WEBVTT 00:00:00.940 --> 00:00:03.320 Now let's tackle some plain text searches. 00:00:03.740 --> 00:00:07.160 These will be basic text strings targeting the information in 00:00:07.160 --> 00:00:12.020 banner text, and we'll see what Shodan can tell us about those. 00:00:12.020 --> 00:00:16.740 Using this search box at the top of the Shodan site, we will try 00:00:16.740 --> 00:00:17.960 some plain text searches. 00:00:18.940 --> 00:00:21.590 I'm curious about the number of Apache web servers there 00:00:21.590 --> 00:00:23.760 are in the world, so let's try that one. 00:00:24.640 --> 00:00:27.760 There are only about 24,000,000 sites powered by Apache. 00:00:28.740 --> 00:00:35.550 Let's compare that with NGINX. There are a few more of those at 31,000,000. 00:00:36.540 --> 00:00:37.760 Let's explore one of them. 00:00:39.240 --> 00:00:43.930 Note the red box and arrow. Clicking that will take you directly to the 00:00:43.930 --> 00:00:48.650 website in your browser. Clicking the IP address or page title will take 00:00:48.650 --> 00:00:51.260 you to a Shodan information page for that system. 00:00:52.740 --> 00:00:56.060 At the top of the page is a map of the location of the system. 00:00:56.940 --> 00:00:59.270 In the upper left is some general information about the 00:00:59.270 --> 00:01:02.660 location, ISP, and associated ASN. 00:01:05.140 --> 00:01:09.660 Below that is some information on the web technologies that the system may have. 00:01:11.640 --> 00:01:15.580 In the upper right, we find the open network ports on the system, and 00:01:15.580 --> 00:01:18.030 below that there are details about those services. 00:01:19.440 --> 00:01:23.560 We can see the network port, protocol, service name, 00:01:23.940 --> 00:01:25.650 and the collected banner text. 00:01:27.740 --> 00:01:29.260 Let's try some other searches. 00:01:29.740 --> 00:01:33.380 I'm curious about those Raspberry Pis. Many of them run an 00:01:33.380 --> 00:01:38.250 OS called Raspbian. Here we can see one example of a system 00:01:38.250 --> 00:01:40.060 that runs the SSH protocol. 00:01:40.940 --> 00:01:45.790 In this case, it's OpenSSH. Shodan has collected its software 00:01:45.790 --> 00:01:48.850 version, public key, and supported algorithms. 00:01:50.240 --> 00:01:53.150 We can search in the same way for Ubuntu systems. 00:01:54.640 --> 00:01:58.450 Note that many of them are web servers hosted in a cloud environment. 00:01:59.440 --> 00:02:02.350 There is a tag applied if Shodan believes they are cloud‑hosted. 00:02:04.340 --> 00:02:08.270 This server has a public key certificate, and we can see the details 00:02:08.270 --> 00:02:14.330 about that certificate here. Shodan has also identified potential 00:02:14.330 --> 00:02:17.050 vulnerabilities based on the software and version. 00:02:17.540 --> 00:02:20.580 Shodan does not test that these are present in the server, 00:02:20.580 --> 00:02:25.310 though. We can also use two or more search terms. 00:02:25.740 --> 00:02:31.650 Shodan will match on all of those terms. Here are Windows Server systems. 00:02:33.040 --> 00:02:37.660 Notice the results highlight the search term matches in a red color. 00:02:40.140 --> 00:02:43.410 We can also use this matching capability to find unique and 00:02:43.410 --> 00:02:45.560 legacy systems still connected to the internet, 00:02:46.240 --> 00:02:50.950 including the very old Google search appliances that were discontinued in 2019. 00:02:53.040 --> 00:02:57.190 It also means plain banner text search can identify other unique 00:02:57.190 --> 00:03:01.150 systems such as Siemens‑made industrial control systems. 00:03:02.140 --> 00:03:03.840 Notice the ics tag. 00:03:05.840 --> 00:03:08.560 This system runs a single network service for management, 00:03:09.040 --> 00:03:12.250 but it reveals a lot of information specific to this device. 00:03:13.240 --> 00:03:16.090 We can see details about the module and its firmware 00:03:16.090 --> 00:03:21.550 version. Nucleus Plus is another ICS example. 00:03:22.040 --> 00:03:24.460 This device has even more network services. 00:03:27.040 --> 00:03:30.670 This quick demonstration of plain text searches shows you the level of detail 00:03:30.670 --> 00:03:34.060 that Shodan provides and relatively quick nature of searching. 00:03:36.040 --> 00:03:39.460 Next, we'll refine our search results using filters.