Network Reconnaissance Tools
Shodan Tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
shodan usage
Shodan.io is a search engine that allows you to find specific devices and information about them on the internet. It is known for its ability to locate various devices connected to the internet, including webcams, routers, servers, and much more. Most internet of things devices can also be found using this tool. Shodan is not a completely free tool. Infact to make the most use of it, you do need to pay for a membership. Here we will show a few basics that can be done even with the free version which has a lot of limitations on the amount of results you can retrieve.
I will be using the web version that is completely free without any account for this demonstration. To start, you can go to shodan.io to access the search page
On the search page, you can search for an IP address, a domain name, an operating system, an IOT device and so on. In this example, I search for "unilus.ac.zm", a domain name for the University of Lusaka.
The results show the IP address of the server, the location including country and city, the database used, the operating system version and build number, the netbios name, the domain name, fully qualified domain name, DNS tree and so on. You can see that it provides a lot of information just from a simple search. You can then click on the "view report" to get more specifics broken down nicely.
The same things can be seen but recognise that there is a vulnerabilities section which should only be accessible to account holders.
The searches can also be for any technology. You can search for device names including phones, routers, basically any internet connected technology. In this case I searched for "Windows 10" and it was able to find 2 million windows 10 internet connected devices on the free plan. In some results, you are able to see the services running, the XML documents showing additional information, text documents and much more.
Likewise, I also searched for MySQL and was able to see systems that are running different versions of the database server with the version information displayed right in the results.
Lastly, I searched for CCTV and was again able to find devices that are connected to cameras, cameras that are IP nodes and much more.
This is an interesting tool even when using the free version. Finding version information about targets is one step towards finding vulnerabilities to exploit and this tool does it with a very good looking user interface.