Shodan
As we gather information on our target,
it is important to remember
that traditional websites are just one part of the internet.
Shodan is a search engine that crawls devices connected to the internet,
including the servers that run websites,
but also devices like routers and IoT devices.
To put it another way,
Google and other search engines search for web server content,
while Shodan searches for internet-connected devices,
interacts with them, and displays information about them.
Let’s start by using Shodan to search for hostname:megacorpone.com.
In this case, Shodan lists the IPs, services, and banner information.
All of this is gathered passively,
avoiding interacting with the client’s web site.
This information gives us a snapshot of our target’s internet footprint.
For example, there are four servers running SSH.
We can drill down to refine our results by clicking on 22,
the port for SSH, under Top Ports on the left pane.
Based on Shodan’s results,
we know exactly which version of OpenSSH is running on each server.
If we click on an IP address, we can retrieve a summary of the host.
We can review the ports, services,
and technologies used by the server on this page.
Shodan will also reveal if there are any published vulnerabilities
for any of the identified services or technologies running on the same host.
This information is invaluable
when determining where to start when we move to active testing.