Hacking With Shodan (How to use Shodan Guide)
Today we are reviewing shodan also know as the hacker’s search engine. We will see what shodan is and how to use shodan. We will also explore some advanced features of shodan. Everything related to shodan search filters and shodan search queries is also available.
Welcome to another hacking tutorial.
What is Shodan?
Shodan is a unique search engine that finds devices that are connected to the internet and gathers information about those related devices using banners and port scanners.
The most popular searches are for devices like routers, webcam, ADB devices, etc. Shodan can show all the devices which are broadcasting their information on the world wide web. This is especially useful for people pentesting IoT devices as well as critical infrastructures such as power grids and power plants.
Sometimes due to misconfiguration and human error, criticals services are explored on the internet. With Shodan, you can see those critical services openly accessible via the internet.
How does Shodan work?
As I said before Shodan is a search engine that works by scanning the entire internet and parsing the information on banners that are returned by various devices connected on the internet. By using this information, Shodan can show you a lot of valuable information about the devices on the internet.
For, e.g., it can show detailed information about which ports and services are being used by a specific device. It can also provide information about which webserver and version it is using along with other juicy details that can be used by hackers and pen-testers for information gathering.
Shodan is mainly used for security research, and that was the original intent of the developer. However, many hackers also use this tool to find information about vulnerable devices on the internet.
The main focus is around the Internet of Things since there are already billions of devices coming online every year.
Shodan can show researchers and pentesters:
1) Devices which have specific vulnerabilities that
2)Devices which can be identified quickly by their banner information.
3)Devices with default credentials
4)Devices connected to the internet without any security
How to use shodan?
A simple Tutorial for Basic Users:
Step 1: You start by visiting the official site of Shodan.
Step 2: Now in the search box type: Any of the following popular queries
“Webcam“,” ” vnc“, ” Android debug bride“, ” router“, ” cams” default password“
For this search, I looked for “android debug bridge.“
From the image, you can see all the critical information revealed by Shodan
Step 3: Click on any link, and you will get even more detailed information about ports services manufacturers information, etc.
What if you want to search for any specific information on shodan?
Well, we have shodan filters that can help you simplify the whole deal. There are many more filters that can be used. The detailed list is added below. For now, I will show the most popular ones below:
Shodan Filters
Here are the most popular search filters you can use on shodan:
§ city: find devices connected in a particular city,
e.g., city:”San Francisco.”
§ country: find devices in a particular country,
e.g., country:”IN”
§ geo: you can pass it longitude-latitude coordinates
geo:32.8,-117,50
§ Hostname: find devices with that matching the Hostname
hostname:”google”
§ net: search based on an IP address
net:”216.219.143.0/24″
§ os: search based on the operating systems
os:”windows”
§ port: find particular ports which are open on specific devices (e.g., 8080, 21, etc.)
port:8080
§ before/after: find results within a specific time frame.
country: CH after: 22/03/2010 before:4/6/2010
You can also use the “Explore” feature on the main website of Shodan to look at popular searches and results. You’ll find exciting things like:
1. Webcams
2. SCADA
3. Traffic lights
4. Routers
5. Default passwords
6. IoT devices
7.and many more
Advanced Use of shodan
Here are a few other cool features of shodan you need to know about
1. Data Export feature: You can export your shodan search results in various formats by using the top menu
2. Browser Search: You can configure your browser by adding addons for shodan. A chrome and firefox plugin is available with shodan API
3. Shodan is Free: You need to create a free shodan account to access all the information. Compared to before, many of the shodan features have become paid only. However, you can still use the free version as much as you want legally.
4. Premium Accounts: A shodan premium account can be bought with a monthly subscription, as shown below. See the image for more details on shodan premium plans
5. Shodan Exploit search feature
You can search exploits with the new shodan exploit search engine. See image below where I searched for android exploits. I’ll make a separate article on this feature so stay tuned.
Android exploits:
6. Shodan Map search
You can find devices by using the map search feature. A great way to find vulnerable devices near you. You can control everything with the mouse making it quite easy to navigate.
7. Shodan honeypot checker
Shodan now has a great feature to check for honeypots. By using these feature, we can confirm the IP address we are pining is an actual device or a honeypot.
If you want to know more about honeypots, click here.
List of Shodan Filters
General Filters
| Name | Description | Type |
|---|---|---|
| after | Only show results after the given date (dd/mm/yyyy) | string |
| asn | Autonomous system number | string |
| before | Only show results before the given date (dd/mm/yyyy) | string |
| category | Available categories: ics, malware | string |
| city | Name of the city | string |
| country | The 2-letter country code | string |
| geo | Accepts between 2 and 4 parameters. If 2 parameters: latitude, longitude. If 3 parameters: latitude,longitude,range. If 4 parameters: top left latitude, top left longitude, bottom right latitude, bottom right longitude. | string |
| hash | Hash of the data property integer | integer |
| has_ipv6 | True/ False boolean | boolean |
| has_screenshot | True/ False boolean | boolean |
| hostname | The full hostname for the device | string |
| ip | Alias for net filter | string |
| isp | ISP managing the netblock | string |
| net | Network range in CIDR notation (ex. 199.4.1.0/24) | string |
| org | The organization assigned the netblock | string |
| os | Search by Operating system | string |
| port | Port number for the service integer | string |
| postal | Postal code (US-only) string | string |
| product | Name of the software/ product providing the banner string | string |
| region | Name of the region/ state string | string |
| state | Alias for region string | string |
| version | Version for the product string | string |
| vuln | CVE ID for a vulnerability string | string |
HTTP Filters
| Name | Description | Type |
|---|---|---|
| http.component | Name of web technology used on the website | string |
| http.component_category | Category of web components used on the website | string |
| http.html | HTML of web banners | string |
| http.html_hash | Hash of the website HTML | integer |
| http.status | Response status code | integer |
| http.title | Title for the web banners website | string |
NTP Filters
| Name | Description | Type |
|---|---|---|
| ntp.ip | IP addresses returned by monlist | string |
| ntp.ip_count | Number of IPs returned by initial monlist | integer |
| ntp.more | True/ False; whether there are more IP addresses to be gathered from monlist | boolean |
| ntp.port | Port used by IP addresses in monlist | integer |
SSL Filters
| Name | Description | Type |
|---|---|---|
| has_ssl | True / False | boolean |
| ssl | Search all SSL data | string |
| ssl.alpn | Application layer protocols such as HTTP/2 (“h2”) | string |
| ssl.chain_count | Number of certificates in the chain | integer |
| ssl.version | Possible values: SSLv2, SSLv3, TLSv1,TLSv1.1, TLSv1.2 | string |
| ssl.cert.alg | Certificate algorithm | string |
| ssl.cert.expired | True / False | boolean |
| ssl.cert.extension | vNames of extensions in the certificate | string |
| ssl.cert.serial | Serial number as an integer or hexadecimal string | integer / string |
| ssl.cert.pubkey.bits | Number of bits in the public key | integer |
| ssl.cert.pubkey.type | Public key type | string |
| ssl.cipher.version | SSL version of the preferred cipher | string |
| ssl.cipher.bits | Number of bits in the preferred cipher | integer |
| ssl.cipher.name | Name of the preferred cipher | string |
Telnet Filters
| Name | Description | Type |
|---|---|---|
| telnet.option | Search all the options available | string |
| telnet.do | The server requests the client does support these options | string |
| telnet.dont | The server requests the client not to support these options | string |
| telnet.will | The server supports these options | string |
| telnet.wont | The server doesn’t support these options | string |
Credits: JavierOlmedo
Hopefully, with this tutorial, you were able to get all the necessary information you need about using shodan.
As you can probably see, shodan is an excellent tool with both good and bad aspects. Its shows how easily hackers can hack our devices by using exploits and misconfigurations to bypass all our security and gain unauthorized access to our devices connected on the internet.
How to secure your devices on the internet?
- Make sure you change the default password configuration of devices on the internet
- Services that do not require the internet should not be connected to the internet.
- Devices should be updated and regularly checked
- Use proper firewalls and antivirus for protecting devices
- Read our article on how to secure your account from hackers
You may also like
Basics of Dynamic Application Security Testing Tools
Top 10 Operating Systems for Hackers
