Objectives
In this lab, you will use the Shodan search engine to understand why security should be the focus of any IIoT implementation.
- Part 1: Obtain Access to Shodan’s Free Features
- Part 2: Investigate Connected IoT Devices
Background / Scenario
Warning: Do not attempt to login to any device you find on the Shodan search engine. Doing so violates your ethical hacking agreement.
In this lab, you will use the Shodan search engine to gain an understanding of why security should be the focus of any IoT implementation.
Shodan has servers located around the world that continually scan the internet for connected devices, including those used in industrial environments. It can detect specific device types such as PLCs, SCADA systems, building automation controllers, and other IIoT components. This information is indexed and made searchable, allowing users to explore systems based on protocols, ports, vendors, or locations. Common industrial-focused searches include terms like "Modbus," "Siemens S7," "HMI," or "BACnet", which can reveal how and where critical infrastructure systems are exposed online.
Shodan is a favorite tool used by researchers, security professionals, large enterprises, and computer emergency response teams (CERTs).
- Researchers can use Shodan to data mine information about what devices are connected, where they are connected, and what services are exposed.
- Security professionals can use Shodan as part of a penetration testing plan to discover devices that need to be hardened to prevent potential attacks.
- Large enterprises employ security professionals who should be aware of tools like Shodan for determining the current risk profile of the enterprise’s connected devices.
- CERTs can use Shodan to quickly generate reports about an emerging attack on connected devices.
Shodan is also a tool used by nefarious individuals and groups commonly referred to as threat actors. Shodan can accelerate a threat actor’s reconnaissance of Internet connected devices. Like all the tools in this course, you must use it responsibly according to your organization’s ethical hacking policies.
Required Resources
- Device with Internet access.
- SANS Penetration Testing article, “Getting the Most Out of Shodan Searches”
Instructions
Part 1: Obtain Access to Shodan’s Free Features
In this part of the lab, you will navigate to the Shodan search engine and sign up for an account and explore the Shodan features.
Step 1: Create free Shodan account.
- Open a web browser and navigate to the Shodan website at https://www.shodan.io/.
- Log in or register to create an account.
- After successfully logging in, you will see your account page, as shown below. Click the Shodan link to return to the homepage.
Now that you’ve created your Shodan account, you’ll begin using its powerful tools to investigate internet-connected devices. In the part of the lab, you will first use the Search feature to perform targeted queries for industrial systems. Then, you'll use the Explore page to discover popular device categories and real-world examples of exposed technologies.
Step 2: Get to know the Shodan interface and how it works.
In this step, you will explore the “Getting Started” area of the Shodan website to learn about its basic features and search capabilities.
- From the Shodan Dashboard, scroll down to locate the “Getting Started” panel.
- Review the introductory materials, including how Shodan gathers data, what banner information is, and how to use search filters and operators.
- Click on any linked tutorials or “Search Examples” to view sample queries and explore how real devices and services appear in Shodan.
Tip: Pay attention to how Shodan uses filters like port, country, or product -you’ll use these in upcoming steps to find IIoT and ICS systems.
Part 2: Investigate Connected IIoT Devices
Step 1: Use the Shodan search engine to find Internet-connected IIoT devices.
In this part, you will gain familiarity with using Shodan to search for Internet-connected IIoT devices.
Legal reminder: Shodan only shows publicly accessible data, but you must not interact with devices unless you own or have permission to do so. Remember, passive observation is allowed; active probing is not.Shodan is a specialized search engine designed to find Internet-connected devices, not websites. It’s often described as the "Google for IoT and IIoT" because it indexes devices like:
- Webcams, routers, and printers
- Industrial control systems (ICS)
- Building automation systems
- Smart TVs, home assistants, and more
- Device type and vendor (e.g., Siemens, Rockwell)
- Open ports and services (e.g., Modbus TCP on port 502)
- Operating system or firmware versions
- Location and hosting provider
Instead of indexing web content like Google, Shodan scans the internet to collect banner information from devices and services listening on open ports. These banners may include:
Shodan organizes this data so users can search for devices by keyword, service, IP range, country, or vulnerability.
- In the Shodan search box type title:"HMI" country:US.
This search will result in industrial Human-Machine Interfaces—the graphical control panels operators use to monitor and control PLCs, SCADA systems, and automated machinery – located in the United States.
- Look at other information on the left side of the web page. The results are broken down into various categories.
- Each entry in a category is a clickable link that will refine your search. Click on 443 under TOP PORTS on the left.
- Select one of the devices in the list of results and click on it to view more details. Shodan now displays key information about the device, including its IP address, domain, geographic location (city), owning organization, internet service provider (ISP), autonomous system number (ASN), web technologies in use, open ports, and any known vulnerabilities. This information helps to assess the device’s exposure and risk profile. Review the results to answer the following:
The results in the right side of the Shodan window show HMI systems in the U.S. that are exposed to the public internet and that are using HTTPS (port 443). These devices often include industrial control dashboards for SCADA systems or remote interfaces for automation. Seeing them on port 443 means they are running a web interface secured by SSL/TLS encryption. However, many of these could still be insecure due to weak or self-signed certificates, misconfigured servers, or lack of authentication or access control. This exposure is significant because HMI systems are meant to control or monitor industrial processes and having them publicly reachable poses serious cybersecurity risks.
This is all very valuable information to a threat actor. By analyzing exposed IP addresses, open ports, software versions, and even geographic or organizational data, they can:
- Pinpoint vulnerable industrial or IoT devices (e.g., PLCs, HMIs)
- Target outdated software versions or services with known vulnerabilities (CVEs)
- Use the organization name and location to craft phishing or social engineering campaigns
- Exploit insecure services (e.g., unencrypted protocols, default credentials)
- Map exposed systems across entire industries or geographic regions
This kind of passive reconnaissance is typically the first step in a more targeted cyberattack.
Step 2: Use the Shodan Explore page.
In the previous step you used the Shodan search feature to perform a targeted query which is useful for finding specific internet-connected devices or services and is ideal for focused investigations, such as identifying publicly exposed PLCs or HMI systems. In contrast, the Shodan Explore page highlights popular and pre-defined categories (e.g., Industrial Control Systems, Webcams, or Databases), making it easier for beginners to browse interesting or high-risk devices without needing advanced search syntax.
- In the Shodan webpage menu click Explore.
The Explore page showcases popular categories, research tools, and community-driven search topics that help users better understand real-world exposure.
At the top, you’ll find clickable categories like:
- Industrial Control Systems – Devices used in manufacturing, energy, and critical infrastructure.
- Databases – Exposed data systems like MongoDB, MySQL, or Elasticsearch.
- Network Infrastructure – Routers, firewalls, load balancers, etc.
- Video Games – Game servers and multiplayer platforms found online.
- Clicking one of these will bring up pre-made searches related to that category, helping you quickly explore how exposed certain systems are across the internet.
On the left side, you’ll find special research tools:
- Shodan 2000 – A fun, retro-styled interface for exploring Shodan results.
- Internet Observatory – A high-level dashboard that shows trends in device exposure by country and the most common vulnerabilities.
The middle and right sections show community-created search queries you can browse:
- Popular Tags – Keywords like door, default password, or modbus help you explore specific technologies or risks.
- Example Queries – Like the Job Board (websites that accidentally reveal jobs in HTTP headers) or Ethereum Miners (devices mining cryptocurrency).
These are public searches shared by other Shodan users, which can be used as a learning tool to analyze exposure and misconfiguration across device types.
- Select the Industrial Control Systems category and review the page contents. Read the descriptions of the various ICS protocols listed on the page.
- Click EXPLORE MODBUS and view the results.
- Look at the right side of the screen. This shows a list of Modbus devices exposing port 502.
- Click on an entry of your choice.
- Review the information shown to answer the following:
These entries represent IP addresses with an open TCP port 502, which is the default port for Modbus TCP.
Remember: Passive observation using Shodan is legal, but only if it remains strictly observational. You are allowed to view banner information, metadata such as IP addresses and open ports, and analyze publicly reported vulnerabilities that Shodan already displays. However, it is illegal and unethical to interact with the device in any way. This includes attempting to log in, send commands, run scans, or authenticate—even with default credentials. As a rule of thumb: if you are not explicitly authorized by the device owner, any interaction beyond viewing is off-limits and may be considered unlawful.
Step 3: Explore other ICS systems.
- Return to the Industrial Control Systems page.
- Select other ICS protocols such as SIEMENS S7, DNP, or EtherNet/IP and explore the results.