Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I just got my academic license for Shodan and I was playing around it. I noticed that when I use the
has_screenshot:true
filter it even shows screenshots from sites which requests authentication.
How is that possible? Because according to this, Shodan can not do that. So am I seeing a cached version or something?
Shodan doesn't authenticate with the device at all so most likely the device added authentication after it was already crawled/ indexed. The screenshot in Shodan isn't real-time. It was taken when the crawler visited the IP. You can use our new website to see the timestamp of when the data was collected (top right corner of the banner). And you can click the "History" tab to see how long that webcam has been online.
It is very unlikely this is the case. More than likely you're seeing results from previous scans. Or as Rory said, default results.Shodan tells you when the last time a scan was run against an asset, you can get an indication from this.
