Shodan
Named by 32 kept items in this workspace.
26 items name it under tools and 6 under classification.technologies.
The items that name it 32
Internet-wide scanning/search service used in the page's examples to find exposed WHM login pages by title search.
Used to identify unprotected/exposed IP cameras
Scanner service noted as used by both researchers/analysts and attackers to assess unpatched/vulnerable services.
Third-party internet scanning service recognized in the new Scan Databases subtechnique as a discovery channel for exposed AI infrastructure
Used to discover roughly 3,000-85,000 publicly exposed LiteLLM proxies for scanning
host intelligence, open port and OS lookup
Used to look up and view the DPRK-linked RDP server IP hosted in the UK
finds exposed servers/services (e.g. illustrative example found Fortinet VPN on :443 and unauthenticated Jenkins on :8080)
Data source used via API key (FR_SHODAN_KEY) for reconnaissance data fetching in FinalRecon
Data source WireTapper queries for internet-connected devices; its API is paid and WireTapper runs without it.
Host lookup (open ports, org, CVEs) for IPv4, or banner/keyword search; requires SHODAN_API_KEY
internet-connected device search
OSINT internet-exposed asset search used in recon playbook
IP lookup and search queries for exposed services
Used by Orca's Threat Research Team to query and count internet-facing Tengine servers (1,453,152 found).
OSINT reconnaissance service referenced under Offensive OSINT curated skills
used for scanning data showing approximately 73% of internet-exposed ChromaDB instances are running vulnerable versions
Search engine integration used by CF-Hero for third-party intelligence; historical DNS records lookup, /dns/domain endpoint requires paid Membership
Recommended tool for finding whether RDP is exposed on a network via external scanning
network intelligence / threat intelligence searches
Internet-wide host/service discovery
Used to identify exposed PAN-OS servers on ports 6081 and 6082 (67 exposed on port 6081, none on port 6082)
Queried with 32+ curated search queries to discover exposed AI/ML endpoints; also used for its query syntax style in AIMap's search bar
Used to view exposure of vulnerable Cleo servers on the internet.
Internet-connected device search
In every workspace you can read 34
Security
All technologies in this workspace.