# Shodan Search Techniques
Shodan is a search engine for internet-connected devices that indexes service banners, certificates, and metadata from billions of IP addresses worldwide. Unlike traditional search engines that crawl websites, Shodan scans the internet's infrastructure layer, cataloging everything from web servers and databases to industrial control systems and IoT devices. It exists because the modern internet is vastly more complex than the web browsers see: every organization runs hundreds or thousands of services across cloud platforms, on-premises infrastructure, and shadow IT deployments that never appear in asset inventories but remain accessible to anyone who knows how to look.
Shodan search techniques enable security professionals to discover exposed systems, identify vulnerable services, and map an organization's internet-facing infrastructure without sending a single packet to the target. This passive reconnaissance capability makes Shodan both a critical defensive tool for understanding your own attack surface and a primary weapon for attackers conducting target research. The platform indexes approximately 500 million internet-connected devices daily, maintaining historical data that reveals how infrastructure changes over time.
Shodan fits into the broader ecosystem of open-source intelligence (OSINT) tools, but unlike social media monitoring or website analysis, Shodan operates at the network infrastructure layer. It answers fundamental questions about internet-facing exposure: What services is an organization running? Which versions are they using? What certificates are they presenting? Which systems lack authentication? These questions matter because every exposed service represents a potential entry point, and most organizations have no comprehensive view of their own internet-facing infrastructure.
Shodan continuously scans the internet using a distributed network of scanners that probe every public IPv4 address across all 65,535 TCP ports and common UDP ports. When Shodan connects to a service, it captures the banner information that the service presents: HTTP headers, SSH version strings, database greeting messages, certificate details, and any other metadata the service volunteers. This banner grabbing happens without authentication attempts or exploitation, making it legal passive reconnaissance.
The core of Shodan's power lies in its query language, which enables precise filtering of the massive dataset. The org: filter searches by organization name from WHOIS registration data, making it simple to find all internet-facing assets for a specific company. For example, org:"Acme Corporation" returns every service Shodan has indexed that belongs to that organization based on IP registration records. The net: filter searches within specific IP address ranges, useful when you know the target network blocks. A query like net:192.168.1.0/24 would search that subnet, though most private IP ranges are not indexed by Shodan since they are not internet-routable.
Port-specific searches use the port: filter to target particular services. Searching port:22 finds all SSH servers, while port:3389 identifies Remote Desktop Protocol services. The product: filter searches for specific software implementations, enabling queries like product:"Apache httpd" to find Apache web servers or product:"MongoDB" to locate MongoDB instances. Version information often appears in banners, allowing defenders to identify outdated software and attackers to target known vulnerable versions.
The vuln: filter represents one of Shodan's most powerful features, enabling searches for specific CVE numbers. A query like vuln:CVE-2017-0144 (the EternalBlue SMB vulnerability) returns systems still vulnerable to that specific exploit. This capability makes Shodan invaluable for both red teams looking for easy targets and blue teams trying to identify vulnerable systems in their environment.
SSL certificate searches use the ssl.cert.subject.cn: filter to find systems presenting certificates for specific domains. This technique reveals not just web servers but any service using SSL/TLS with certificates, including mail servers, VPN endpoints, and API services. Certificate transparency logs ensure that even internal certificates often appear in Shodan if the services are internet-accessible.
Advanced Shodan operators combine multiple filters to create highly specific queries. Searching for title:"login" port:80,443 -ssl finds web login pages that are not using SSL encryption. The query product:"MongoDB" port:27017 -auth identifies MongoDB databases without authentication enabled. Industrial control system searches might use product:"Siemens" port:102 to find Siemens PLCs exposed to the internet.
Geographic and network filters add another dimension. Country:US restricts results to IP addresses registered in the United States, while city:"New York" narrows results to specific metropolitan areas. ASN (Autonomous System Number) searches target specific internet service providers or hosting companies.
Shodan Monitor provides continuous tracking of organizational assets, alerting when new services appear, configurations change, or previously unknown systems come online. This monitoring capability is essential for organizations with dynamic cloud infrastructure or development teams that regularly deploy new services.
The platform maintains historical data, showing how services change over time. This temporal analysis reveals patterns: when organizations patch systems, when new services come online, or when misconfigurations appear and disappear. Historical trending helps distinguish between stable infrastructure and development environments that may cycle frequently.
Shodan's API enables programmatic access to both search results and the scanning infrastructure, allowing security teams to integrate Shodan data into their own tools and workflows. The API supports bulk queries, automated monitoring, and custom data analysis that would be impractical through the web interface.
Shodan reveals the internet-facing attack surface that organizations often underestimate by orders of magnitude. Most asset management systems capture officially deployed production services but miss shadow IT deployments, forgotten development servers, cloud resources spun up for temporary projects, and the expanding universe of IoT devices that connect automatically to corporate networks. These gaps between official asset inventories and actual internet exposure create blind spots that attackers exploit systematically.
Shadow IT represents a particularly significant exposure category. When business units deploy cloud services directly, configure VPN endpoints for remote work, or connect building management systems to corporate networks, these services often receive minimal security review. They may lack enterprise authentication integration, skip security hardening procedures, or use default credentials. Shodan discovers these services regardless of whether IT teams know they exist, creating an asymmetric information advantage for attackers.
Cloud misconfigurations appear in Shodan results with alarming frequency. Development teams launch EC2 instances for testing, configure security groups permissively for troubleshooting, or expose databases temporarily for data migration projects. When these temporary configurations become permanent or when teams forget to clean up development infrastructure, sensitive services remain internet-accessible. Shodan indexes these exposed services within hours of deployment, often before the owning organizations realize the exposure exists.
The financial consequences of Shodan-discoverable exposures are substantial. Ransomware operators routinely use Shodan to identify vulnerable Remote Desktop Protocol implementations, unpatched VPN appliances, and exposed backup systems. The 2020 attacks against Pulse Secure VPN appliances began with Shodan searches for specific product signatures. Many of the largest healthcare breaches in recent years started with attackers using Shodan to identify exposed systems running vulnerable software versions.
Compliance auditors increasingly use Shodan to verify that organizations understand their own internet-facing exposure. Payment card industry assessments may include Shodan searches to identify card processing systems that should not be internet-accessible. Healthcare auditors use similar techniques to find medical devices or patient data systems exposed beyond approved network boundaries.
The intelligence value of Shodan extends beyond vulnerability identification to competitive intelligence and nation-state reconnaissance. Understanding an organization's technology stack, geographic distribution, and infrastructure scale provides significant advantages for both commercial competitors and adversarial actors planning long-term compromise campaigns.
Perhaps most importantly, Shodan demonstrates that internet exposure is not a binary concept. Traditional network security models assume clear perimeter boundaries, but cloud deployment, remote work, and IoT adoption create exposure surfaces that change daily. Organizations that think in terms of fixed network perimeters systematically underestimate their actual attack surface because they are measuring the wrong things.
CDA integrates Shodan into both the Vulnerability Surface Discovery (VSD) and Threat Intelligence Development (TID) domains as an essential tool for understanding real-world exposure rather than theoretical risk. Our approach differs fundamentally from conventional vulnerability management thinking, which tends to focus on internal scanning of known assets. CDA operators use Shodan to discover what attackers see first, then work backward to understand how those exposures fit into the organization's actual infrastructure.
Within the VSD domain, Shodan serves as the primary tool for external surface enumeration. Rather than starting with internal asset inventories and working outward, VSD methodology begins with Shodan reconnaissance to establish ground truth about internet-facing services. This outside-in approach consistently reveals exposures that internal teams miss: development systems that should have been temporary, cloud resources deployed outside standard change management, and third-party integrations that create unexpected exposure points.
The TID domain uses Shodan for both defensive monitoring and threat actor emulation. TID analysts maintain continuous Shodan monitoring for client organizations, tracking new exposures, configuration changes, and emerging vulnerable services. This intelligence feeds directly into incident response planning and attack surface reduction efforts. Simultaneously, TID teams use Shodan to understand how attackers research targets, providing realistic threat modeling based on actual attacker reconnaissance techniques rather than theoretical attack vectors.
CDA's Continuous Surface Reduction (CSR) methodology treats every Shodan-discoverable service as a reduction target: "Every surface you expose is a surface we eliminate." This approach recognizes that finding exposures is straightforward, but eliminating them requires sustained operational focus. CSR emphasizes remediation velocity over discovery sophistication because attack surface reduction happens only when exposed services actually disappear from Shodan results.
Our methodology diverges from conventional thinking in several key areas. Most organizations treat Shodan searches as periodic assessment activities, but CDA implements continuous monitoring because internet exposure changes constantly. Traditional approaches attempt to categorize Shodan findings by severity or exploitability, but CDA focuses on reduction feasibility because any internet-accessible service can become an attack vector under the right circumstances.
CDA theater missions use Shodan reconnaissance to establish baseline exposure before any other assessment activities. This ensures that red team exercises reflect actual attacker reconnaissance capabilities rather than insider knowledge about target infrastructure. The intelligence gathered through Shodan searches drives subsequent penetration testing priorities and helps clients understand the difference between their perceived exposure and their actual attack surface.
The dual-use nature of Shodan perfectly illustrates CDA's philosophy about security tools: the same techniques that attackers use for target reconnaissance become defensive capabilities when applied systematically to your own infrastructure. Organizations that understand their Shodan footprint can reduce it; organizations that ignore Shodan exposure leave that intelligence advantage to their adversaries.
• Shodan reveals internet-facing infrastructure that internal asset management systems consistently miss, including shadow IT, temporary cloud deployments, and misconfigured services that may not appear in official inventories for months or years.
• Passive reconnaissance through Shodan provides attackers with detailed intelligence about target organizations without triggering any security monitoring, making it a preferred technique for initial target research and infrastructure mapping.
• Continuous Shodan monitoring is essential because internet exposure changes daily through cloud deployments, configuration changes, and development activities that may bypass standard change management processes.
• The gap between what organizations think they expose to the internet and what Shodan actually discovers typically represents the highest-risk attack surface because these services receive minimal security attention.
• Effective attack surface reduction requires treating Shodan as both a discovery tool and a measurement system: exposures are not reduced until they disappear from Shodan search results.
• External Attack Surface Management • Passive Reconnaissance Techniques • Cloud Security Posture Management • Industrial Control System Security • Continuous Surface Reduction (CSR): Every Surface Eliminated
• National Institute of Standards and Technology. "Guide to Industrial Control Systems (ICS) Security." NIST Special Publication 800-82 Rev. 2, May 2015.
• MITRE ATT&CK Framework. "Active Scanning: Vulnerability Scanning." Technique T1595.002. https://attack.mitre.org/techniques/T1595/002/
• Center for Internet Security. "CIS Controls Version 8: Control 1 - Inventory and Control of Enterprise Assets." April 2021.
• Industrial Control Systems Cyber Emergency Response Team. "ICS-CERT Year in Review 2020." Cybersecurity and Infrastructure Security Agency, 2021.