Now that you have an idea of how powerful and at the same time dangerous Shodan is let's move on and
see how it works behind the scenes. When used properly and ethically
Shodan can be an invaluable tool to help you improve vulnerability assessment and penetration testing
as the IoT continues to expand. A typical search engine like Google crawls for data on web pages and
then index them for searching. SHODAN
on the other hand interrogates ports and grabs the resulting banners, then indexes the banners
for searching rather than the web content. Rather than locating specific content on a particular search term,
SHODAN is designed to help the user find specific IoT devices that are connected to the Internet with
specific content in their banners.Optimizing Shodan search results requires some basic knowledge
of banners because Shodan works by scanning specific ports of random IP addresses on the Internet
and performing what is known as Banner Grabbing. Banner grabbing is defined as a technique used
to gain information about a computer system on a network and the service running on its open ports. Banner grabbing
can be performed manually or in an automated fashion like Shodan. The manual way to perform
a banner grab is by using a network utility like Telnet or Netcat.
For example I'll grab the banner of a Linux machine that has port 22 open telnet the IP address
of the machine and port22. This has opened a connection to that IP address and got a response
from the remote server.
In this case I targeted the port 22 of an open ssh server and the result was the exact version that
is running on that server
right now. A hacker having that valuable information can then search for exploits for that specific version.
I'm copying and then pasting the ssh version on Google.
Shodan works by performing this banner grabbing action over and over again for all possible combinations
of IP addresses and ports on the Internet.
Shodan's basic algorithm works by picking a random IP for address and then a port from a list with
ports of interest; then it will do a banner grab and see if the device responds in a way that
is known.
Then it starts all over again by picking a new random IPv4 and a port. If a device is connected
to the Internet
it probably is on Shodan too. The basic search for such a device is performed by its IP address.
Let's
suppose you want to check that this IP address is on Shodan. You simply paste it here and search
for the address;
and it was found. If you like to have more in-depth knowledge of Shodan
I highly recommend the book written by its creator himself.