Re:Shodan Search Engine: Search Engine for the Internet of E...
by GSGBen on Sunday September 26, 2021 @09:29PM
(#28666204)
This is a great tool, but there's a caveat: Last time I checked Shodan didn't scan all ports, and from all locations. If you're using this to check the surface area of your infrastructure (including the notify-me-of-new-open-ports feature), always test with a full nmap scan yourself, preferably from within the same geographic region.
[ Parent
| on HN ]
Re:Shodan Search Engine: Search Engine for the Internet of E...
by bikingbismuth on Sunday September 26, 2021 @11:03PM
(#28666668)
When I use Shodan as a data source for any info sec consulting, I try to get the point across that Shodan’s map of your network is not accurate (nmap is much better for that), but anything that an adversary sees on Shodan is likely to be an initial target (even if it is down at the time of the attacker looking).
Shodan is a fantastic tool, but I never trust it as a single source of truth for a network perimeter.
Re:Shodan Search Engine: Search Engine for the Internet of E...
by napalmall on Monday September 27, 2021 @06:36AM
(#28669097)
there are actually multiple alternatives available that are like Shodan but concentrate more on detailed port scanning for example https://www.idyllum.com or https://pentest-tools.com/network-vulnerability-scanning/tcp...
There still really aren't much all encompassing tool sites out there and you need to mix and match unfortunately