Shodan

Shodan is a search engine for devices rather than pages. It scans the routable IPv4 space continuously, records what each responding port says about itself, and indexes the result so it can be queried. Censys and ZoomEye do the same thing with different coverage and different pricing.

What it actually records

For every reachable service it stores the banner and whatever protocol-specific metadata it can obtain without authenticating: the HTTP response headers and title, the TLS certificate with its subject and issuer, the SSH host key and version string, an SNMP sysDescr, the identification response of an industrial protocol. Plus geolocation, the owning organisation and ASN, and the observation timestamp.

That last field matters more than people expect. A result is a record of what answered when it was scanned, which may be days or weeks ago, and may be a different host if the address is dynamic.

Query syntax

port:502                        Modbus
port:102 product:"Siemens"      S7 controllers
port:1883                       MQTT brokers
"MikroTik" country:FR
org:"Some ISP" city:"Lyon"
http.title:"IP Camera"
ssl.cert.subject.cn:"vendor.example"
product:"OPC UA" -has_screenshot:true
net:203.0.113.0/24
vuln:CVE-2021-44228

Filters combine with AND by default, - negates, and free text matches anywhere in the banner. vuln: and some filters require a paid account.

Why it matters

The recurring finding is not an exotic vulnerability. It is that things nobody intended to publish are published: plc controllers on port 502 with no authentication in front of them, unauthenticated MQTT brokers streaming a building's sensor data, HMI panels with a web interface and default credentials, printers, cameras, and databases with no password.

For a defender, the highest-value use is inverted: search your own address space and your own certificates, and find the asset nobody remembered. ssl.cert.subject.cn and org: searches routinely surface forgotten staging environments and vendor-installed remote access.

For OT specifically, Shodan is the standard demonstration that "the control network is not connected to the internet" is a claim to verify, not a premise.

Practical use

Start from what you can verify you own: an ASN, a netblock, a certificate common name, a distinctive HTTP title.
Read the banner, do not just count the hits. Version strings and certificate subjects tell you far more than the port number.
Cross-check the timestamp, then verify the finding directly before reporting it. Shodan's record is evidence that something answered, not proof it still does.
The shodan CLI and the API return the same data in JSON, which is what you want for anything beyond a handful of results.

Pitfalls

Scanning what you find is a separate decision. Shodan already did the scanning; connecting to a third party's exposed controller is your action and your liability, and on OT equipment it can cause a physical outage.
Honeypots are common in the industrial ranges specifically, and they are designed to look exactly like the vulnerable device you were hoping for.
Coverage is incomplete. Shodan sees what responds to its scanners on the ports it probes. Absence from the index is not absence from the internet.
Banners lie. Version strings are trivially edited, and vendors reuse them across firmware revisions.

What it pairs with

nmap is what you use once you have a target and authorisation to touch it. ot-security and purdue-model explain why the industrial results exist, and incident-response is where an unexpected exposure usually leads.