what is shodan a full presentation pptx

This presentation talk about :


What is shodan.io

Banner

Data base / Meta data


How does it work ?

Shodan techniques and strategies to gather information

Default Search includes

Shodan search filters

Examples

Shutting the door on Shodan

1. Shodan Tutorial

2. Outline What is shodan.io Banner Data base / Meta data How does it work ? Shodan techniques and strategies to gather information Default Search includes Shodan search filters Examples Shutting the door on Shodan

3. What is shodan Shodan= Sentient Hyper =Optimized Data Access Network Shodan is a search engine for Internet like google so what is special about S hodan ? To understand more about Shodan we would do comparison between the most famous search engine google and Shodan in four points : Scope of Data Collection: Type of Data Indexed: Purpose and Use Cases: Audience and Access:

4. What is shodan Scope of Data Collection: Google: Google primarily crawls and indexes content from the World Wide Web, which consists of publicly accessible websites and web pages. It focuses on indexing HTML, CSS, JavaScript, and other web content. Shodan: Shodan, on the other hand, focuses on indexing all devices connected to the Internet, including but not limited to web servers. It scans and indexes a wide range of devices such as webcams, routers, printers, industrial control systems, IoT devices, and more. Shodan aims to provide a comprehensive view of the entire Internet-connected infrastructure, not just websites.

5. What is shodan 2. Type of Data Indexed: Google: Google indexes content primarily intended for human consumption, such as text, images, videos, and documents. It prioritizes indexing content that is relevant, authoritative, and user-friendly. Shodan: Shodan indexes technical data and metadata associated with Internet-connected devices. This includes device banners, service information, protocol details, and sometimes even unsecured data streams. Shodan focuses more on technical information about devices rather than user-friendly content.

6. What is shodan 4. Purpose and Use Cases: Google: Google's main purpose is to help users find and access information on the web quickly and easily. Shodan: Shodan is primarily used for security research, network monitoring, vulnerability assessment, and IoT device management. It helps security professionals and researchers identify exposed devices, misconfigurations, and potential security threats across the Interne

7. What is shodan 4. Audience and Access: Google: Google's audience consists of general internet users seeking information, businesses looking to improve their online presence, advertisers, researchers, and more. Google's search engine is publicly accessible and widely used. Shodan: Shodan's audience primarily includes cybersecurity professionals, researchers, network administrators, and IoT device manufacturers. Access to Shodan's data is typically restricted and may require registration or subscription, especially for advanced features and API access.

8. What is Banner Banners are an essential factor in shodan work informational messages sent by network services that the client would like to know before interacting with the server For example, following is a FTP banner: . This tells us a potential name of the server (kcg.cz), the type of FTP server (Solaris ftpd ) and its version (6.00LS) For HTTP a banner looks like:

9. Database /Meta data Database Shodane database are updated 24 hours a day 7 days a week. So ,it means anytime you search , you are retrieving the lastest results on the internet . Meta data In addition to Banners , shodan crawlers also look for the meta data of an IP address and show results from the past month .Meta Data are the information collected from an IP address like its Physical location , Geo Coordinated .

10. How shodan worke Whenever shodan gets a query from a user ,it generates randomized IPV4 addresses and randrom Ports => retrieve Banners -> Banner Analysis / process / logic -> Result Shodan uses 0R operator by default for filtering queries . If you want to search for a word that include spaces or want combine two different filters ,you can use + . It will work as AND operator.

11. Shodan techniques and strategies to gather information Banner Grabbing: banner grabbing involves connecting to devices on the Internet and retrieving informational messages (banners) sent by network services Port Scanning : Shodan performs port scans to identify open ports on devices, Port scanning is essential for mapping out the Internet's infrastructure and identifying accessible services. Protocol Analysis : Shodan analyzes various network protocols to gather data about devices and services. Collaborative Contributions: Shodan benefits from contributions and submissions from its user community. Crawling and Indexing : Similar to web search engines, Shodan may crawl publicly accessible web pages, forums, and online resources to gather information about devices, software, and vulnerabilities. Passive Listening: Shodan may passively listen to network traffic to identify patterns, trends, and anomalies. This technique can provide insights into emerging threats, changes in the Internet's landscape, and new device deployments.

12. Default Search includes The Shodan documentation doesn’t disclose exactly what protocol data is used in the default search , but empirical analysis indicates that it includes at least the following : HTTP header information HTTPS header and certificate information Several gaming server banners FTP banners NetBios server key data SSH header and server key data Telnet banner SMTP banner NTP banner SIP/VoIP banner DNS server configuration settings And more

13. Shodan search filters Filter Name Description Country Filter results by country code eg:in ,us, FR, DZ geo: “ 28.0339, 1.6596” City Cairo, Algiers Port 21 , 80,25 Server: Microsoft iis Surveillance Cams: NETSurveillance uc -httpd OP “windows- xp ” “windows 10” Host name Google , Microsoft Wifi Password html :” def_wirelesspassword ” IP ip ‘127.0.01’ Country and city : country: “DZ” city:” medea ” nginx The above query will search for the word “ nginx ” in banners retrieved from the IP addresses which are located in medea , algeria . IP filter : Ip:”127.0.0.1” This will look for the banners from IP 127.0.0.1 Example:

14. Shutting the door on Shodan "Shutting the door" on Shodan refers to taking measures to prevent or limit the exposure of devices and services to Shodan's scans and indexing. Here are some common strategies organizations and individuals use to restrict or protect their devices from being indexed by Shodan: Firewall Configuration : Configure firewalls and network security devices to block incoming connections from Shodan's scanning IP addresses. By filtering traffic at the network perimeter, organizations can prevent Shodan from accessing their devices and services. Service Hardening : Implement best practices for securing services and applications running on devices. This includes disabling unnecessary services, changing default passwords, applying security patches and updates regularly, and configuring access controls to restrict unauthorized access. IP Filtering : Use IP whitelisting or blacklisting techniques to control which IP addresses can access devices and services. By whitelisting trusted IP addresses and blocking suspicious or unauthorized ones, organizations can limit exposure to Shodan and other scanning activities.