Technology and tools
What is Shodan?
A search engine for internet-connected devices and services, showing open ports, banners, software versions and certificates by IP.
Shodan scans the internet continuously and indexes what it finds on each IP address: open ports, service banners, software versions, TLS certificates and screenshots of some interfaces. Users search it with filters such as port:, product:, org: and ssl:.
Defenders use it to see their organisation's exposure the way an attacker would. Researchers use it to count vulnerable devices after a disclosure and to find attacker infrastructure that shares a distinctive banner or certificate.