資安人員與駭客都愛用的搜尋引擎：Shodan

https://en.wikipedia.org/wiki/Shodan_(website)

Shodan is a search engine that lets the user find specific types of computers (webcams, routers, servers, etc.) connected to the internet using a variety of filters.

Shodan collects data mostly on web servers (HTTP/HTTPS - port 80, 8080, 443, 8443), as well as FTP (port 21), SSH (port 22), Telnet (port 23), SNMP (port 161), IMAP (port 993), SMTP (port 25), SIP (port 5060), and Real Time Streaming Protocol (RTSP, port 554). The latter can be used to access webcams and their video stream.

The website began as Matherly's pet project, based on the fact that large numbers of devices and computer systems are connected to the Internet. Shodan users are able to find systems including traffic lights, security cameras, home heating systems as well as control systems for water parks, gas stations, water plants, power grids, nuclear power plants and particle-accelerating cyclotrons;[citation needed] most have little security. Many devices use "admin" as their user name and "1234" as their password, and the only software required to connect to them is a web browser.

In May 2013, CNN Money released an article detailing how SHODAN can be used to find dangerous systems on the Internet, including traffic light controls. They show screenshots of those systems, which provided the warning banner "DEATH MAY OCCUR !!!" upon connecting.

In September 2013, Shodan was referenced in a Forbes article claiming it was used in order to find the security flaws in TRENDnet security cameras. The next day, Forbes followed up with a second article talking about the types of things that can be found using Shodan. This included Caterpillar trucks whose onboard monitoring systems were accessible, heating and security control systems for banks, universities, and corporate giants, surveillance cameras, and fetal heart monitors.

In January 2015, Shodan was discussed in a CSO Online article addressing its pros and cons. According to one opinion, presented in the article as that of Hagai Bar-El, Shodan actually gives the public a good service, although it highlights vulnerable devices. This perspective is also described in one of his essays.

In December 2015, various news outlets, including Ars Technica, reported that a security researcher used Shodan to identify accessible MongoDB databases on thousands of systems, including one hosted by Kromtech, the developer of the MacOS security tool MacKeeper.

The primary users of Shodan are cybersecurity professionals, researchers and law enforcement agencies. While cybercriminals can also use the website, some typically have access to botnets that could accomplish the same task without detection.