Shodan
Shodan is a search engine for internet-connected devices and services; defenders use it to see what their own organisation exposes.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Check which of your IP addresses and services are visible on the internet
- Look up exposed service banners for your own assets
Key features
- Searchable index of service banners
- Filters such as org, port, product
- API and command-line client
Installation
Use the website, or install the official CLI with `pip install shodan` and initialise it with your API key.
Beginner usage guide
Search for your own organisation's IP ranges or hostnames; treat results as a starting point and confirm them with your own scans.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Look up one of your own IPs (CLI)
shodan host 203.0.113.10Shows ports and banners Shodan has recorded for that address (replace with your own IP).
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.