Walkthrough: Shodan.io [TryHackMe]
Tags: tryhackme
Published: 2020-10-08 08:08:44

[Shodan.io](https://www.shodan.io) is a search engine for the internet of things. There is a room about **Shodan** in Tryhackme and this walk-through is about that.

> Due to the nature of Shodan and its scanning services, the answer is changing all the time. So keep trying.

# Task 01

An **autonomous system number (ASN)** is a global identifier of a range of IP addresses. Basically, large companies like Google, Microsoft have their own ASN for all of the IP addresses they own.

To find out ASN, first, we can search their IP address: `ping google.com`

We can put the IP address into an ASN lookup tool such as [ultralools/asninfo](https://www.ultratools.com/tools/asnInfo)

[It is mentioned by David Paine (*see on the comment*) that the above link isn't working. You should check another which he suggested: [DNSchecker](https://dnschecker.org/asn-whois-lookup.php)]

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/4jngi66z558q2i76zd3t.png)

Though, we can put the company name here to find the ASN, using the IP address seems the easiest one to me.

On shodan, we can search using the ASN filter. The filter is: `ASN:[number]`
here, the number is marked on the picture.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/5qg8beqhf25a6510s9l6.png)


# Task 02


* What is Google's ASN number?

**Ans:** You know it now. ;)

* When it was allocated?

**Ans:** Again, look at the details.

* Where are most of the machines on this ASN number, physically in the world?

**Ans:** United States.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/fwd7xp39mrvo1jbsgkgt.png)

* What is Google's top service across all their devices on this ASN?

**Ans:** SSH.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/c0r7034nvq93t516esvh.png)

* What SSH product does Google use?

**Ans:** OpenSSH.

* What is Google's most used Google product, according to this search? Ignore the word "Google".

**Ans:** Cloud.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/lrduuaygeaz1nqhlndox.png)


# Task 03


Here is a list of filters for shodan:
1. product: _product Name_ (_ex: MySQL_)
2. city
3. country
4. Geo (*co-ordinates*)
5. Hostname
6. net (*based on IP/CIDR*)
7. os (*find operating systems*)
8. port
9. before/after (*time-frames*)


# Task 04


* What is the top operating system for MYSQL servers in Google's ASN?

**Ans:** 5.6.40–84.0-log

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ap2tjmgdh1x96jvnkpb5.png)

* What is the 2nd most popular country for MYSQL servers in Google's ASN?

**Ans:** Netherlands.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/650481abl2bgxyezm8rd.png)

* Under Google's ASN, which is more popular for Nginx, Hypertext Transfer Protocol, or Hypertext Transfer Protocol(s)?

**Ans:** HyperText Transfer Protocol.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/jtug7t9z1no4pix77kn1.png)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/o6j201ibjz951m0chi29.png)

**Port 80** stands for HTTP; **port 443** stands for HTTPs.

* Under Google's ASN, what is the most popular city?

**Ans:** Mountain View. (*Answer changes tiem to time*)

* Under Google's ASN in Los Angeles, what is the top operating system according to Shodan?

**Ans:** PAN-OS.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/j43u23s4yqvqav8r7o6f.png)

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/zev21xqc1e3qag8ea0au.png)

* Using the top Webcam search from the explore page, does Google's ASN have any webcams? Yay / nay.

**Ans:** Nay.

# Task 05

Shodan has a limit on the free user account. It has an API, use it for more searches.