Shodan & Censys — The Search Engines for Hackers

Imagine a search engine that indexes not websites, but every internet-connected DEVICE and SERVER on the planet — exposed databases, admin panels, cameras, servers, IoT gadgets. That's Shodan (and its cousin Censys). For a hunter, they're incredibly powerful. Let me introduce you.

What Shodan & Censys Do

Regular search engines crawl web PAGES. Shodan and Censys scan the whole internet and index the SERVICES running on it — what's on each open port, what software, what version, what's exposed. They basically map the internet's infrastructure.

So instead of "find pages about cats," you can ask "find exposed databases belonging to this company" or "find servers running this vulnerable software version." See the power?

Why Hunters Love Them

With a company's assets mapped in Shodan, you can spot:

• Exposed databases (MongoDB, Elasticsearch, Redis) sitting open to the internet
• Admin panels and dashboards that shouldn't be public
• Outdated software with known vulnerabilities (match the version to a CVE)
• Forgotten servers and services outside the main app
• Misconfigured cloud instances

All of this is attack surface the company often forgot they exposed.

How To Search (The Filters)

Shodan uses filters to narrow things down:

• org:"Target Company" — assets belonging to an organization
• ssl:"target.com" — find hosts using their SSL certificate (great for finding assets!)
• hostname:target.com — match hostnames
• port:9200 — find a specific service (9200 = Elasticsearch)
• http.title:"Dashboard" — find pages with a specific title
• Combine them: ssl:"target.com" port:3306 → their exposed MySQL servers

The favicon trick: you can even search by a favicon hash to find ALL servers using the same favicon as your target — a sneaky way to discover related assets that don't obviously belong to them.

The Ethical Line

Same rule as always: FINDING an exposed service via Shodan is fine. Actually connecting to and poking someone's exposed database can cross legal lines — and it might not even be in your program's scope. Confirm the asset belongs to your in-scope target, verify exposure minimally, and report. Don't go rummaging in open databases.

The Workflow

1. Map the target's assets in Shodan/Censys (org, SSL, favicon, hostname filters)
2. Spot the anomalies — exposed services, old software, open databases, stray panels
3. Cross-check they're in scope
4. Match software versions to known CVEs
5. Verify and report responsibly