Shodan Cheat Sheet for Penetration Testing

Shodan Cheat Sheet for Penetration Testing - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: Shodan Cheat Sheet for Penetration Testing (/showthread.php?tid=6278262)

Shodan Cheat Sheet for Penetration Testing - #AfterDark - Aug 21, 2024

Before I start nmap and light up my targets firewall like a Christmas tree, I tend to go with the route of passive-recon. Here is a tool I often use.

Shodan is a search engine for Internet-connected devices. It can be used to discover which of your devices are connected to the Internet, where they are located, and who is using them.

Also on a side note: If you attend a CyberSecurity related college you can get a student acct for free with access to the API.

Website: https://shodan.io/

Here’s how to use Shodan for penetration testing:

Basic Commands

Search for devices using a simple query

Code 
shodan search apache

Count the number of results for a query

Code 
shodan count microsoft iis 6.0

Searching by Filters

Use filters to refine your searches:

Code 
shodan search city:"Las Vegas" apache - Country -

shodan search country:"US" camera - Geo (latitude/longitude) - 

shodan search geo:"50.3,8.25" - Hostname - 

shodan search hostname:"example.com" - Net (network range) - 

shodan search net:192.168.0.0/24 - OS (operating system) - 

shodan search os:"windows 7" - Port - shodan search port:80

Advanced Search Techniques

Combine filters

Code 
shodan search country:"DE" port:21 "anonymous ftp"

Search for vulnerabilities

Code 
shodan search vuln:CVE-2024-36840

Using Shodan to Monitor Specific Systems or Assets

Set up alerts for specific terms

Code
shodan alert create "Name of Alert" "port:22 country:US"

List all your created alerts

Code
shodan alert list

Remove an alert

Code
shodan alert remove [ALERT ID]

Command-line Interface (CLI) Features

Download search results

Code
shodan download myresults apache

View downloaded data

Code
shodan parse --fields ip_str,port,org,hostnames myresults.json.gz

Generate a report from downloaded data

Code
shodan stats --facets port:top10 myresults.json.gz

Reconnaissance on Companies for Bug Bounties

Identify technology footprint

Code
shodan search org:"Example Company"

Find exposed databases

Code
shodan search org:"Example Company" product:"MongoDB"

Locate vulnerable systems

Code
shodan search org:"Example Company" vuln:cve-2022-0001

Monitor for new devices

Code
shodan alert create "New Devices at Example Company" "org:'Example Company'"

This cheat sheet provides a foundation for using Shodan in penetration testing and security assessments, with specific strategies for conducting company-specific reconnaissance for bug bounties. I utilize it quite frequently during my recons. The shodan API is prty neat too and I would recomend checking that out as well.

RE: Shodan Cheat Sheet for Penetration Testing - ham_flavred_licorice - Sep 20, 2024

New to this but def gonna check this out. Thank you

RE: Shodan Cheat Sheet for Penetration Testing - utk_1310 - Oct 28, 2024

Thank You! Very helpful resource.

RE: Shodan Cheat Sheet for Penetration Testing - Big Dong - Nov 2, 2024

Thank you for sharing - this is really great information!

RE: Shodan Cheat Sheet for Penetration Testing - jellyhat - Nov 4, 2024

great share, shodan is very handy if you know how to use it, thanks and waiting for next part ;)

RE: Shodan Cheat Sheet for Penetration Testing - m0narch - Nov 10, 2024

Any chance you got one for FOFA?

RE: Shodan Cheat Sheet for Penetration Testing - #AfterDark - Nov 12, 2024

(Nov 10, 2024 12:22 PM)m0narch Wrote: Any chance you got one for FOFA?

Sorry I do not, I ussuly rely on shodan mostly. The api is prty neat.

Havent used FOFA to be honest. any good?

RE: Shodan Cheat Sheet for Penetration Testing - m0narch - Nov 18, 2024

(Nov 12, 2024 08:21 PM)#AfterDark Wrote: Sorry I do not, I ussuly rely on shodan mostly. The api is prty neat.

Havent used FOFA to be honest. any good?

It can filter out honeypot IPs and also has several more options for querying as well as better pricing for users who don't want to spend $$$ - $$$$ per month for whatever they're using the service for. If you need unlimited results a month though... Shodan would be your best bet then. But FOFA is definitely better in terms of cheaper for consumers who don't want to go broke to get results. I think you still get 100,000 results a month the $25/month plan. Though it's not as good as Shodan if you're tryna get 1,000,000+ results a month.