Shodan and Device Search Engines

Shodan (and its cousins Censys, FOFA, ZoomEye) constantly scan the whole Internet and store which services respond on each IP: banners, ports, certificates, versions, technologies. Instead of scanning the target yourself (noisy, active), you query an already-built database (passive). It’s one of the most powerful recon sources: you find exposed infrastructure, forgotten panels, cameras, open databases, and the real IP behind a CDN.

What they index

Service banners on all ports, TLS certificates, HTTP headers, favicon hashes, geolocation, owning organization/ASN, and sometimes screenshots (VNC/RDP). All searchable with filters.

Key Shodan filters

hostname:target.com         by host name
ssl:target.com / ssl.cert.subject.cn:target.com   by certificate
org:"Target Inc"            by organization
net:1.2.3.0/24              by IP range
port:445                    by port
product:nginx / version:    by software/version
http.title:"Login"          by web title
http.favicon.hash:-123456   by favicon hash (finds the same org's infra!)
country: / city:            geolocation
vuln:CVE-2021-44228         by known vulnerability (requires a plan)

They combine: org:"Target" port:3389 → all the org’s exposed RDP.

Recon use cases

# find the real IP behind Cloudflare (by certificate or favicon)
ssl:target.com -org:"Cloudflare"
http.favicon.hash:<real_site_hash>
# an org's exposed infrastructure
org:"Target Inc"  -> ports, services, versions
# dangerous open services
"MongoDB Server Information" port:27017   databases without auth
port:445 os:Windows   exposed SMB
screenshot.label:rdp  remote desktops

Tools and API

shodan init <APIKEY> ; shodan search 'org:"Target"' ; shodan host 1.2.3.4
# Censys (very strong on certificates and hosts)
censys search 'services.tls.certificates.leaf_data.subject.common_name: target.com'
# FOFA, ZoomEye, BinaryEdge, GreyNoise (scan "noise" context)

Favicon hashing: correlate infrastructure

The favicon hash identifies applications and lets you find all infra using the same one (including the real IP behind a CDN, or forgotten instances):

# compute the hash and search it in Shodan
http.favicon.hash:116323821

For the defense

Reduce your Shodan exposure: don’t expose unnecessary services to the Internet, close externally-facing panels/databases, use certificates that don’t reveal internal hostnames, protect the origin behind the CDN (firewall accepting only the CDN — see WAF Bypass), and periodically monitor what appears about your org in Shodan/Censys.

Testing checklist

Search by org:, ssl:, hostname: for the target’s infra
Locate the real IP behind the CDN (certificate/favicon)
Exposed ports/services and their versions
Open databases or panels without auth
Favicon hashing to correlate infrastructure
Cross-reference vuln: known CVEs
Repeat on Censys/FOFA for coverage
Everything exported to your target inventory