What is Shodan?
Shodan is a search engine for finding specific devices, and device types, that exist online.
Shodan collects data mostly on web servers (HTTP/HTTPS – ports 80, 8080, 443, 8443), as well as FTP (port 21), SSH (port 22), Telnet (port 23), SNMP (port 161), IMAP (ports 143, or (encrypted) 993), SMTP (port 25), SIP (port 5060) and Real Time Streaming Protocol (RTSP, port 554). The latter can be used to access webcams and their video stream
The most popular searches are for things like webcam, linksys, cisco, netgear, SCADA, etc.
It works by scanning the entire Internet and parsing the banners that are returned by various devices. Shodan can tell you things like what web server (and version) is most popular, or how many anonymous FTP servers exist in a particular location, and what make and model the device may be.
Shodan is of particular use for security research around the Internet of Things, since there will soon be billions of devices online that 1) have specific vulnerabilities that need to be fixed, and 2) can be identified quickly by their banner information.
You start by navigating to the main page, and then entering into the search field, like you would any other search engine.
For example, SHODAN shared results for “webcams”.
Results map shows different type of information like
- Total results
- Top countries
- Top services (Ports)
- Top organizations (ISPs)
- Top operating systems
- Top products (Software name)
And in the main section we get the full results list, including:
- IP address
- When the entry was added to the database
- The country it’s located in
- The banner itself
Then, for even more information click details, which takes into that host itself:
When in details mode for a given host, the URL changes from the search structure to the following: https://www.shodan.io/host/22.214.171.124
The data about the host on the left, the list of ports that were found at the top right, and then the individual port details and banners from each port as you go down the page. It’s very easy to understand information