DC205 March Meetup: Shodan Showdown – The Great Internet Exposure Hunt
Date: March 28th, 2025
Time: 7 PM – 9 PM CST
Location: Red Mountain Makers (810 4th Ave N, Birmingham, AL 35203)
Talk: “Show And Tell” style event, bring your interesting find, people vote, win prizes.
Think you’ve got what it takes to uncover the internet’s strangest, most unexpected exposures?
Join us for a "Show and Tell" style contest, where YOU bring your best OSINT finds—misconfigurations, open databases, exposed dashboards, or other weird public discoveries (all legal & ethical, of course!). The community votes, and the most fascinating submission wins prizes!
Contest Overview:
Participants will use OSINT and public discovery techniques to find the most interesting publicly accessible system, service, or data on the internet. The goal is to uncover misconfigurations, unintended exposures, or fascinating open resources—without breaking any laws or ethical boundaries.
️ Rules and Ethical Guidelines:
- Prohibited Actions (Do NOT Do These):
-
- No Unauthorized Access – Do not bypass authentication (e.g., guessing passwords, using leaked credentials, or exploiting vulnerabilities).
- No Private/Personal Data – Do not access, collect, or share PII (Personally Identifiable Information).
- No Home Devices – Avoid things like personal webcams, baby monitors, smart home devices, etc.
- No Disrupting Services – Do not perform denial-of-service (DoS), fuzzing, or aggressive scanning that could cause harm.
- No Hacking or Exploiting – If you find something vulnerable, report it responsibly but do not exploit it.
- No Accessing Paid or Restricted Content – If a website/service is meant to be behind a paywall or login, it is off-limits.
- No .onion TOR / dark web hosted sites
- · ✅ Allowed Actions (What You CAN Do):
· Use Public Search Tools – Shodan, Censys, Google Dorking, Wayback Machine, etc.
· Look for Open and Public Data – Misconfigured S3 buckets, open Elasticsearch/Kibana dashboards, public repositories.
· Find Interesting Misconfigurations – Public Jenkins servers, exposed dashboards, unsecured databases.
· Use Passive Reconnaissance – WHOIS lookups, certificate transparency logs, subdomain enumeration (without active brute force).
· Submit a Cool Find – The most unusual or unexpected publicly accessible system wins!
Scoring Criteria:
- · Findings will be judged on:
- · Uniqueness – Is it a one-of-a-kind exposure?
- · Impact – Could this exposure pose a real risk if misused?
- · Humor/Coolness Factor – The weirder or more unexpected, the better!
- · Legality & Ethics – Must follow all contest rules.
Prizes & Recognition:
1st Place – Full Conference Pass to the Southeast Cybersecurity Summit
2nd Place – A copy of The Hacker Mindset book
3rd Place – Social Media Shoutout
Winners also get an optional social media shoutout! Want to flex your OSINT skills to the world? We’ll feature your winning find (with your permission) on DC205’s socials—because good recon deserves recognition.
RSVP & More Info: https://discordapp.com/channels/893886927793696799/1156078296430297199/1347385061938303098
Who will uncover the wildest internet exposure? Find it, bring it, and battle it out at Shodan Showdown!
