EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesMedium
A penetration tester is performing reconnaissance against a large target organization. They want to identify publicly accessible resources, including IoT devices, industrial control systems (ICS), and webcams that might be inadvertently exposed to the internet. Which specialized search engine or platform is best suited for this task?
- ABing Search
- BDuckDuckGo
- CGoogle Search
- DShodan
Show answer & explanationAnswer & explanation
Correct answer: D. Shodan
Shodan is specifically designed to index internet-connected devices, not just web pages. It can identify a vast array of devices, including IoT, ICS, routers, and webcams, by scanning ports and banners across the internet, making it ideal for discovering exposed operational technology.
Why the other options are wrong
- A. Bing Search, like Google, is a general-purpose web search engine and not specialized for device discovery.
- B. DuckDuckGo is a privacy-focused web search engine, also not specialized for device discovery.
- C. Google Search primarily indexes web pages and is not optimized for finding specific types of internet-connected hardware or services.
Shodan
A search engine that indexes internet-connected devices rather than web pages, allowing users to find specific types of hardware, services, and vulnerabilities exposed to the public internet.
- Indexes devices, not just web pages
- Identifies IoT, ICS, webcams, routers, servers
- Scans banners and open ports
- Valuable for discovering exposed operational technology
Memory trick: Shodan shows you the 'stuff' connected to the internet, not just websites.