Skip to main content

Shodan , guide how you can find everything!

Cover image

Article Metadata

Ecosystem Fit​

This page mirrors the original Medium article into the 1200km.com Docusaurus ecosystem. The original article flow, images, screenshots, infographics, and technical blocks are preserved from the export.

In this guide, we’ll explore how to navigate Shodan, understand the information it provides, and, most importantly, how to make use of the data you find. From identifying exposed critical infrastructure to locating everyday devices, Shodan opens a window into the connected world. Let’s dive in and learn how to uncover and leverage this powerful resource!​

shodan

The internet is more than just websites; it’s a vast network of devices, from industrial control systems to home security cameras, all of which can be discovered with the right tools.Shodanis that tool — a powerful search engine for the Internet of Things (IoT). Whether you’re a cyber security professional, researcher, or curious tech enthusiast, Shodan can reveal what devices are exposed to the internet and potentially vulnerable.

About the Author:

I’m Andrey Pautov, a penetration tester and cyber security researcher. My work and research focus on offensive security.

About this guide:

In this guide, I’ll explore many of Shodan’s capabilities, providing a detailed look at what you can uncover. I’ll also include links to my other articles on how to use or exploit the findings you discover, helping you maximize Shodan’s potential in your cybersecurity research.

Disclaimer:​

This guide is intended for educational purposes only and is aimed at promoting responsible and legal use of Shodan for cybersecurity research. All data, including IP addresses, usernames, and other sensitive information, referenced in this guide were found through open sources that are publicly available on the internet. No systems were harmed or compromised during the creation of this guide.

It is important to note that unauthorized access to systems or networks is illegal and unethical. As the author, I am not responsible for how the information in this guide is used by others. Always ensure you have proper authorization before interacting with any network, device, or system.

What devices can Shodan really find with examples and exploit:​

1. Servers and Endpoints with open remote access services​

Shodan can locate:

1. FTP (File Transfer Protocol)​

  • Standard Query:

[port:21](https://www.shodan.io/search?query=port%3A21)

Vulnerable or Misconfigured FTP Servers:​

  • Anonymous Access Enabled:

[port:21 "230"](https://www.shodan.io/search?query=port%3A21+%22230%22)

[port:21 Login successful](https://www.shodan.io/search?query=port%3A21+Login+successful)

Full explanation about FTP cracking in my other posthere

2. Remote Desktop Protocol (RDP) services​

  • Standard Query:

[port:3389](https://www.shodan.io/search?query=port%3A3389)

Vulnerable or Misconfigured RDP Services:​

  • RDP with Screenshot Available or username (potential for exposed sensitive information):

[port:3389 has_screenshot:true](https://www.shodan.io/search?query=port%3A3389+has_screenshot%3Atrue)

[port:3389 "Administrator"](https://www.shodan.io/search?query=port%3A3389+has_screenshot%3Atrue)

Full explanation about RDP cracking in my other posthere

3. Telnet​

  • Standard Query:

[port:23](https://www.shodan.io/search?query=port%3A23)

Vulnerable or Misconfigured Telnet Services:​

  • Telnet with Login Prompt (susceptible to brute force attacks):

[port:23 "Login"](https://www.shodan.io/search?query=port%3A23+%22Login%22)

  • Telnet Not Requiring Authentication:

Already Logged-In as root via Telnet: ["root@" port:23 -login -password -name -Session](https://www.shodan.io/search?query=%22root%40%22+port%3A23+-login+-password+-name+-Session)

No password for Telnet Access: [port:23 console gateway](https://www.shodan.io/search?query=port%3A23+console+gateway)

Full explanation about Telnet cracking in my other posthere

3. SSH​

[port:22](https://www.shodan.io/search?query=port%3A22)

Full explanation about SSH cracking in my other posthere

4. RTSP​

  • Standard Query:

[port:554](https://www.shodan.io/search?query=port%3A554)

Vulnerable or Misconfigured RTSP Services:​

  • RTSP with Screenshot Available (can indicate unsecured streams):

[port:554 has_screenshot:true](https://www.shodan.io/search?query=port%3A554+has_screenshot%3Atrue)

  • Unauthenticated RTSP Streams:

[port:554 "401 Unauthorized"](https://www.shodan.io/search?query=port%3A554+%22401+Unauthorized%22)

Full explanation about RTSP cracking in my other posthere

5.Web servers​

Full explanation about Web Interface cracking in my other posthere

What is Shodan dorks?​

“Shodan dorks” refer to the search queries used on the Shodan search engine. Shodan is a tool that scans and indexes devices connected to the internet, ranging from webcams and routers to servers and industrial control systems. Shodan collects data from these devices, such as banners which can contain information about the software and versions running, any services exposed to the internet, and sometimes even the physical location of the device.

Understanding Shodan Dorks​

A Shodan dork is essentially a search string that uses specific search syntax to filter through the indexed data collected by Shodan. These dorks can be simple or complex, depending on the user’s familiarity with the syntax and the specific data they are trying to extract. For example:

  • Searching for all devices within a specific country:country:"US"

  • Finding devices running a specific web server:server:"Apache"

  • Locating devices with a specific port open:port:21

Uses of Shodan Dorks​

**1. Security Research:**Security professionals use Shodan dorks to find devices that may be vulnerable to exploits, helping to identify and mitigate risks before they can be exploited by malicious actors.

**2. Network Monitoring:**System administrators can use Shodan to monitor the internet exposure of their network and ensure that no unexpected services or devices are publicly accessible.

**3. Educational Purposes:**Educators and students use Shodan for research and learning about the distribution of devices and services across the internet, enhancing their understanding of the global digital infrastructure.

**4. Market Research:**Companies can use Shodan to gauge how widely their products are being used or to find the usage stats of competitors’ products.

Crafting Effective Shodan Dorks​

To effectively use Shodan dorks, one must understand the various filters and operators that Shodan supports. This includes geographic filters, service or product filters, and more complex boolean operators that allow for detailed and refined searches. Mastery of these dorks can yield powerful insights and a comprehensive view of the internet’s infrastructure landscape.

In summary, Shodan dorks are powerful tools in the hands of those who know how to use them, allowing for detailed searches and analysis of the devices that make up the internet. However, it’s important to approach this capability responsibly, given the potential security and privacy implications.

Table of Contents​

  • Cameras

  • Industrial Control Systems

  • Network Infrastructure

  • Files and Directories

  • Compromised Devices and Websites

  • Miscellaneous

Cameras​

General Camera Searches​

  • General Camera Search: Explore a broad spectrum of cameras connected all over the world.

  • Search here

Specific Camera Brands and Features​

Vulnerable and Accessible Cameras​

Miscellaneous Camera Queries​

Less Common Searches​

Industrial Control Systems​

Major Industrial Protocols​

Specialized Industrial Searches​

Monitoring and Control Devices​

Miscellaneous Industrial Equipment​

Highly Specific and Niche Searches​

Network Infrastructure​

Database Technologies​

Management and Configuration Interfaces​

Network Devices and Tools​

  • Android Debug Bridge: Provides a terminal interface for managing Android devices, often left open unintentionally.

  • Search Android Root Bridges

  • Polycom Video Conferencing: These devices are crucial for business communications but can expose meetings if misconfigured.

  • Search Polycom systems

  • Pi-hole Open DNS Servers: DNS servers that block ads at the network level but can be manipulated if exposed.

  • Search open Pi-hole DNS servers

Vulnerabilities and Misconfigurations​

  • Exposed MongoDB Express Web Interfaces: Web interfaces for MongoDB that should not be accessible without authentication.

  • Search exposed MongoDB Express interfaces

  • Citrix Virtual Apps: Used for remote applications and desktops, these systems can give access to an organization’s internal networks if compromised.

  • Search Citrix applications

  • PBX IP Phone Gateways: Essential for managing VoIP services, these gateways must be secured against unauthorized access.

  • Search PBX gateways

Miscellaneous​

General Printer Searches​

  • General Printer Search: This query provides a broad view of printers connected across the globe, regardless of brand or type.

  • Search general printers—91,880 results

  • Brand-Specific Printer Searches

  • HP Printers Remote Restart: HP printers are common in both business and personal environments. This search finds devices that may allow remote restart commands.

  • Search HP printers with remote restart capability

  • Canon Printer HTTP Servers: Canon printers with HTTP servers can often be managed remotely.

  • Search Canon printers

  • HTTP Accessible Epson Printers: These printers are accessible over HTTP, potentially allowing for unsecured access to the device’s functions.

  • Search HTTP accessible Epson printers

Security and Configuration​

Miscellaneous Printer Searches​

Files and Directories​

Exploring Open Directories​

  • Open Lists of Files and Directories: Discover directories openly indexed on the internet, potentially exposing sensitive files.

  • Search open file lists

  • Open Lists on Port 80: Specifically focusing on web servers configured to list contents publicly on the default HTTP port.

  • Search open lists on port 80

Network File Sharing Vulnerabilities​

Specific FTP Configurations and Vulnerabilities​

  • Filezilla FTP: Targeting Filezilla servers, commonly used for file sharing and management.

  • Search Filezilla FTP servers

  • NDMP on FTP Port 10000: Searching for Network Data Management Protocol services running on a non-standard FTP port.

  • Search NDMP services on FTP port 10000

  • Vulnerable vsftpd Service: Specifically targets vulnerable versions of the vsftpd server, known for critical security flaws.

  • Search vulnerable vsftpd servers

  • Miscellaneous File Exposures

  • QuickBooks Files Shared Over Network: Focuses on network shares that expose QuickBooks financial data, which could be extremely sensitive.

  • Search QuickBooks files over network

  • Compromised Devices and Websites

Indicators of Compromise

  • General Hacked Label Search— Looks for devices labeled as hacked.

  • Ransomware Infected RDP Services — Targets RDP services compromised with ransomware.

Compromised devices and websites​

General Search for Hacked Devices​

Specific Compromised Systems​

Hacked Website Indicators​

Specific Types of Compromise​

Ransomware and Malware​

Bitcoin and Cryptocurrency Threats​

Miscellaneous​

Dashboard and Control Panel Interfaces​

Specific Server Configurations​

  • Minecraft Servers: Identifies active servers running Minecraft, a popular online game, which can reveal the game’s network infrastructure.

  • Search for Minecraft servers

  • Tesla-related Interfaces: Searches for network interfaces related to Tesla, which might include charging stations or other Tesla-related technology.

  • Search for Tesla-related interfaces

Geographically Specific Searches​

Utility and Infrastructure​

  • EIG Electricity Meters: These searches target specific utility meters, which can provide insights into the infrastructure and operational technology of utility providers.

  • Search for EIG electricity meters

Configuration Vulnerabilities​

Conclusion: The Broad Reach of Shodan​

Exploring Shodan has uncovered a wide spectrum of exposed and vulnerable devices, from everyday objects like printers to critical infrastructure like industrial controls. This exploration underscores the vastness of the digital world and the urgent need for enhanced cybersecurity awareness and measures. Shodan not only illuminates the hidden corners of the internet but also highlights the importance of proactive digital hygiene practices. Let this guide inspire you to further explore and secure our interconnected digital landscape, making the internet a safer place for everyone.

1200km@gmail.com