Shodan

Shodan Transforms for Maltego

Shodan is a search engine that gathers data from internet-connected devices. These connected devices are queried for various types of publicly available information. The types of devices that are indexed vary tremendously and range from small desktop computers to nuclear power plants, and everything in between. Shodan queries go far beyond what the traditional web search engines can provide as Shodan crawls the internet - whereas traditional search engines crawl the World Wide Web. The devices powering the World Wide Web only make up a tiny fraction of internet connections and Shodan aims to provide a complete picture.

Shodan indexes data taken from banners. This is metadata about software that is running on a device. This can include information about the server software, what options the service supports, a welcome message, or anything else that the client would like to know before interacting with the server.

Shodan operates servers worldwide which crawl the internet 24/7 to provide the latest intelligence. With the increasing number of devices connected to the internet, it is an effective search engine not only for servers and networks, but for the whole Internet of Things (IoT). From unsecured webcams and routers to SCADA control systems, traffic lights, and hospital equipment.

Cyber investigations often need to go beyond what is traditionally considered “infrastructure” in order to paint a full picture of the types of risks to which a system might be exposed. This is precisely where Shodan is an invaluable source of insight and information.

With Maltego Transforms for Shodan, investigators are able to gain access to intelligence about the global IoT and infrastructure data in their investigative workflows within Maltego. These Transforms can be used with all tiers of Shodan API keys.

Benefits

• Network Security: Keep an eye on all devices within your business that are connected to the internet
• Market Research: Discover which products people are using in the real-world
• Cyber Risk: Include the online exposure of your vendors as a risk metric
• Internet of Things: Track the growing usage of smart devices
• Tracking Ransomware: Measure the number of devices that have been impacted by ransomware
• Pivot across other disparate data sources available on the Transform Hub and gain a comprehensive perspective of investigations all in one single UI

In addition, the Shodan Transforms are extremely useful for network footprinting, especially when used in conjunction with the Maltego Standard Transforms

Typical Users of This Data

• Law Enforcement Agencies
• Penetration Testers
• Security Professionals
• Researchers
• CERTS