Shodan

OVERVIEW

Shodan continuously scans the public internet and stores the resulting service banners — HTTP headers, SSH/FTP/Telnet banners, SCADA/ICS protocol responses, SSL certificate details, and more — making them searchable by IP, organization, hostname, product, or CVE. Instead of scanning the target yourself, you query Shodan's already-collected data.

Filters like org:, net:, hostname:, and vuln: (Enterprise plans) let you narrow to a specific company's ASN or a known CVE across its exposed fleet, which makes it a fast way to spot forgotten or misconfigured internet-facing devices — exposed databases, industrial control interfaces, admin panels — that never showed up in the client's own asset inventory.

USE CASES

Practical use cases

• 01

  Mapping an organization's internet-facing IPs, ports, and services via its ASN or org name.

• 02

  Finding exposed databases, industrial control systems, or admin interfaces tied to the target.

• 03

  Checking whether a specific CVE shows up on any host in the target's known IP ranges.

• 04

  Building an external attack-surface baseline before active scanning starts.

QUICK START

During external recon, to map an organization's internet-facing footprint from already-collected scan data before sending a single packet yourself.

1. Search org:"Target Org Name" or net:<CIDR> to list known hosts and open services.
2. Review banners for unexpected services, default credentials pages, or outdated software versions.
3. Cross-reference interesting hosts against the signed scope before investigating further.
4. Save a saved search or alert if the engagement calls for ongoing external monitoring.

BEFORE YOU RUN IT

What to check before running it