Hunting Cobalt Strike C2 with Shodan

Michael Koczwara
2 min readSep 7, 2021
Cobalt Strike C2 Hunting

Four techniques:

  • Default certificate.
  • Hash + 50050 port (FP filtering is required).
  • JARM (FP filtering is required).
  • ASN/ISP scanning (this one is handy for subnet pivoting).

You can read my Twitter thread where I explained the logic behind each technique.