EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesMedium
A penetration tester is performing reconnaissance against a target organization's web applications and notices that many of them are hosted on cloud platforms like Amazon Web Services (AWS) and Azure. The tester wants to identify potential misconfigurations or exposed services associated with these cloud instances. Which specialized search engine would be most effective for discovering internet-connected devices, databases, and services, including those hosted in the cloud?
- AGoogle
- BDuckDuckGo
- CBing
- DShodan
Show answer & explanationAnswer & explanation
Correct answer: D. Shodan
Shodan is a specialized search engine for internet-connected devices. It actively scans the internet for services and devices, making it highly effective for discovering exposed cloud instances, databases, webcams, and other IoT devices that might have misconfigurations or vulnerabilities, which is precisely what the penetration tester is looking for.
Why the other options are wrong
- A. Google is a general-purpose search engine, less effective for finding specific internet-connected devices and services with banners.
- B. DuckDuckGo is a privacy-focused general-purpose search engine, not specialized for device discovery.
- C. Bing is a general-purpose search engine, similar to Google, and not specialized for this type of device enumeration.
Shodan
A search engine that lets users search for various types of servers (webcams, routers, servers, etc.) connected to the internet using a variety of filters. It's often called 'the search engine for hackers' due to its ability to find exposed devices and services.
- Indexes internet-connected devices and services.
- Collects banners and metadata.
- Useful for finding exposed cloud instances, IoT, ICS.
- Identifies potential misconfigurations.
Memory trick: Shodan shows the 'Shadow of the Domain'.