Shodan / Censys

# RoE: defensive use only. Shodan indexes public services on the public internet.
# Querying is legal; PROBING / EXPLOITING services owned by others is not.
# Use to audit YOUR OWN attack surface; never to attack systems you do not own.

# ===== What Shodan indexes =====
# - Open TCP ports + banners (SSH, FTP, RDP, ICS/SCADA, IoT, web servers)
# - TLS certificate metadata
# - Geolocation, ASN, organization
# - Service versions (often vulnerable)
# - Historical data (some plans)

# ===== Defensive use cases =====
# 1. Inventory your own perimeter ('what does the internet see?')
# 2. Detect shadow IT (forgotten EC2 instances, dev environments)
# 3. Monitor for new exposure (a new open port)
# 4. Verify post-deploy that you did not expose ops endpoints
# 5. Find leaked secrets in banners (env var dumps, cert subject leaks)

# ===== Web UI =====
# https://www.shodan.io — search bar; saved searches; alerts
# Free tier: limited queries; paid tiers unlock filters + downloads.

# ===== Useful filters (for YOUR OWN assets) =====
# org:'YourCompany Pty Ltd'
# hostname:.yourdomain.com
# net:203.0.113.0/24
# ssl:'yourdomain.com'

# Combine with service filters:
# ssl:'yourdomain.com' port:9200          # Elasticsearch exposed?
# org:'YourCompany' product:RabbitMQ      # MQ exposed?
# hostname:.yourdomain.com 'X-Powered-By'  # framework leakage

# ===== CLI =====
pip install shodan
shodan init <API_KEY>
shodan host 203.0.113.10                  # ALL data for an IP you own
shodan search 'org:"YourCompany" port:22 country:AU'
shodan stats 'org:"YourCompany"' --facets port:20
shodan alert create 'yourdomain' net:203.0.113.0/24
shodan stream                             # live banner stream (paid)

# ===== Set up monitoring =====
# 1. Create a network range monitor for your IP space
# 2. Get email/webhook alerts when new ports appear
# 3. Tie to your incident response (open ticket; identify owner; harden or close)

# ===== Defensive responses to findings =====
# - Unauthorised port open: identify owner via tags / config; close or move behind WAF
# - Outdated banner version: schedule patch; track via SLA
# - Cloud metadata API exposed (SSRF risk): add IMDSv2 + IAM policy
# - SSH on default port from anywhere: restrict by source IP / move to bastion

# ===== Compliance overlap =====
# Many frameworks (PCI, ISO, SOC 2) require external attack surface review.
# Shodan + censys.io give you a programmatic 'outside-in' view.

# ===== Search alternatives =====
# Censys      similar data; great cert + protocol intel
# BinaryEdge  similar, paid
# ZoomEye     China-based; useful for global coverage

# ===== Ethical guardrails =====
# - Always have written authorisation BEFORE looking at systems you do not own
# - Querying is legal; the moment you SEND a packet to an exploit endpoint, you crossed the line
# - Public exposure is not consent to attack
# - Use Shodan to defend YOUR assets, not to scope someone else's

# ===== When Shodan wins =====
# - Asset inventory in cloud-heavy / merger-heavy orgs
# - Continuous monitoring for drift
# - Pen-test scoping for AUTHORISED engagements
# - Post-incident: what did the attacker see?

# ===== Pitfalls =====
# - Acting on Shodan data without owner verification (could be a partner's range)
# - Probing systems you do not own based on Shodan output
# - Relying on Shodan freshness for time-critical decisions (data has TTL)
# - Sharing screenshots that contain customer IPs / certs without redaction

# ===== Patterns to internalise =====
# - Set Shodan alerts for your network ranges + domains
# - Pair with attack-surface management (ASM) for full coverage
# - Document ownership for every IP / port you find
# - Hardening tickets with SLAs for any new exposure

# Shodan + Censys index internet-exposed services.
# Useful for inventory checks against YOUR domains:
shodan search 'org:"Your Org"' --fields ip_str,port,product
# Use to confirm nothing unexpected is reachable externally.