shodan.io is the search engine that lets you scan through the internet of things. It’s essentially a port scanner and banner grabber that lets you punch in some parameters for a search query and brings back a hacker’s treasure trove of information. It makes searching for vulnerable IP cameras, routers and industrial control systems as easy as using Google. Like Google, knowing how to search can be the difference between being the average user and being dangerous with the tools you have. When using Shodan, it’s important to know a few things. You know Google Dorks? Those will help you become a whole lot more effective with Shodan. You want to have an understanding of common protocols and ports, and you will want to be able to understand the results of a banner grab. It’s also helpful to know some Nmap and Netcat. You’ll probably be using those, too. Remember, attackers go after the low-hanging fruit. Most of them aren’t after this organization or that company. They just want to pop the box that’s begging to be broken into. Unfortunately, some of us make it easy.