What is Threat Intelligence?
Threat intelligence is the collection, analysis, and use of information about potential or existing threats to an organization's assets. In the context of reconnaissance, threat intelligence tools help security professionals and penetration testers gather actionable data about:
- Internet-exposed devices and services
- Known malicious files and URLs
- Compromised credentials in data breaches
- Attack infrastructure and indicators of compromise (IOCs)
Good threat intelligence turns raw data into context that informs defensive decisions and offensive research.
Shodan
Shodan is a search engine for devices connected to the internet. Unlike Google, which indexes web content, Shodan indexes internet-connected devices and systems including:
- Servers and web applications
- Routers and network appliances
- Industrial control systems (ICS/SCADA)
- Webcams and IP cameras
- IoT devices
- VoIP phones and printers
Shodan works by continuously scanning the internet and collecting banner information from open ports. This makes it an extraordinarily powerful tool for:
- Discovering internet-facing infrastructure
- Identifying unpatched or outdated services
- Finding default credentials on exposed devices
- Mapping an organization's external attack surface
Example Shodan Queries:
hostname:target.com -- find all indexed assets under a domain
port:22 country:US -- SSH servers in the US
product:Apache version:2.2 -- find outdated Apache servers
default password -- devices with default credentials exposed
Shodan is freely accessible for basic searches. Registered accounts and paid plans unlock more results, filters, and API access.
Censys
Censys is similar to Shodan but with a different focus. While Shodan emphasizes internet-connected devices and systems broadly, Censys focuses specifically on:
- Internet-connected hosts and their open services
- Websites and their configurations
- TLS/SSL certificates and certificate chains
- Internet assets including domains, IP addresses, and associated metadata
Shodan vs. Censys:
Shodan:
└── IoT devices, routers, webcams, industrial systems, servers
Censys:
└── Hosts, websites, certificates, domains, internet infrastructure
Censys provides particularly strong certificate intelligence, making it useful for:
- Discovering subdomains through certificate transparency logs
- Identifying services using expired or misconfigured TLS certificates
- Mapping certificate relationships across an organization's infrastructure
Both tools complement each other and are used together for comprehensive internet-facing asset discovery.
VirusTotal
VirusTotal is an online service that provides multi-engine malware scanning for files, URLs, and file hashes.
How it works:
- A user uploads a file, submits a URL, or provides a file hash
- VirusTotal scans the submission against dozens of antivirus engines and website scanners simultaneously
- Results from all engines are aggregated and presented in a single report
Input Types:
├── File Upload → scanned by 70+ AV engines
├── URL Submission → checked for malware and phishing
└── File Hash (MD5, SHA1, SHA256) → checks results of previously scanned files
VirusTotal is particularly useful for:
- Incident response — checking whether a suspicious file found on a system is known malware
- Threat hunting — querying hashes extracted from logs or memory dumps
- Pre-deployment checks — verifying software before installation
- Malware research — analyzing behavioral reports from sandbox integrations
Important: Files submitted to VirusTotal are shared with the security community and antivirus vendors. Never upload sensitive or confidential files.
Have I Been Pwned (HIBP)
Have I Been Pwned (HIBP) does one thing exceptionally well: it tells you whether an email address has appeared in a known data breach.
When a service like LinkedIn, Adobe, or Dropbox suffers a breach, the stolen credentials are often compiled and sold or publicly released. HIBP aggregates these breach datasets and provides a searchable interface.
How HIBP Works:
1. Enter an email address
2. HIBP searches its database of known breached credential dumps
3. Returns: which breaches the email appeared in and what was exposed
Why this matters:
- Finding an email in breached data indicates that associated passwords may be exposed
- Many users reuse passwords across multiple platforms
- A single breach can cascade — one stolen password unlocks many accounts
From a penetration testing perspective, HIBP helps with:
- OSINT on target users — identifying employees whose credentials may be compromised
- Credential stuffing preparation — understanding which accounts have leaked passwords
- Social engineering intelligence — knowing which breaches affected target individuals
Intelligence-Gathering Workflow
These tools work together in a structured reconnaissance workflow:
Phase 1: Asset Discovery
├── Shodan → find internet-facing devices and services
└── Censys → map hosts, certificates, and web infrastructure
Phase 2: Vulnerability Intelligence
└── VirusTotal → check if known exploits target discovered software versions
Phase 3: Credential Intelligence
└── HIBP → identify breached credentials for target email addresses
Phase 4: Analysis
└── Combine findings to prioritize attack surface and entry points
Legal and Ethical Considerations
These tools are publicly accessible and legal to use for research, defensive security, and authorized penetration testing. However:
- Using intelligence gathered with these tools to attack systems without authorization is illegal
- VirusTotal file submissions are shared publicly — never upload sensitive files
- HIBP is designed for personal use and authorized security testing
Always operate within a clearly defined scope and with proper authorization before acting on intelligence gathered through these tools.