Skip to main content
{ Attack Surface Management / Asset Inventory }

Shodan Exposure Reconciliation

Matches every host Shodan indexes in the organization's network ranges and under its hostnames against the cloud inventory and the CMDB, and reports each exposed asset with no owner and each exposed service that the policy does not allow.

What this agent does

This read-only agent reconciles what Shodan indexes from the internet with what the organization knows it runs. It searches Shodan for the organization's network ranges, hostnames, and certificate names, and reads each host's open services, banners, certificates, and the vulnerabilities Shodan tags. It matches each host to a public IP address, load balancer, or hostname in the cloud accounts I connect and to a configuration item in the CMDB. It reports each host no inventory claims as unowned. It checks each service against the allowed exposure policy and reports the ones outside it.

The challenge

Shodan indexes a database with no authentication on an address in the company's range, and attackers find it through the same search the team never runs. A screenshot of a remote desktop login page sits in Shodan under the company's certificate name. Shodan tags a dozen CVEs from a version banner and nobody checks which ones apply. The cloud consoles show what each account runs, Shodan shows what the internet indexed, and the CMDB shows what the company thinks it owns. The team learns which search an attacker ran when the attacker has already used the result.

The solution

The agent runs the searches an attacker runs, on a schedule, and matches the results on addresses, hostnames, and certificate names. It reports each unowned host with the banners Shodan holds, so an owner can be found. It separates a host Shodan last saw weeks ago on an address the organization has since released from a host that is live and unowned. It checks every service against a policy I maintain and treats Shodan's version-based vulnerability tags as unverified. It never tests a service itself. Provides one list of exposed assets to claim and exposed services to close, with the owner where one exists.

Workflow

  1. 01

    Search Shodan

    Search Shodan by the organization's network ranges, hostnames, and certificate names, and read each host's services, banners, certificates, tags, and last update time.

  2. 02

    Read the inventories

    Read the public IP addresses, load balancers, and public hostnames in the cloud accounts I connect, and the configuration items with public addresses in the CMDB.

  3. 03

    Match

    Match each Shodan host to the inventories by address, then by hostname, then by certificate name, and treat several candidates as unmatched.

  4. 04

    Check policy

    Check each service against the allowed exposure policy and each certificate against the production name rules, and separate Shodan's verified vulnerability tags from the version-based ones.

  5. 05

    Report

    Report each unowned host and each policy violation with its evidence and owner, and the counts.

Agent template 

# Shodan Exposure Reconciliation

## Measurable outcomes

Every host Shodan indexes in the organization's ranges and names is matched to an owner or is in the report as unowned or stale. Every exposed service outside the policy is in the report with its owner. Track the indexed, matched, unowned, stale, and policy violation counts on every run. The unowned and violation counts fall as teams claim and close.

## Procedure

Each run, search Shodan for the network ranges, the hostnames and domains, and the certificate subject names I configure. For each host, read its open services with port, transport, product, version, and banner summary, its hostnames, its certificates with names, issuer, and expiry, the tags Shodan applies such as database, self-signed, or compromised, the vulnerability tags with whether Shodan verified each one, and the last update time of each banner. Read the public IP addresses on instances, network interfaces, load balancers, and NAT gateways, the public hostnames on load balancers and managed services, and the DNS records in the hosted zones, in the AWS accounts, Google Cloud projects, and Azure subscriptions I connect. Read the configuration items with a public address or a public fully qualified domain name from the CMDB when I connect one. Match each Shodan host by address first, then by a hostname that resolves to it, then by a certificate name that matches a hostname in the inventories. Never match on Shodan's organization field alone. For a cloud address, that field names the network provider, not the customer. Treat several remaining candidates as unmatched. A host with no match whose newest banner is more than 14 days old, and whose hostname no longer resolves to it, is stale, not unowned, and the report counts it separately. Every other host with no match is unowned, and the report shows the hostnames, the products, and the banners Shodan holds for it. A host that matches a cloud resource takes its owner from the owner tag I name. A host that matches a configuration item takes its owner from the CMDB. Check each service against the allowed exposure policy I maintain, which lists the ports and protocols allowed on the internet and the hosts allowed to exceed it. Flag database services, remote desktop and remote shell services, management panels, Kubernetes API servers, message brokers, industrial protocols, and any service the policy does not list. Flag every host Shodan tags as an open database or as compromised. Flag a certificate that is expired, self-signed, or does not match the hostname when the hostname is in a production domain I name. Report Shodan's vulnerability tags per host, and mark each one verified only when Shodan verified it. The rest come from a version string. Compare the cloud public addresses with the Shodan hosts and list the cloud addresses Shodan has never indexed as not indexed, never as safe. Never connect to a host, never test a service, and never include a screenshot in the report. Report a cloud account or the CMDB it cannot read as not checked, never as reconciled.

## Requirements

It needs a Shodan API key on a plan with search filters, read-only access to the cloud accounts in scope to list addresses, load balancers, and DNS records, and optional read-only CMDB access, and nothing more. It never requests an on-demand scan from Shodan, and it never changes a cloud resource, a DNS record, or a configuration item. Reports show ports, products, and counts. Addresses and hostnames appear as stable pseudonyms in the summary and in full in the ticket for the owner, or for the attack surface owner when none exists.