Back to OSINT guides

Shodan - IoT Search Engine

The most powerful search engine to discover and analyze the world's internet infrastructure

500M+
Indexed devices
200+
Countries covered
24/7
Continuous scanning

What is Shodan?

Shodan is the first search engine for the Internet of Things (IoT). Unlike Google, which indexes web content, Shodan scans and indexes the metadata of internet-connected devices: servers, routers, cameras, industrial systems and much more.

Created in 2009 by John Matherly, Shodan has become an essential tool for security researchers, pentesters and CTI analysts. It reveals an organization's internet exposure, helps identify vulnerabilities and monitors the attack surface.

Key points

  • Automated scanning - Shodan scans the internet 24/7 to index exposed services
  • Powerful filters - Search by port, product, country, vulnerability, etc.
  • Full API - Automate your searches with Python, the CLI or REST
  • Historical data - Access the history of infrastructure changes

Core capabilities

Explore the features that make Shodan the go-to tool for internet reconnaissance

Indexed devices
500M+

IoT device search

Discover millions of internet-connected devices in real time

  • Web servers
  • IP cameras
  • Routeurs
  • Industrial systems
Tracked CVEs
2000+

Vulnerability analysis

Identify security flaws and CVEs on exposed infrastructure

  • CVE scanning
  • SSL/TLS analysis
  • Exploits detection
  • Weak configs
Countries covered
200+

Network mapping

Map global network infrastructure and visualize its distribution

  • ASN mapping
  • Geolocation
  • Network ranges
  • ISP analysis
Scans/jour
10M+

Continuous monitoring

Track infrastructure changes in real time with alerts

  • Real-time alerts
  • Network monitoring
  • Change tracking
  • Custom triggers
Protocoles
150+

Industrial intelligence

Analyze SCADA, ICS and critical infrastructure systems

  • SCADA systems
  • ICS protocols
  • PLCs
  • Industrial IoT
Access
Web, CLI, API

Powerful API

Automate your searches with the full REST API

  • REST API
  • Python SDK
  • CLI tools
  • Streaming API

Search filters

Master Shodan filters for precise, efficient searches

Network filters

net
net:192.168.0.0/16

Search by CIDR range

port
port:22

Filter by TCP/UDP port

asn
asn:AS15169

Autonomous system number

isp
isp:"Orange"

Internet service provider

Geographic filters

country
country:FR

ISO country code

city
city:Paris

Specific city

geo
geo:48.8566,2.3522,10

GPS coordinates + radius

region
region:"Ile-de-France"

Administrative region

Technical filters

os
os:Windows

Operating system

product
product:Apache

Software product

version
version:2.4.41

Specific version

hostname
hostname:*.gov

Hostname or pattern

Security filters

vuln
vuln:CVE-2021-44228

CVE vulnerability

ssl
ssl.cert.expired:true

Expired SSL certificate

has_screenshot
has_screenshot:true

Screenshot available

http.title
http.title:"login"

Web page title

OSINT use cases

Practical scenarios for using Shodan in investigations

Infrastructure reconnaissance

Map an organization's exposed infrastructure

1

Define the scope (ASNs, domains, IP ranges)

2

Find all exposed services

3

Map the technologies in use

4

Identify potential entry points

5

Review security configurations

6

Document the findings

7

Produce an exposure report

Vulnerability hunting

Find systems vulnerable to specific CVEs

1

Identify the target CVE (e.g. Log4Shell)

2

Build the right Shodan query

3

Filter by geography or sector

4

Analyze the affected versions

5

Check severity and exploitability

6

Prioritize targets by risk

7

Notify the affected organizations

Attack surface monitoring

Continuously monitor your internet exposure

1

Define the assets to monitor

2

Create monitoring queries

3

Set up automatic alerts

4

Track newly exposed services

5

Detect configuration changes

6

Identify shadow IT

7

Produce periodic reports

Advanced queries

Specialized search examples for different types of infrastructure

Industrial systems

port:502 country:FR

Modbus systems in France

SCADAICSCritical
product:"Siemens" port:102

Siemens S7 PLCs

PLCIndustrial
"Schneider Electric" port:80

Exposed Schneider systems

ICSWeb

Cameras & IoT

title:"webcamXP" has_screenshot:true

Accessible webcams

IoTCameraPublic
product:"Hikvision" country:FR

Hikvision cameras in France

CameraSurveillance
"Server: yawcam" "Mime-Type: text/html"

Yawcam cameras

WebcamStreaming

Databases

product:MongoDB port:27017 -authentication

MongoDB without authentication

DatabaseCriticalNoAuth
port:3306 product:MySQL

Exposed MySQL servers

DatabaseMySQL
product:Elasticsearch port:9200

Elasticsearch instances

DatabaseSearch

Best practices

Essential recommendations for responsible and effective use of Shodan

Do

  • Use it for legitimate reconnaissance
    Only audit your own infrastructure or with authorization
  • Combine several filters
    Refine your searches with port, country, product, etc.
  • Use the API to automate
    Python scripts or the CLI for recurring searches
  • Document your findings
    Export and archive results for your reports
  • Use a VPN
    Protect your IP during sensitive searches
  • Use facets
    Analyze statistics to understand trends

Avoid

  • Accessing systems without authorization
    Shodan is only a reconnaissance tool: never attempt an intrusion
  • Overly broad queries
    Avoid generic searches that return millions of results
  • Ignoring API limits
    Respect your subscription's query and scan credits
  • Disclosing vulnerabilities publicly
    Contact the owners before publishing anything
  • Relying on Shodan alone
    Cross-check with other sources (Censys, ZoomEye, etc.)
  • Actively scanning targets
    Use indexed data; don't scan yourself

Getting started with Shodan

Step-by-step guide to start using Shodan effectively

1

Create a Shodan account

Sign up at shodan.io to access advanced features

Free account: limited searches, few result pages, advanced filters reserved
Membership and API plans: advanced filters, query and scan credits, API access (current pricing on shodan.io)

2

Try simple searches

Start with basic queries to get familiar

apache country:FRport:22product:nginx city:Paris
3

Explore facets and filters

Use the side panel to see the geographic distribution, top ports, organizations, etc.

4

Install the CLI tool

Automate your searches with the command-line interface

pip install shodan
shodan init YOUR_API_KEY
shodan search apache
5

Set up monitoring alerts

Create alerts to be notified of changes to your infrastructure (paid plan required)

Resources and documentation

Useful links to deepen your Shodan knowledge

Official Shodan website

The main platform for your searches

Open Shodan

Official documentation

Complete guide to filters, API and features

Read the docs

API Developer Hub

REST API documentation and Python, Ruby SDKs, etc.

Explore the API

Python SDK

Official Python library for the Shodan API

View on GitHub

Ready to explore the invisible internet?

Discover other powerful OSINT tools and put your skills into practice with our case studies

See case studiesOther OSINT guides
CyberXTEL
100% Free

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL