Shodan, Censys, and FOFA: How Internet Scanners Already Mapped Your Attack Surface Before Your First Firewall Rule

A fintech startup spun up a staging environment at 9am on a Monday. MongoDB was on the default port 27017, with no authentication configured, and the firewall rule would be adjusted later. By 5pm that same day, Shodan's index already recorded the MongoDB Server Information banner with the IP address, geolocation, and exact server version.

The database was not compromised that day, but it was indexed and queryable by anyone with a free Shodan account. Any analyst, researcher, or attacker running org:"empresa-fintech" port:27017 would find the address on the first line of results. The security window the team thought they had simply did not exist.

This scenario repeats thousands of times per day because internet scanners operate continuously, with no pause, sweeping the entire public IPv4 space. Censys detects new services in an average of 12.3 hours; Shodan takes an average of 76.5 hours. Neither gives defenders enough time to act first, and the mechanism behind it is well documented.

The Scanner Saw Your Service Before You Finished Deploying

ZMap, developed by Zakir Durumeric and team at the University of Michigan in 2013, scans the entire IPv4 address space on a single port in roughly 45 minutes. The mechanism is stateless: the scanner sends SYN packets without maintaining any TCP connection state, which eliminates handshake overhead and enables speeds impossible for traditional scanners. There is no attempt to establish a real connection; the goal is only to detect which addresses respond with SYN-ACK.

Masscan, written by Robert Graham, goes further: it operates at up to 10 million packets per second. A single dedicated server with the right network card can cover all of IPv4 on a specific port in minutes.

Shodan and Censys use variants of these methods as the foundation of their collection infrastructure, running continuously from multiple points of presence around the world. Censys processes approximately 3 billion IP addresses per day and scans all 65,536 ports, not just the common ones. When an engineer spins up a container with an exposed port "just for today," the scanners have no way to know it is temporary and do not stop collecting.

Shodan, Censys, and FOFA Index Different Layers of the Same Surface

Shodan (John Matherly, 2009, San Diego) is the oldest TCP/UDP banner archive still in operation. It collects raw service responses on ports like 22 (SSH), 23 (Telnet), 27017 (MongoDB), 5432 (Postgres), 9200 (Elasticsearch), 5984 (CouchDB), and hundreds of others, maintaining a per-address banner history over time. Its strength lies in fingerprinting industrial devices, ICS, and IoT, and in the depth of its historical database, which allows comparing current state against previous snapshots.

Censys was created in 2015 by the same team behind ZMap: Zakir Durumeric and Alex Halderman. Unlike Shodan, Censys maintains a structured graph of hosts, TLS certificates, and domains with explicit relationships between entities. The 12.3-hour average detection performance comes from a more frequent scan cycle and correlation with Certificate Transparency logs and active DNS, which lets Censys detect new services before the next scan cycle even completes.

FOFA (Beijing Baimaohui Technology, 2015) indexes over 4 billion assets with an emphasis on web application fingerprinting and coverage of infrastructure in the Asia-Pacific region, which Western scanners systematically underindex. A target with significant presence in Chinese or South Asian data centers will appear far more completely in FOFA than in Shodan or Censys. Cross-validation across all three platforms is necessary: a service invisible on Shodan because it uses a non-standard port may be fully visible on Censys through its complete port scan.

Basic FOFA syntax: app="Apache" && country="BR" locates Apache servers in Brazil. protocol="mysql" && port=3306 && country="CN" finds exposed MySQL instances in China. For ASN cross-referencing: asn="AS12345" returns all indexed assets of the target AS, including frontends, proxies, and forgotten endpoints not visible on Shodan.

The most common objection from security teams is "our servers are in a private VPC." The misconception is that any service with a public IP, including load balancers, NAT gateways, and staging instances with open rules, enters the scan cycle. Censys scans all 65,535 ports, not just the standard ones. Non-standard ports provide no real protection against modern scanners.

What Gets Indexed: Banners, TLS Certificates, and HTTP Headers

When Shodan finds a service on port 443, it completes the TLS handshake, captures the full X.509 certificate (including Common Name, Subject Alternative Names, and issuing organization), and then makes an HTTP request to capture headers and page title. This is not just "open port" detection; it is metadata extraction that most teams do not actively monitor.

This process reveals which server version is running (Server: Apache/2.4.29), which security headers are missing (X-Content-Type-Options, Strict-Transport-Security), and which framework generated the HTML (X-Powered-By: Express). The SSH banner exposes the OpenSSH version. The SMTP banner exposes the relay software and, often, the server's internal hostname.

The TLS certificate exposes every domain that server is authorized to serve content for, even if those domains never appear in public DNS. The query ssl.cert.subject.cn:*.empresa.com.br on Shodan returns all servers with certificates issued for company subdomains, regardless of port or protocol. This maps the real surface, not the surface the team thinks it has.

Deployed, Forgotten, Indexed, Exploited

Of the 3,100 fully exposed MongoDB instances analyzed by researchers via Shodan (2017 data, Shodan blog), 45.6% had already been attacked: the original content was deleted and replaced with a ransom note demanding Bitcoin payment. These instances were not compromised through sophisticated exploits; a mongodump followed by db.dropDatabase() was enough because the port was open and unauthenticated.

Trend Micro identified 243,469 Kubernetes clusters with the kubelet API (port 10250) publicly exposed via Shodan (Trend Micro, May 2022). The kubelet API, when accessible without authentication, treats anonymous requests as valid by default, exposing running workloads, mounted secrets, and service account tokens. An attacker with Shodan access and basic Kubernetes knowledge can list running pods from an unprotected cluster without any prior contact with the organization.

Jenkins repeats the pattern: over 78,000 servers appear in http.title:"Jenkins" on Shodan (2023). Many expose the /api/json endpoint with build artifacts, internal repository URLs, and deploy credentials accessible to any HTTP client without authentication. The structural pattern is identical across all cases: service came up, firewall rule was deferred, scanner indexed it in hours, attacker queried it days or weeks later.

Auditing Your Own Surface Before the Attacker Does

The same passive methodology that attackers use can be run by the defensive team without touching the target's infrastructure. The starting point is enumerating the organization's ASNs via public BGP data and then querying Shodan, Censys, and FOFA for each registered IP range.

The Shodan CLI offers shodan myip to check what is indexed on the current IP and shodan search org:"Company Name" to sweep by ASN. The Censys CLI allows queries like censys search "autonomous_system.asn=12345 AND services.port=27017" to find MongoDB services within a specific ASN. Triage priority: database ports (27017, 5432, 9200, 6379, 5984), admin panels by http.title, and non-standard HTTPS ports carrying TLS certificates from the organization's domain.

The MAGO team tool automates this continuous monitoring: it ingests Shodan/Censys feeds, correlates with the declared surface, and alerts on deviations. Shodan Monitor and Censys ASM offer native alerts when new services appear in registered IP ranges; configuring them is the minimum viable step before any more elaborate attack surface management program.

The difference between organizations that detect exposures internally and those that discover them through a pentest report almost always comes down to the presence or absence of this passive automation. Your infrastructure is already indexed. The operational question is who queries that index first.