OSINT for the Lazy Part 16: Discovering Hidden Corporate Infrastructure Through Shodan

The article explains how Shodan differs from traditional search engines by indexing internet-connected devices such as servers, routers, cameras, databases, and admin panels rather than web pages. It provides ten practical search techniques including hostname queries, SSL certificate searches, ASN lookups, IP range scans, and targeted queries for development environments, admin panels, and databases. Examples demonstrate how forgotten dev.company.com or staging.company.com hosts, open Jenkins or Grafana dashboards, and exposed MongoDB or Redis instances can be located with simple filters. The piece walks through a five-step real-world workflow that combines domain, SSL, organization, and service-title searches to map a target company’s infrastructure. It emphasizes that Shodan only reveals services already exposed to the internet and does not perform any exploitation. Common root causes listed include forgotten test servers, rushed DevOps configurations, and misconfigured firewalls. The article concludes with a reminder that many organizations remain unaware their internal systems are visible to anyone using the same techniques.

HabrAugust 9, 2026Translated from Russian

Read at source

If the internet is compared to a large city, the visible part consists of main streets and side alleys that host official company websites, while the backyards, basements, and service entrances are where maintenance staff and potential intruders move. Shodan specializes in exploring exactly these hidden areas by indexing devices instead of web pages.

Unlike conventional search engines such as Google that crawl HTML content, Shodan catalogs internet-connected hardware including servers, IP cameras, databases, routers, administration panels, and IoT equipment. When administrators leave such systems exposed, analysts can discover valuable information about a company’s infrastructure.

1. Search by company domain

The simplest method uses the filter hostname:company.com. Results often reveal forgotten development, VPN, test, and API endpoints such as dev.company.com, vpn.company.com, test.company.com, and api.company.com.

2. Search by SSL certificates

The query ssl:"company.com" locates certificates that mention the target domain and frequently surfaces additional subdomains including jenkins.company.com, internal-api.company.com, and staging.company.com.

3. Search by ASN

Companies that own IP address blocks usually possess an ASN (Autonomous System Number). The filter asn:ASXXXX returns every device registered to that network, exposing servers, routers, and sometimes cameras.

4. Search by IP range

When the exact network block is known, the filter net:192.168.10.0/24 lists all devices inside the range, potentially revealing VPN services, SSH ports, Docker, Kubernetes, GitLab instances, and even internal databases.

5. Search for development infrastructure

Developers commonly use keywords such as dev, stage, staging, test, qa, beta, and internal. Queries like hostname:dev or hostname:staging can uncover unprotected development and staging environments.

6. Search for administration panels

Filters such as title:"Jenkins", title:"Grafana", and title:"Kibana" locate continuous-integration systems, monitoring dashboards, and other operational tools that sometimes remain accessible with default credentials.

7. Search for databases

Port-based queries including port:27017, port:6379, and port:9200 identify MongoDB, Redis, and Elasticsearch instances. Adding an organization filter can tie these services to the target company.

8–10. Cloud, organization, and IoT searches

Additional techniques cover cloud-hosted Docker and Kubernetes APIs, organization-name searches with org:"Company Name", and queries that surface corporate webcams, industrial controllers, and building-automation systems.

A practical five-step workflow combines hostname, SSL, organization, development-keyword, and service-title searches. In one documented case the search sequence led directly to an unprotected jenkins.dev.company.com instance containing CI pipelines, source repositories, and deployment keys.

Shodan does not exploit or attack any system; it merely displays services that are already reachable from the public internet. The most frequent reasons for exposure remain human error: forgotten test servers, temporary development environments, incorrectly configured firewalls, and rushed deployments that leave ports open.

Redis MongoDB Shodan Jenkins Grafana Kibana Elasticsearch

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users

Mail.ru has begun notifying a small group of long-term Cloud Mail users that their complimentary 1TB storage, originally granted through a 2013-2014 app installation promotion, will be reduced to the standard 8GB free tier. Affected users receive personalized deadlines, with some facing storage limits starting 30 October and final deletion of excess files scheduled for 30 January 2027. The company confirmed the change impacts fewer than 0.5 percent of Cloud Mail users and stated that core free features remain available. Once the 8GB limit is exceeded, uploads, edits, and sharing are blocked while users have three months to download data or purchase additional space before files move to the trash for 14 days prior to permanent removal. This follows a similar reduction of lifetime 100GB storage performed by the service in 2024.

AntiMalwareOct 29, 2026Translated from Russian

Other

Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts

Kimi K3 is an open-weights model that outperforms closed systems from GPT and Anthropic on several independent benchmarks. Developers achieved this by scaling three dimensions simultaneously: one million tokens of context, deeper layers, and 896 Mixture-of-Experts specialists. The team replaced the standard KV-cache with a fixed-size state matrix updated via the delta-rule, solving numerical instability by clamping the forgetting coefficient alpha between e^-5 and 1. Sequential state updates were parallelized across chips, GPUs, and multi-GPU nodes using the open-source FlashKDA kernel built on CUTLASS. Inter-layer information flow was preserved through learned pseudo-queries that selectively retrieve relevant outputs from prior blocks rather than passing full activations. Load balancing across 896 routed experts uses per-expert quantile thresholds and a distributed histogram method to guarantee fair token allocation without full sorting.

HabrOct 29, 2026Translated from Russian

Other

Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria

Innostage has published the second part of its evaluation of PT NGFW version 1.10.3, focusing on functional capabilities rather than raw performance. The testing covered 156 individual checks grouped into categories such as basic technical features, firewalling, IDS/IPS, web filtering, malware protection, logging, routing, deployment, cryptographic controls and access management. Out of the total, 136 checks passed fully, seven passed with remarks, and 13 did not meet the predefined criteria. Key confirmed functions include high-availability clustering, centralized management via PT-MNGT, AD-based rule application, Site-to-Site VPN, TLS inspection, and Syslog integration with external security systems. Several advanced scenarios, including custom block pages, application risk classification, and centralized software distribution, were not confirmed under the test conditions. The report provides detailed protocol notes that help organizations map product capabilities against their specific infrastructure and regulatory requirements.

HabrOct 29, 2026Translated from Russian