Using Shodan and Censys to see your own internet-facing services

Scan data you do not have to collect

Shodan and Censys continuously scan the internet and index service banners, TLS certificates, and HTTP responses. Searching them for your own ranges shows what any attacker can see without touching your network. It is passive from your side, but the results reflect whatever their scanners found.

Queries for your organization

Search by network range, organization name, hostname, or certificate subject. Filters narrow to ports or products. Results include the timestamp of the last observation, which matters because services may have changed.

Snippet

# Shodan (web or CLI)
net:203.0.113.0/24
hostname:example.org
ssl.cert.subject.cn:example.org
org:"Example Org" port:3389
shodan search --fields ip_str,port,product,timestamp net:203.0.113.0/24

# Censys Search
host.services.tls.certificates.leaf_data.subject.common_name: "example.org"
host.ip: 203.0.113.0/24 and host.services.port: 22

Lab: triage your exposure

With a free account, search for your own public IP address or your organization’s ranges if you are authorized. List each service, port, product, and last-seen date. Mark anything that should not be public, such as RDP, databases, admin panels, or outdated software versions in banners. Verify each finding from an outside connection before filing a ticket, because the index may be stale.

Acting on findings

Close or restrict management services to a VPN or allowlist, patch outdated versions, and remove default pages. Set up the services’ monitoring features for your ranges so new exposure triggers an alert. Pair this outside view with your internal inventory and scheduled scans of your own ranges.

Diagram

Exposure findings for an owned range

Verify before you file.

portproductlast seen

203.0.113.10:443

nginx 1.25, cert CN=www.example.org

Last seen 2 days ago

203.0.113.22:3389

Remote Desktop, CN=FIN-JUMP01

Last seen 1 day ago

203.0.113.40:9200

Elasticsearch 7.10 banner

Last seen 6 days ago

Check yourself

1. Why is searching Shodan for your ranges considered passive for you?

2. Which exposed service is usually most urgent?

3. Why verify a finding before filing a ticket?