OSINT for the Lazy Part 16: Discovering Hidden Corporate Infrastructure Through Shodan
The article explains how Shodan differs from traditional search engines by indexing internet-connected devices such as servers, routers, cameras, databases, and admin panels rather than web pages. It provides ten practical search techniques including hostname queries, SSL certificate searches, ASN lookups, IP range scans, and targeted queries for development environments, admin panels, and databases. Examples demonstrate how forgotten dev.company.com or staging.company.com hosts, open Jenkins or Grafana dashboards, and exposed MongoDB or Redis instances can be located with simple filters. The piece walks through a five-step real-world workflow that combines domain, SSL, organization, and service-title searches to map a target company’s infrastructure. It emphasizes that Shodan only reveals services already exposed to the internet and does not perform any exploitation. Common root causes listed include forgotten test servers, rushed DevOps configurations, and misconfigured firewalls. The article concludes with a reminder that many organizations remain unaware their internal systems are visible to anyone using the same techniques.
HabrAug 9, 2026Translated from Russian
