Shodan - Search Engine for Internet Connected Devices

Shodan is yet another search engine specifically designed for the Internet Connected Devices. In Simple terms, Shodan is a search engine that allows you to find and look for various devices connected on the internet such as webcams, server smart devices, routers, and ports & services running on various web applications, & systems. According to shodan.io, Shodan is the world's first search engine for Internet Connected.

It is also being described as a search engine of server request/response metadata i.e., whenever a service request or response to something, an appropriate header is attached to it which can be grabbed (banner grabbing, we will discuss later in this chapter) to know about the Windows Service parameters and information. It was launched in the year 2009 by computer programmer John Matherly.

Today, Shodan is one of the most popular tools among security researchers, and it is widely used. It provides APIs (Application Programmable Interface), and that's why many security tools and scripts such as Maltego support Shodan libraries through the tool/script’s interface.

To operate/use shodan, visit - www.shodan.io & below attachment shows the interface of shodan.

Shodan

Shodan is a search engine that lets you find specific types of devices connected to the internet and gather detailed information about them. Explore its various products and tools like Honeyscore, ICS Radar, and Exploits for comprehensive cybersecurity insights.

Please note, that to use some of the advanced queries of Shodan, it requires login. It is advised to create a free account for learning purposes before starting to play with Shodan Queries.

Shodan has another product line as well, let's first look into them before starting with the Shodan Search Engine. Shodan Products involve tools such as Exploits, Maps, Images, Developer API, Browser Plugins, Ship Tracker, Complete guide to shodan, map of the internet, honeypot or not, shodan 3D, etc.

For detailed information, visit https://www.shodan.io/about/products.

Honeyscore - Honeypot or Not

A Honeypot is a technology that is used for computer or network security which helps to detect, counteract, or prevent malicious or intentional attempts that may cause a breach or unauthorized access. It is one of the essential mechanisms implemented by Top-Domain Industries.

Honeyscore is a project by Shodan that helps you to identify honeypots. The tool is based on some of the defining properties of honeypots and the probability that an IP is a honeypot is captured in a Honeyscore value that can range from 0.0 to 1.0.

Steps to check for Honeypot using Honeyscore —

• Visit https://honeyscore.shodan.io/
• Enter the suspect IP Address & Click on Check for Honeypot.
• It will tell whether the system IS real or is a real honeypot.

Industrial Control System (ICS) Radar

ICS describes different types of industrial control systems and associated instruments which include various devices, systems, and networks that are used for automating, controlling, or managing industrial processes? There are various types of ICS such as Supervisory Control & Data Acquisition (SCADA) Systems.

Shodan ICS Radar crawls the various protocols to fetch raw data and information about ICS. This tool visualizes and shows the location of various ICS Devices & other relevant data.

Steps to view ICS Radar –

• Visit https://ics-radar.shodan.io/
• It will show a globe revolving with various green marks hovering which represents various ICS Devices.

The below image shows the interface of this tool.

Shodan Exploits

Shodan Exploits is a database or record of exploits stored by Shodan. You can type the keyword and search of the search for exploits as well as venous exploits. Also, there are a few advanced queries to search for exploits as well.

• Steps to check Exploits with Shodan Exploits –
• Visit https://exploits.shodan.io
• Enter Keyword or Specific Vulnerabilities and hit Search.

It will reflect the result as shown in the below image.

Click on any search result to show its report.

Shodan Search

Shodan Search is the core and heart of shodan.io. It lets you find almost everything that is present or connected over the internet from services, open ports & protocols to webcams & IoT Devices.

Shodan is simple to use but takes time to master the advanced complex queries. We will look at some of the Shodan search engine queries & further resources to explore the Shodan search in-depth.

 

Shodan Basic Operations

• Search - Search terms such as keywords, ports, services or anything specific is entered in the search box.
• Quotation Marks can narrow down the search.
• Boolean operators such as +, &, - can be used to include/exclude query terms and form complex queries.
• Filters - Filters are used to make search results more specific and accurate are a variety of filters such as –
• Country - Two-letter country code (Ex: IN)
• Net-specific IP Range or Subnet
• OS - Operating System
• Port- Specific Ports
• City- Find devices in a specified city
• Geo- you can pass its geographical coordinates, etc.
• Example - Apache Country: IN

This will show results for Apache service with the country code specified.

Steps to use Shodan Search

Visit www.shodan.io

In Search Box input the search query according to a specific target. For Example: we want to look for Apache services in Jaipur City. We will use the following filter—

Apache: city: "Mumbai"

The results shown will look as described in the below image.

Select any of the search results to get an in-depth report. The common Shodan search results include the following information –

• Geographical Information
• Organization & ISP
• Hostname
• Services
• Open Ports
• Web Technologies
• Vulnerabilities that may occur
• SSL Certificate Information
• Banner Information, Etc.

Shodan Explore

Shodan Explore is also a similar feature to search but it lets you look for common search results, top vote targets and give findings like—

• Industrial control systems
• Webcams
• Routers
• Traffic Lights
• Other IoT Devices & Credentials, etc.

Using Shodan Explore

• Visit www.shodan.io and click on the Explore button adjacent to the Shodan search bar.

• It will show options like Featured Categories. Top Voted Queries, Recently Shared, etc. (Refer to the image below):

• Click on any option to show results and detailed information as done in the Shodan Search Option.

Advance Shodan Usage

There are various advanced usage of Shodan which can be self-explored after consistent practice. Some of the advanced usages are—

• Data Export allows exporting results in various formats.
• Browser Search allows configuring the Shodan search from the URL bar.