, find vulnerable devices, and map organizational attack surfaces. The CLI and API enable automation and integration into workflows.

    Knowledge Check

  • How is Shodan different from Google search?
  • What information does a Shodan search result include?
  • Name three filters and what they do.
  • Why is verifying Shodan results important?
  • What is Shodan Monitor used for?

    • Frequently Asked Questions

    What is Shodan and how does it differ from Google?

    Shodan scans IP addresses and indexes service banners, headers, and metadata from devices like webcams, routers, and servers. Google searches web content; Shodan discovers internet-connected devices and their exposed services.

    What Shodan filters should I know first?

    Basic filters include port (port:80), protocol (protocol:ssh), country (country:US), org (org:'Google'), product (product:Apache), and hostname (hostname:target.com). Combine multiple filters for precise targeting.

    How do you find vulnerable systems on Shodan?

    Search for specific versions like `apache version:2.4.49` (CVE-2021-41773) or `product:Redis port:6379 'NOAUTH'` for unsecured databases. Shodan reveals default credentials, outdated software, and misconfigured services.

    What IoT devices can Shodan discover?

    Shodan finds webcams (`webcamxp` port:8080), industrial control systems (`modbus` port:502), printers (`JetDirect` port:9100), and routers. These often have default credentials and minimal security.

    How do you use the Shodan CLI?

    Install with `pip install shodan`, initialize with `shodan init YOUR_API_KEY`, then search with `shodan search`, count results with `shodan count`, and get host details with `shodan host IP`. The CLI enables scripting and automation.

    What is Shodan Monitor used for?

    Shodan Monitor provides continuous monitoring of your organization's network. Add IP ranges with `shodan monitor add`, receive alerts for new exposures, and track changes in your attack surface over time.

    How do you find all services for an organization?

    Use `org:'Target Corporation'` to find all Shodan-indexed services for an organization. Combine with SSL certificate filters (`ssl.cert.subject.cn:target.com`) and hostname patterns (`hostname:*.target.com`) for comprehensive coverage.

    Why should Shodan results be verified?

    Shodan banners may not reflect current state — services may have been patched, removed, or changed since the last scan. Always verify findings with direct connection or Nmap scans to confirm vulnerabilities still exist.

    How can Shodan be used for incident response?

    During breach investigations, check attacker infrastructure with `shodan host ATTACKER_IP`. Find other systems using the same SSH key with `ssh fingerprint:KEY_HASH`. This helps map the attacker's footprint.

    What are the limitations of the free Shodan tier?

    The free tier shows limited results and filters. Serious work requires a paid account for full access to search results, API credits, and Shodan Monitor. See the [Nmap Advanced Techniques](/learn/nmap-advanced-techniques) article for complementary scanning.