Shodan ( https://www.shodan.io/ ) is a search engine designed by web developer John Matherly ( http://twitter.com/achillean ). Shodan is a much different search engine than content search engines like Google, Yahoo, or Bing. Shodan is a search engine to find online devices on the internet such as: computers, servers, webcams, routers… It works by scanning all devices on the internet that have open public ports. go to the internet and analyze the signals returned from the devices. Using that information, Shodan can tell you things like which web servers (and versions) are most popular, or how many anonymous FTP servers exist in a particular location, or return a list The cameras are accessible online via the internet. In general, with shodan you can search for any device on the internet as long as they have an internet connection and open a public port.
Shodan is effectively used in security testing of IOT (Internet Of Thing) devices by quickly detecting devices that are online and devices with security vulnerabilities. Shodan operates 24/7 so its data is always updated as quickly and accurately as possible.
With Shodan, hackers with evil tendencies (Black hat) can search for targets to serve hacking (walking hack). By reading notifications about newly appearing vulnerabilities, the notifications will often include additional information about the vulnerable service versions. Hackers rely on that service information to find targets on Shodan and exploit them. Or, it can also be used to peek at cameras with weak or no passwords, etc.
For security experts, Shodan becomes an effective Information Gathering tool for Pen Testing Applications, Pentest Server,… and it is also a useful reference channel for statistics and risk assessment. Potential security risks, the risk of being attacked by a certain vulnerability in a certain area. For example: Statistics to see how many servers can be exploited through the HeartBleed vulnerability in Vietnam?
=> Shodan is completely legal and does not violate the law. In essence, shodan just collects data that is already available on the internet, and shodan simply reports what it finds. However, users may violate the law if they use information from Shodan indiscriminately and without control!
Author: Hoang Duc Hoan – VSEC
