So far,
Shodan has shown a lot of information about devices it found
on the internet with a plain text search.
Now let's focus refining those results with search filters.
All search filters are based on using the name of the filter,
a colon separator, and then the value. Notice there's no
space between the colon and the value.
If you need a space in the value,
say, for a two‑word city name, double quote the value.
You can also combine filters together to match on both filter values.
There are many filters available in Shodan, but
we're focusing on just a few here.
First, we'll look at limiting results to specific
organizations with the "org" filter. Next,
we can limit results to a specific city.
Then, products.
These can be software or hardware products or network services.
Finally,
we'll look at network service ports. Using the filters, we can also exclude
results by prefixing the filter name with a "dash." To see how filters work,
let's start with looking at results from an organization. Here we can see
quite a few results for this organization.
Notice that there are multiple matches for the organization name here.
Here's another example. Notice here we have several
countries listed for this organization.
This example organization offers services worldwide through its cloud services,
SaaS software, and various locations.
Now let's look at limiting results to a specific city. Using our
previous organization, let's also add a city filter.
Let's look at another city. Here we can see a variety of
organizations with assets in this city.
This works internationally as well,
but notice those city names may be present in countries you didn't expect.
We may be interested in only identifying specific software.
For this, there is the "product" filter. Here are the results
for identifying ProFTPD servers.
Here are the results from a sendmail server filter, and an example of details.
When searching around, we'll likely find examples of "security through
obscurity," where someone thought placing a common network service on a
non‑standard network port will provide some protection.
Shodan can detect and identify specific network services
regardless of the port they run on.
So, how do we find these?
Well, we can prefix the filter with a "dash" to exclude those results.
For example,
I want to find all of the results where Sun SSH is not
running on the standard SSH port of 22.
Another service that might run on a non‑standard port is VNC.
This search looks for VNC servers that do not run on ports
5900 and 5901 for VNC displays 1 and 2.
So you can see, using search filters,
you can be more specific with your search results.