Shodan.io

3 min readArticle

Shodan is a search engine for internet-connected devices. Unlike Google which indexes web content, Shodan indexes banners and service information from open ports across the entire internet. It continuously scans the internet and stores what it finds — HTTP headers, SSH banners, TLS certificates, FTP banners, Telnet, RTSP streams, industrial control systems, and thousands more protocols.

Why It's Powerful

You can find:

Internet-exposed industrial control systems (SCADA, PLCs)
Default-credential cameras, routers, NAS devices
Exposed databases (Elasticsearch, MongoDB, Redis)
Server software versions (often outdated/vulnerable)
SSL certificates (useful for finding all domains/IPs of an org)
VNC servers with no authentication
Printers, smart TVs, baby monitors

Access

Web UI: https://shodan.io (free account = limited results)
API: Paid — much more powerful
CLI: shodan command-line tool

bash

# Install CLI
pip install shodan

# Initialize with API key
shodan init YOUR_API_KEY

# Quick search
shodan search "nginx"
shodan search "apache 2.4.49"

Search Operators

shell

# Basic search
shodan search "term"

# By country
country:US
country:CN

# By port
port:22
port:3389

# By city/org
city:"New York"
org:"Google"
org:"Target Company Inc"

# By product/service
product:"Apache httpd"
product:"OpenSSH"

# By operating system
os:"Windows Server 2012"

# By hostname
hostname:"target.com"

# By certificate CN (Common Name)
ssl.cert.subject.cn:"*.target.com"

# Combine
org:"Company" port:22 country:US

Useful Searches (Security Context)

bash

# Find exposed RDP servers (Windows Remote Desktop)
shodan search "port:3389 has_screenshot:true"

# Exposed Elasticsearch databases (no auth)
shodan search 'port:9200 product:Elastic json'

# Default credential cameras
shodan search "GoAhead-Webs"
shodan search "netcam"

# Exposed MongoDB
shodan search "product:MongoDB port:27017"

# Industrial Control Systems
shodan search "Siemens" port:102

# Webcams
shodan search "server: SQ-WEBCAM"

# VNC no auth
shodan search "authentication disabled port:5900"

# Redis with no auth
shodan search "product:Redis port:6379"

Target-Specific OSINT

bash

# Find all IPs belonging to an org
shodan search "org:\"Target Company\""

# Find via ASN number
shodan search "asn:AS12345"

# Find via IP range
shodan search "net:192.168.0.0/24"

# Via domain certificate
shodan search "ssl.cert.subject.cn:target.com"

# Find all their servers with specific service
shodan search "org:\"Target Corp\" port:443"

API / CLI Usage

bash

# Search and get JSON output
shodan search --fields ip_str,port,product "org:\"target\""

# Get info about a specific IP
shodan host 8.8.8.8

# Count results
shodan count "apache"

# Download results
shodan download results.json.gz "org:\"Company\""
shodan parse results.json.gz

# My own IP's exposure
shodan myip

Python API Example

python

import shodan

api = shodan.Shodan("YOUR_API_KEY")

# Search
results = api.search("org:\"Target Company\" port:443")
print(f"Results: {results['total']}")

for result in results['matches']:
    print(f"IP: {result['ip_str']}")
    print(f"Port: {result['port']}")
    print(f"Product: {result.get('product', 'unknown')}")
    print(f"Version: {result.get('version', 'unknown')}")
    print()

# Get host details
host = api.host("8.8.8.8")
print(host['org'])
for banner in host['data']:
    print(f"Port {banner['port']}: {banner.get('product', '')}")

Shodan Alerts (Monitor for Changes)

bash

# Create alert for your IP range
shodan alert create "MyNetwork" 192.168.1.0/24

# List alerts
shodan alert list

# Get triggered alerts
shodan alert info <alert-id>

Shodan.io

Why It's Powerful

Access

Search Operators

Useful Searches (Security Context)

Target-Specific OSINT

API / CLI Usage

Python API Example

Shodan Alerts (Monitor for Changes)

See Also