Now let's tackle some plain text searches.
These will be basic text strings targeting the information in
banner text, and we'll see what Shodan can tell us about those.
Using this search box at the top of the Shodan site, we will try
some plain text searches.
I'm curious about the number of Apache web servers there
are in the world, so let's try that one.
There are only about 24,000,000 sites powered by Apache.
Let's compare that with NGINX. There are a few more of those at 31,000,000.
Let's explore one of them.
Note the red box and arrow. Clicking that will take you directly to the
website in your browser. Clicking the IP address or page title will take
you to a Shodan information page for that system.
At the top of the page is a map of the location of the system.
In the upper left is some general information about the
location, ISP, and associated ASN.
Below that is some information on the web technologies that the system may have.
In the upper right, we find the open network ports on the system, and
below that there are details about those services.
We can see the network port, protocol, service name,
and the collected banner text.
Let's try some other searches.
I'm curious about those Raspberry Pis. Many of them run an
OS called Raspbian. Here we can see one example of a system
that runs the SSH protocol.
In this case, it's OpenSSH. Shodan has collected its software
version, public key, and supported algorithms.
We can search in the same way for Ubuntu systems.
Note that many of them are web servers hosted in a cloud environment.
There is a tag applied if Shodan believes they are cloud‑hosted.
This server has a public key certificate, and we can see the details
about that certificate here. Shodan has also identified potential
vulnerabilities based on the software and version.
Shodan does not test that these are present in the server,
though. We can also use two or more search terms.
Shodan will match on all of those terms. Here are Windows Server systems.
Notice the results highlight the search term matches in a red color.
We can also use this matching capability to find unique and
legacy systems still connected to the internet,
including the very old Google search appliances that were discontinued in 2019.
It also means plain banner text search can identify other unique
systems such as Siemens‑made industrial control systems.
Notice the ics tag.
This system runs a single network service for management,
but it reveals a lot of information specific to this device.
We can see details about the module and its firmware
version. Nucleus Plus is another ICS example.
This device has even more network services.
This quick demonstration of plain text searches shows you the level of detail
that Shodan provides and relatively quick nature of searching.
Next, we'll refine our search results using filters.