Shodan has changed the way hackers build tools,
as it allows a large part of the target discovery phase to be automated. Rather than scanning the entire
Internet
hackers can enter the right search terms to get a massive list of potential targets.
There is also a Shodan CLI client written in Python that allows hackers to quickly write Python
scripts that target vulnerable devices all over the world.
There are more than 20 billion IoT devices connected to the Internet so definitely you'll want to
narrow your search. After you log in with a free or paid account
a number of additional search capabilities will become available for you in the form of filters.
The real power of Shodan comes from customized queries.
Let's take a look at some of the most useful filters!
If you want to geographically narrow your search use the country or city filters. Let's
search for d-link Internet cameras in Germany.
These are all d-link Internet cameras and I want only the cameras in Germany country: and the
country code,
in this case de. To use the filter type the name of the filter,
in this case country: and then a search for a term. And these are all d-link Internet cameras
In Germany. Now let's see what we can find in Berlin.
city:Berlin
and there are 6 cameras in Berlin.
Or we can search for Cisco devices in a particular subnet.
Cisco net the filter : and the sumnet.
Let's take a random subnet!
And there are 3 Cisco devices on that subnet. We can also combine filters by adding them like this
so if you want to search for Apache web servers in Sidney that are running on port 8080 and
are also running Tomcat you have to combine 3 filters: city, port and product.
So I'm searching for Apache city:"Sydney" port:"8080" the port is listens on
product:"Apache Tomcat"
and it found only a Apache web servers that also run Tomcat in Sydney.
For example
this one has 3 ports open 22 80 and 88.
And Shodan also searches for vulnerabilities for the versions of the services that are running on that
host. For example
these are the vulnerabilities for the services that are running on this IP address.