Shodan Guide
A comprehensive guide to mastering Shodan for OSINT investigations
Core Concepts
Shodan works by continuously scanning the entire internet for devices with open ports. When it finds one, it performs a "banner grab" to collect information about the service running on that port. This data is indexed and made searchable using filters like `country`, `port`, `os`, and `product`.
Installation
Create a free account on the Shodan website for basic search functionality. For CLI access: `pip install shodan` then initialize with your API key: `shodan init YOUR_API_KEY`
Step-by-Step Usage Guide
Performing a Basic Search
The main search bar can be used for simple keyword queries. For example, searching for `apache` will return devices with "apache" in their banner information.
Using Search Filters
The real power of Shodan lies in its filters using `filter:value` syntax:
• `port:21` - Finds devices with FTP port 21 open • `country:US` - Limits results to the United States • `city:"New York"` - Narrows to a specific city • `os:"Windows XP"` - Finds devices running Windows XP • `product:"Microsoft-IIS"` - Searches for IIS web servers • `net:192.0.2.0/24` - Searches within a specific IP range
Advanced Queries
Combine multiple filters for highly specific searches:
**Find vulnerable webcams:** `webcamxp country:FR`
**Find exposed databases:** `product:"MongoDB" port:"27017" -authentication`
**Find Industrial Control Systems:** `product:"OPC" port:"4840"`
Command-Line Interface
Use the CLI for automation and scripting:
**Search:** `shodan search --fields ip_str,port,org 'apache country:DE'`
**Host Information:** `shodan host 8.8.8.8`
**Count Results:** `shodan count 'product:"nginx"'`
Practical Tips
Start with broad searches and narrow down using filters. Use the CLI for repeatable searches and automation. Check the Shodan Explore page for pre-made popular queries.
Legal Considerations
Shodan itself is a passive reconnaissance tool and is legal to use. However, using the information it provides to access, interact with, or exploit a system without authorization is illegal.