3 ms·
I guess this can be useful if you don't know what's going on with your internet connection. Although the fact that the "results" are cached arguably makes this
by nobody9999 6y ago
I guess this can be useful if you don't know what's going on with your internet connection.
Although the fact that the "results" are cached arguably makes this less useful than GRC and other sites that will actively scan your IP (range).
And even though they provide a timestamp for the reported information (different for different ports by 24 hours or so, at least for me), I'd personally prefer an active scan over a database lookup if I want to know what's going on.
I'll go further and say that while the information provided is absolutely useful, depending on the services you're exposing to the Internet, there are other tools that will give you much more useful, actionable information.
There are rafts of online tools to check for vulnerabilities in specific services. Notably:
Mozilla Observatory
https://observatory.mozilla.org/ https://observatory.mozilla.org/
Qualys Labs SSL test
https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
MX Toolbox Super Tool
https://mxtoolbox.com/SuperTool.aspx https://mxtoolbox.com/SuperTool.aspx
And many others, including the GRC Shields Up! port scanner mentioned in other comments in this thread:
https://www.grc.com/shieldsup https://www.grc.com/shieldsup
As such, unless you're going to use Shodan services, or want to know what information they have about you, it seems like there are other, better tools out there.
What's more there are tons of tools that you can run locally that will provide much more information about the devices on your internal network, since you can run them inside your firewall.
N.B.: I am emphatically not discouraging others from using shodan.io, nor am I claiming that it's bad. Rather, I'm expressing my own opinion as to how I prefer to identify and test my internet-facing attack surface.
- gowld 6y agoMozilla's "include my site in the public results" (including vulnerabilities) by default doesn't seem very privacy respecting.
- nobody9999 6y ago>Mozilla's "include my site in the public results" (including vulnerabilities) by default doesn't seem very privacy respecting. Then don't use it. Or check the click-box. Which is what I did. That said, your Internet-facing IP address isn't private. In fact, it has to be public in order to route traffic to/from you. I'd note that the shodan.io site had information about my IP address, even though I'd never used it or requested a scan. What's more, I'm included in that database without any opportunity to opt out as the Mozilla site provides. And just to be clear, I have no connection to Mozilla (or any of the other sites I mentioned). In fact, I'd never looked at Mozilla Observatory before I started poking around for the comment to which you replied and included it only because it had an SSH scanner.
- silverfox17 6y agoIt's not generally used to assess your own attack surface - it's mainly used to assess the attack surface of others using their search syntax. It's a Google of vulnerable systems.
- achillean 6y agoActually monitoring your own attack surface is the most common reason companies purchase a subscription. See: https://monitor.shodan.io https://monitor.shodan.io
- achillean 6y agoBtw we do also offer the ability to request scans (https://help.shodan.io/the-basics/on-demand-scanning https://help.shodan.io/the-basics/on-demand-scanning) but it's only available w/ a paying account (including the membership which is a one-time payment of $49).