External Web Applications Discovery with Shodan and ImmuniWeb®

How many external websites, applications and (sub)domains does your company have? Compare free application discovery service by Shodan and ImmuniWeb® Discovery.

Vulnerable applications represent a huge risk for companies and organizations. One single abandoned subdomain, running an outdated WordPress installation, may open a door to successful APT attack against your company and compromise your digital crown jewels.

Shadow IT is one of the biggest sources of data breaches according to Gartner. In many companies, in-house and external developers unwittingly expose internal or applications in development (e.g. test environment) to the Internet, often with sensitive data and easily exploitable vulnerabilities. Many companies don’t even know how many of their applications are currently exposed to the Internet, let alone how (in)secure they are.

Cybercriminals on their turn run continuous monitoring for new apps and vulnerabilities. Once a public vulnerability appears for your CMS or CRM accessible from the outside, bad guys will start probing to exploit the flaw and takeover your web server. Worse, many cyber gangs will even patch the vulnerability to prevent their “competitors” from getting in.

Impending GDPR enforcement requires a comprehensive inventory and protection of Personally Identifiable Information (PII) that your company stores or process via a great wealth of intertwined applications, APIs and Web Services. This task becomes virtually impossible if you don’t have a comprehensive and up2date list of your web and mobile apps.

To help companies better identify and inventory their applications, we decided to compare [web] application discovery service offered by Shodan and ImmuniWeb® Discovery. Both services are available for free and provide commercial subscription for some extra options.

Being a reputable service, Shodan is a freemium OSINT search engine to look through all your publicly exposed devices, from network servers to specific IoT devices. ImmuniWeb® Discovery is a part of ImmuniWeb Application Security Testing Platform. It leverages intelligent algorithms and OSINT big data to detect external web and mobile apps attributable to your company or organization. Additionally, ImmuniWeb Discovery uses non-intrusive techniques to fingerprint CMS on the discovered applications. For every application, ImmuniWeb Discovery also assesses TLS encryption and web server security in a non-intrusive manner.

The comparison is based on publicly available data from Shodan and ImmuniWeb Discovery. For Shodan, we had to adjust the output format and remove some superfluous results (e.g. non-applications) for the purpose of the comparison. ImmuniWeb Discovery was tested directly via the customer portal.

We took five random organizations from completely different sectors, differentiating by size, complexity and scope of their external web systems. Below are the results obtained by non-intrusive OSINT discovery run by Shodan and ImmuniWeb Discovery:

openbsd.org

facebook.com

europa.eu

forbes.com

wwf.ch

For the purpose of this simple exercise, ImmuniWeb Discovery has significantly outperformed Shodan both by quality and quantity of the results. Nonetheless, we are continuously working on its algorithms to make them even more efficient and intelligent to eliminate the shadow in your IT.

To try ImmuniWeb Discovery for your organization, just sign-up on the Portal and explore your web and mobile apps (yes, we do detect mobiles apps too).

High-Tech Bridge Security Research High-Tech Bridge Security Research Team regularly writes about web and mobile application security, privacy, Machine Learning and AI.

User Comments

Add Comment

Allowed BB codes: [i], [u], [b], [quote]. Insulting or inappropriate comments will be immediately deleted. HTML is not allowed.

I agree with Privacy Policy