Footprinting & Reconnaissance · Module 02
Shodan
A search engine for internet-connected devices — see what is exposed online.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Shodan is a search engine that indexes internet-connected devices and services (servers, routers, webcams, ICS, etc.) from banner data gathered by scanning the public internet.
Discover what devices and services are exposed on the internet, including software versions, open ports, and configurations.
External attack-surface discovery, exposure assessment, and OSINT during authorized assessments.
Key features
Stores service banners from internet-wide scans, not on-demand scanning.
Supports filters like country:, port:, org:, product: and net:.
Flags some results with CVEs tied to the detected version.
Offers a command-line tool and API for scripted queries.
Lets you track your own organization's exposed assets over time.
Important commands
shodan init <API-KEY>Configure the Shodan CLI with your API key.
shodan host <ip>Retrieve everything Shodan knows about an IP.
shodan search "<query>"Run a search against the indexed data.
shodan count "<query>"Return how many results match, without listing them.
shodan download <file> "<query>"Save search results locally for offline analysis.
Practical examples
shodan host 8.8.8.8
Purpose Shows open ports, banners and any known vulnerabilities for that IP.
shodan search "nginx country:US"
Purpose Finds internet-facing nginx servers in the US (for scoped recon of your own assets).
shodan count "port:3389"
Purpose Returns how many indexed hosts expose RDP — useful for exposure trends.
Important points
- Passive by design: It queries a pre-built index, so no direct traffic is sent to the target during a lookup.
- Scope discipline: Only act on information about systems you own or are authorized to assess.
- Data freshness: Banners may be outdated since Shodan rescans periodically, not continuously.
- Account limits: Free accounts have limited results and filters; full search needs a paid plan.
Common use cases
Identify your organization's internet-exposed assets and misconfigurations.
Early-stage OSINT during a scoped penetration test.
Study trends in exposed services across regions or industries.
Get alerted when new, unexpected assets appear online.
This tool is taught in Module 02
Read the full written notes, with diagrams, defense and detection.