Before we get into the tool itself, we need to bring some theory to mind. There are two types of reconnaissance — passive and active.
Passive reconnaissance means collecting information about devices from sources publicly available on the Internet. For example, getting information about a server, we do not interact with it directly, which would be, for example, connecting to it.
Active reconnaissance means direct contact with the device. So we need, for example, to send a packet to it. Tools that use active reconnaissance are nmap and WPrecon.
Device search engine
Using Google or Yahoo, not everything can be found. We can filter our queries, but it is of little use. Shodan is just such a search engine that focuses on IoT. What can we find in it? Any networked device, including scanners, servers, and cameras, among others. If the device is connected to the Internet, Shodan’s algorithm queries it from publicly available information. This allows us to obtain such information as server software, supported services, or other information useful in collecting information about the target.
Filtering results
Shodan provides the ability to filter IoT devices. You will find a few example below. For all of them, we refer you to here.
Pages that use bootstrap: http.component:bootstrap.\
Pages that used the word “Apache” in the html code: http.html:Apache.\
Sites vulnerable to CVE-2014–0160: vuln:CVE-2014–0160\\
Sites supporting TLS 1.3: ssl.version:tlsv1.3 HTTP.\
Sites requiring HTTPS connection: HTTP Strict-Transport-Security.
Additional Materials
For those who have a free evening, at this link you can look at random images taken straight from the search engine to the rhythm of retro music 🙂
On repository you will find a tool that allows you to use the Shodan search engine via the command line. For extended use, you'll need an API key.
And for those of you with an insufficiency, a handful of readings for the evening:
https://sekurak.pl/censys-nowa-wyszukiwarka-do-zadan-specjalnych/
https://www.safetydetectives.com/blog/what-is-shodan-and-how-to-use-it-most-effectively/
If our article hasn't convinced you of Shodan, take a look at Censys and ZoomEye.
Sources
https://help.shodan.io/
https://www.safetydetectives.com/blog/what-is-shodan-and-how-to-use-it-most-effectively/
https://beta.shodan.io/search/examples
Top comments (0)