Aaron Jones: Introduction to Shodan

Aaron Jones presented "Introduction To Shodan" at the Phoenix Linux Users Group's security meeting on July 19th 2018

Introduction To Shodan is designed to provide an overview of the search engine for finding devices connected to the internet. Shodan is a security researcher tool that works by scanning the entire internet, locating and parsing banners, and then returning this information to the user. Shodan is an excellent tool to familiarize yourself with if you do not have the infrastructure or tools necessary to run masscan yourself. Shodan is useful in the target selection phase of an operation.

Follow along at:

About Aaron:
Aaron is an experienced Linux user with several years of teaching experience. He works in the industry as a software developer while also providing consultancy on cyber security related topics. His discussions are AZ Post certified for training credit for law enforcement and he prides himself on providing quality educational material that is relevant and topical. He has a Masters Degree in Intelligence Analysis with a focus in Cyber Security, is a life long learner, and prides himself on staying up to date with the ever changing field of cyber security.

[SuperAmir]

I was for 2 hours out of the universe and don't wanted the video to rich the end. Thank you so much I really enjoyed the concept and the way of explaining it.

[crazymonkeyVII]

This has to be the best and most insightful introduction I've ever seen. It feels like a never-ending video resulting in me going every other minute :D

[GiveMeAReason]

I really like this guy! Very informative without coming across as cocky whatsoever! I'm EXTREMELY new to this stuff but it probably would have been cool to sit in this class and hear him speak in person!

[MrCleverOnion]

I fell asleep to this and dreamt I was in an auditorium with my old high school classmates sitting through a "lecture" and they were distracting me from something I found really interesting. It was supposed to be a seminar but a student in the crowd took over and ran the show lol

[SCP-upot]

I searched for shodan from system shock, but then this came up, i have no idea what is this but im here to stay

[TraceursMonkey]

I saw someone makeing a python script using shodan and I wanted more information about how it works . Thank you for posting this very informative video !

[sindhbad]

Excellent Video, I was able to follow along on split screen and do the examples!
Please post more, very informative and educational!!!
Thank you for posting!

[thgltch]

44:36 just to add an update here, he states that tw telecom holding and cox communication are running the xp machines. This may not be accurate; in some cases the ISP is provided as the business name. This means they are using cox or TWT as their ISP. It could be CG NAT, so from scanners it appears to be COX or TWT. This is common with ipv4 since ISP's may only have so many ip's to give out.

[nonokodog]

I work in ICS and many older and come modern devices, ONLY have telnet for serial communications. Then you have to lock down the network / subnets. Typically some outside service tests it periodically.

[cghoselle]

My teacher brushed over this. I forgot about it to be honest.

[jaredmeit]

I want to know how these 12 year olds are getting access to S7 networks.

[maasimara]

I followed along but could not get "postal:" to work kept saying "No results found", no matter the zip.

[Kakkarot]

seems like a cool dude and he's very informative

[leguile]

Some years ago I quit hacking and security, doesn't matter the reason, and I was miserable. A few weeks ago I decided to start checking out security again and THIS video helped me really decide to go full steam ahead to get myself back to it. Thanks Aaron, you have no idea how much you helped me.
I was wondering if the command line Shodan version is better than the web version, it seems to me that the web version has many pros.
Hope someone can answer this.
GRATE video.

[geroffmilan]

To realise the potency of Shodan at a large scale, notes alone can be painful.
If you can develop, go for graphing: like how Bloodhound AD works - ingest tables of info, then draw relationships, query with Cypher.

[geroffmilan]

Around 49:10 8443 & 8080 are much more commonly used by HTTP proxies, forward or reverse.
Edit: also 8081 and 8082.
See Forcepoint/WebSense, BlueCoat, but also sometimes just Apache.

[mylostone]

Could you provide a link to the doc you were referencing that has links to all the pdf's and stuff?

[jonnysokkoatduckdotcom]

so before using shodan should you be using the tor browser first then log in to use shodan?

[abandonedmuse]

Hi question, can you download shodan and use it for a closed network? Like an Intranet? Or an offline network? Something that would give you a way to see all local networks running...if not what would you recommend? I have a malware running which I am trying to access but they obfuscate with through the local network. Every time I think I found an ip it’s always local. 😠
Great talk by the way!!

[adityajoshi]

Amazing video.. I understood most of it even though I just have a a bit of routing and switching knowledge and some basic linux command line stuff. However my main question is what if I just use a dynamic IP on my router and host a website off that using dynamic dns( from what I know that the ddclient will update whatever dynamic IP I will be using to connect to the internet). Will those potentially unsecure devices show up on shodan? Let's say I open a http port on my routers internet facing side that maps to a server on my internal network. Would that show up? Or does this only work for static ip's? From what I understand an IP assigned to a regular broadband user with a dynamic IP is actually shared by multiple users via NAT and there may be multiple levels of NAT. So my guess is those devices wouldn't show up on shodan. Would that be a safer option instead of getting a public IP and running a webcam or other IOT devices that would show up on shodan?