Shodan has earned its reputation as the search engine for internet-connected devices, indexing everything from web servers and industrial control systems to exposed webcams and misconfigured databases. For security teams, it is one of the fastest ways to see what an organization actually exposes to the internet, often revealing assets that internal inventories missed entirely. This walkthrough covers how to use Shodan effectively for asset discovery and exposure assessment, along with the query syntax and workflows that turn raw search results into actionable findings. External attack surface reviews at Sagefox Cybersecurity regularly start with exactly this kind of Shodan-driven reconnaissance before deeper testing begins.
What Shodan Actually Indexes and Why It Matters
Unlike a traditional search engine that indexes web page content, Shodan indexes banners, service responses, and metadata returned by internet-facing devices when they respond to connection attempts. This includes HTTP headers, SSH banners, SCADA protocol responses, database service banners, and TLS certificate details. The result is a searchable database of what is actually running on the public internet, not just what organizations intend to expose.
Why This Matters for Security Teams
- Shadow IT and forgotten assets often show up on Shodan long before internal asset inventories catch them
- Misconfigured cloud instances frequently get indexed within hours of going live
- Third-party and vendor-managed systems connected to your infrastructure may expose more than expected
- Attackers use Shodan for reconnaissance just as often as defenders do, making it essential to see your own exposure the same way
Getting Started with Shodan
Setting Up API Access
While the web interface works for casual searching, serious assessment work benefits from API access, which allows scripted queries and integration into broader reconnaissance workflows.
pip install shodan
shodan init YOUR_API_KEYConfirm the setup and check your account's query credit balance:
shodan infoRunning a Basic Search from the Command Line
The Shodan CLI supports the same search syntax as the web interface, making it easy to script repeatable queries.
shodan search "apache" --limit 20For a quick count of results without listing them all, useful when scoping how large a query's result set is before pulling full details:
shodan count "apache"Core Search Syntax for Targeted Discovery
Searching by Organization or Network Range
The most immediately useful query for a security team is searching by your own organization name or IP range to see what Shodan has indexed about your environment.
shodan search "org:\"Example Corp\""Searching a specific CIDR range works the same way and is often more precise than an organization name search, which can miss assets registered under different naming conventions:
shodan search "net:203.0.113.0/24"Searching by Port and Service
Combining a search with a specific port narrows results to a particular service type, which is useful when auditing for specific exposure categories like remote access services.
shodan search "port:3389 net:203.0.113.0/24"This example specifically targets RDP exposure within a defined network range, a common finding in external assessments where remote access should never be internet-facing without additional controls like VPN or MFA in front of it.
Searching by Product and Version
Shodan's banner grabbing often identifies specific software and version numbers, which makes it possible to search for known vulnerable versions directly.
shodan search "product:\"Apache httpd\" version:\"2.4.49\""Apache 2.4.49 specifically had a well-documented path traversal issue, making a query like this a fast way to identify potentially unpatched systems across a large search space, either your own or as part of understanding what attackers can trivially find.
Searching for Exposed Databases
Misconfigured databases exposed directly to the internet remain a consistent finding across external assessments. Shodan indexes these based on default ports and service banners.
shodan search "product:MongoDB port:27017"
shodan search "product:\"Elasticsearch\" port:9200"Databases returned by these searches often have no authentication configured at all, meaning the data is fully accessible to anyone who finds the listing.
Using Shodan Filters for Precision
Filtering by Country, City, or ASN
Geographic and network ownership filters help narrow results when investigating exposure tied to a specific data center or region.
shodan search "asn:AS13335 port:22"
shodan search "country:US city:\"Ashburn\" port:443"ASN-based searches are particularly useful when investigating exposure within a specific hosting provider or cloud region tied to known infrastructure.
Filtering by SSL and Certificate Details
Certificate metadata often reveals infrastructure relationships that are not obvious from IP ranges alone, such as internal hostnames leaking through certificate subject alternative names.
shodan search "ssl.cert.subject.cn:\"internal.example.com\""This kind of query frequently surfaces internal naming conventions or infrastructure never meant to be discoverable, since certificates issued for internal systems sometimes still get indexed if the service briefly touches the public internet.
Combining Multiple Filters for Precise Exposure Hunting
Real assessment queries usually combine several filters at once to narrow in on specific risk categories.
shodan search "product:\"OpenSSH\" port:22 country:US org:\"Example Corp\""Using Shodan for Industrial Control System Exposure
Why ICS and SCADA Exposure Is a Persistent Concern
Industrial control systems were historically designed for isolated networks, and many still carry that assumption despite increasingly being connected to corporate networks or the internet for remote monitoring. Shodan indexes common ICS protocols directly.
shodan search "port:502 product:Modbus"
shodan search "tag:ics country:US"Modbus and similar ICS protocols frequently have no authentication mechanism at all, meaning any exposed instance is fully accessible to whoever finds it, which makes this category of finding among the highest severity results a Shodan-based exposure review can surface.
Using Shodan Maps for Visual Exposure Assessment
The Shodan Maps interface plots search results geographically, which is useful when presenting exposure findings to stakeholders who benefit from a visual rather than a raw list of IP addresses and ports.
Automating Shodan Monitoring for Ongoing Visibility
Setting Up Alerts for New Exposures
Rather than running one-off searches, Shodan Monitor allows continuous tracking of a defined IP range, flagging new services or changes as they appear.
shodan alert create "Company Range Monitor" 203.0.113.0/24
shodan alert triggersThis turns Shodan from a point-in-time lookup into an ongoing detection mechanism for shadow IT and configuration drift, catching new exposure within hours of it appearing rather than during the next scheduled assessment months later.
Scripting Regular Exposure Reports
For teams that want scheduled reporting without manual query runs, a simple script combining the Shodan Python library with a cron job produces a lightweight recurring exposure report.
import shodan
api = shodan.Shodan("YOUR_API_KEY")
results = api.search("net:203.0.113.0/24")
for result in results['matches']:
print(f"{result['ip_str']}:{result['port']} - {result.get('product', 'unknown')}")Interpreting Shodan Results Without Overreacting
Not Every Result Is a Finding
A device appearing on Shodan does not automatically mean it is vulnerable or misconfigured. Some exposure is intentional and necessary, such as a public-facing web server or mail gateway. The goal of a Shodan review is distinguishing between intentional, properly secured exposure and unintentional or misconfigured exposure that increases risk without providing business value.
Validating Findings Before Reporting Them
Banner information can be outdated or spoofed, and services sometimes change between when Shodan last indexed them and when you review the results. Before including a Shodan finding in a report, a quick manual check against the live host confirms the exposure is current and accurately represented.
nc -zv 203.0.113.15 27017This kind of lightweight verification step is standard practice before any Shodan-derived finding makes it into a client deliverable, and it is a step assessors at Sagefox Cybersecurity apply consistently to keep exposure findings accurate and defensible.
Common Mistakes When Using Shodan for Security Assessments
Treating Shodan as a Complete Attack Surface Picture
Shodan only indexes what it has scanned and when. Assets provisioned recently or scanned infrequently may not appear yet, so Shodan results should complement, not replace, active scanning and asset discovery conducted directly against known ranges.
Ignoring Historical Data
Shodan retains historical banner data, which can reveal how long a misconfiguration has been present. A database exposed with no authentication for eight months tells a very different risk story than one exposed for eight hours, and that context matters for prioritization.
Overlooking Third-Party and Vendor Exposure
Organizations often focus Shodan reviews solely on their own IP ranges while ignoring vendor-managed systems or cloud assets that may not fall under a clean CIDR block. A thorough review includes searching by organization name, known hostnames, and certificate details in addition to IP ranges.
Key Takeaways
Shodan gives security teams a direct view into what is actually reachable from the internet, often surfacing exposure that internal documentation and asset inventories never captured. The value comes from combining precise search syntax, ongoing monitoring, and careful validation before treating any result as a confirmed finding. Used consistently, it becomes less of a one-time discovery tool and more of a continuous check against configuration drift and shadow IT.
If your organization wants a thorough external exposure review that goes beyond a single Shodan search, including validation and prioritized remediation guidance, the team at Sagefox Cybersecurity can help identify what is actually exposed and what to fix first.
