WEBVTT 00:00:01.040 --> 00:00:01.770 So far, 00:00:01.770 --> 00:00:05.040 Shodan has shown a lot of information about devices it found 00:00:05.040 --> 00:00:06.950 on the internet with a plain text search. 00:00:07.340 --> 00:00:11.450 Now let's focus refining those results with search filters. 00:00:12.440 --> 00:00:15.350 All search filters are based on using the name of the filter, 00:00:15.620 --> 00:00:19.790 a colon separator, and then the value. Notice there's no 00:00:19.790 --> 00:00:21.750 space between the colon and the value. 00:00:22.240 --> 00:00:23.670 If you need a space in the value, 00:00:23.670 --> 00:00:27.460 say, for a two‑word city name, double quote the value. 00:00:28.340 --> 00:00:32.259 You can also combine filters together to match on both filter values. 00:00:33.240 --> 00:00:35.710 There are many filters available in Shodan, but 00:00:35.710 --> 00:00:37.560 we're focusing on just a few here. 00:00:37.940 --> 00:00:41.020 First, we'll look at limiting results to specific 00:00:41.020 --> 00:00:44.770 organizations with the "org" filter. Next, 00:00:44.780 --> 00:00:46.960 we can limit results to a specific city. 00:00:47.940 --> 00:00:48.820 Then, products. 00:00:49.240 --> 00:00:52.960 These can be software or hardware products or network services. 00:00:53.940 --> 00:00:54.550 Finally, 00:00:54.680 --> 00:00:59.970 we'll look at network service ports. Using the filters, we can also exclude 00:00:59.970 --> 00:01:06.960 results by prefixing the filter name with a "dash." To see how filters work, 00:01:06.960 --> 00:01:12.430 let's start with looking at results from an organization. Here we can see 00:01:12.430 --> 00:01:14.960 quite a few results for this organization. 00:01:15.840 --> 00:01:19.650 Notice that there are multiple matches for the organization name here. 00:01:21.540 --> 00:01:25.560 Here's another example. Notice here we have several 00:01:25.560 --> 00:01:27.750 countries listed for this organization. 00:01:30.840 --> 00:01:35.940 This example organization offers services worldwide through its cloud services, 00:01:36.060 --> 00:01:38.700 SaaS software, and various locations. 00:01:40.640 --> 00:01:44.590 Now let's look at limiting results to a specific city. Using our 00:01:44.590 --> 00:01:48.060 previous organization, let's also add a city filter. 00:01:50.040 --> 00:01:56.360 Let's look at another city. Here we can see a variety of 00:01:56.360 --> 00:01:58.560 organizations with assets in this city. 00:02:00.540 --> 00:02:02.670 This works internationally as well, 00:02:02.680 --> 00:02:06.860 but notice those city names may be present in countries you didn't expect. 00:02:08.840 --> 00:02:12.020 We may be interested in only identifying specific software. 00:02:12.020 --> 00:02:17.510 For this, there is the "product" filter. Here are the results 00:02:17.510 --> 00:02:19.960 for identifying ProFTPD servers. 00:02:21.940 --> 00:02:28.640 Here are the results from a sendmail server filter, and an example of details. 00:02:28.640 --> 00:02:33.550 When searching around, we'll likely find examples of "security through 00:02:33.550 --> 00:02:37.390 obscurity," where someone thought placing a common network service on a 00:02:37.390 --> 00:02:40.550 non‑standard network port will provide some protection. 00:02:40.940 --> 00:02:44.190 Shodan can detect and identify specific network services 00:02:44.200 --> 00:02:45.950 regardless of the port they run on. 00:02:46.640 --> 00:02:47.860 So, how do we find these? 00:02:48.240 --> 00:02:52.680 Well, we can prefix the filter with a "dash" to exclude those results. 00:02:53.640 --> 00:02:54.450 For example, 00:02:54.840 --> 00:02:58.570 I want to find all of the results where Sun SSH is not 00:02:58.570 --> 00:03:01.460 running on the standard SSH port of 22. 00:03:03.440 --> 00:03:07.460 Another service that might run on a non‑standard port is VNC. 00:03:08.440 --> 00:03:12.720 This search looks for VNC servers that do not run on ports 00:03:12.720 --> 00:03:17.670 5900 and 5901 for VNC displays 1 and 2. 00:03:19.840 --> 00:03:21.950 So you can see, using search filters, 00:03:22.030 --> 00:03:24.760 you can be more specific with your search results.