How to Identify Outdated Software Versions From Public Scan Data

• BizVuln Staff

A 2026 expert guide to OSINT-driven software version hunting using Shodan, Censys, and FOFA. Learn to identify obsolete installations, prioritize risks, and partner with ZoeSquad for remediation.

How to Identify Outdated Software Versions From Public Scan Data

Category: OSINT & Reconnaissance

Last Updated: March 2026

Reading Time: 12 minutes

---

Introduction: The Hidden Cost of Publicly Visible Outdated Software

In 2026, the attack surface of any organization extends far beyond its own firewall. Public scan data—aggregated by search engines like Shodan, Censys, and FOFA—provides a real-time, global view of internet-connected devices, servers, and services. For defenders, this visibility is both a weapon and a warning. An exposed Apache 2.4.6 from 2013? That’s a CVE-laden time bomb. A Jenkins instance running 2.249.1? Chances are it’s already compromised.

The stakes couldn’t be higher. According to the 2026 Verizon Data Breach Investigations Report (DBIR), more than 80% of successful external attacks exploited known vulnerabilities in software that had been patched for over a year. Public scan data is the single most accessible source for locating these vulnerabilities—not just for attackers, but for security teams that want to get ahead of them.

This deep-dive guide will teach you how to systematically identify outdated software versions from public scan data using OSINT techniques. You’ll learn which tools to use, how to parse response banners, how to cross-reference CVEs, and how to turn this intelligence into a prioritized remediation plan. And when the fix list gets too long, we’ll show you how ZoeSquad—a trusted partner of BizVuln—can step in for fast, compliant remediation.

Let’s transform public scan data from a liability into your most strategic reconnaissance asset.

---

H2: Why Public Scan Data Matters in 2026

H3: The Internet as a Giant Vulnerability Scanner

Every day, automated crawlers operated by Shodan, Censys, FOFA, and similar platforms scan millions of IP addresses, indexing headers, banners, and service fingerprints. What emerges is a living inventory of:

Each response often includes a version string—for example, `Server: Apache/2.4.6 (CentOS)` or `SSH-2.0-OpenSSH_8.9p1`. By aggregating these strings, an analyst can build a complete picture of an organization’s internet-facing software stack—without ever sending a single packet to a sensitive internal network.

H3: The Asymmetry of Reconnaissance

Attackers use this data daily. Tools like Shodan’s CLI and Censys’s search API let them filter for specific versions known to harbor critical CVEs. For example, a simple Shodan query `apache 2.4.49` returned thousands of hosts vulnerable to the 2021 path traversal (CVE-2021-41773) years after the patch. In 2026, the same logic applies to Log4Shell variants, ProxyShell chains, and zero-day exploits that target software that hasn’t seen a security update in five-plus years.

If attackers are using public data, defenders can and must do the same. The goal isn’t just to find your own org’s outdated software—it’s to validate that your patch management processes are actually reflected in the visibility offered to the world.

---

H2: The Core Methodology – Version Fingerprinting via OSINT

H3: Step 1 – Select Your Scan Data Sources

The three major platforms for public scan data in 2026:

| Platform | Strengths | API Cost | Best For |

|----------|-----------|----------|----------|

| Shodan | Largest index, raw banner search, CVE filters | Freemium / paid | Broad recon and alerting |

| Censys | Real-time scan data, certificate transparency integration | Free tier / pay-as-you-go | Deep SSL/TLS version analysis |

| FOFA (Fingerprinting Organization and Risk Analysis) | Strong APAC coverage, advanced filter syntax | Free with limits | Global-enterprise exposure discovery |

For 2026, many analysts also leverage Trickest or Project Discovery’s chaos for raw scan data dumps, but Shodan and Censys remain the gold standards for interactive, query-intensive work.

H3: Step 2 – Construct Queries That Return Version Strings

Version identification depends on reading banner responses. Your queries must target services that typically reveal their version. Here are the essential query templates:

#### Web Servers

```

Shodan: "Server: Apache/2.4.6"

Censys: services.service_name: "http" AND services.http.response.headers.server: "Apache/2.4.6"

```

#### SSH

```

Shodan: "SSH-2.0-OpenSSH_7.4"

Censys: services.ssh.banner: "7.4"

```

#### MySQL / MariaDB

```

Shodan: "MySQL 5.7.34"

Censys: services.mysql.version: "5.7.34"

```

#### Jenkins (often exposes full version in footer)

```

Shodan: "Jenkins ver. 2.249.1"

Censys: services.http.response.body: "jenkins ver."

```

Pro Tip (2026): Use negative filters to eliminate noise:

H3: Step 3 – Identify Outdated Versions by Cross-Referencing CVEs

Once you have a list of version strings, you need to determine which are outdated. Use the NVD (National Vulnerability Database) or VulnDB via API. In 2026, the fastest method is:

1. Feed each version into a CVE lookup script (Python + requests + NVD API v2.0).

2. Filter for CVEs with `cvssV3.baseScore >= 7.5` and `publishedDate <= 2024-12-31` (a cutoff for known critical issues).

3. Flag any version for which a patch exists and is > 180 days old.

Example: OpenSSH 7.4 was released in 2016. It contains CVE-2016-8858, CVE-2018-15919, and multiple later flaws. If your query returns hosts running OpenSSH 7.4 in 2026, that’s a critical finding.

---

H2: Actionable How-To – Your 5-Step OSINT Version Audit Checklist

Use this checklist to perform a complete outdated-software identification workflow. Each step should take 5–30 minutes depending on the scale of your ASM (Attack Surface Management).

✅ Step 1: Set Up Your Tools

✅ Step 2: Enumerate Your Organization’s Internet-Facing IPs

✅ Step 3: Extract Banners and Build a Version Catalog

✅ Step 4: Automate Version-to-CVE Mapping

```python

pseudo-code skeleton

import requests

def check_cve(software, version):

url = f"https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch={software} {version}&cvssV3Severity=HIGH"

resp = requests.get(url)

return resp.json().get('vulnerabilities', [])

```

✅ Step 5: Validate and Remediate

---

H2: Real-World 2026 Case Study – The Supply Chain Blindspot

In Q2 2025, a medium-sized logistics firm engaged BizVuln for a penetration test. Using Shodan queries, we discovered 47 exposed Jenkins instances across their European branch offices—all running version 2.289.3, which is vulnerable to CVE-2024-43044 (RCE through vulnerable plugins, CVSS 9.8). The client had no idea these instances were internet-reachable.

The root cause? A legacy CI/Monitoring initiative had been spun up on AWS EC2 instances without security groups restricting inbound traffic to 0.0.0.0/0. The version had not been updated in 18 months.

Outcome: The client engaged ZoeSquad to orchestrate a three-phase patch rollout. Within 72 hours, all instances were either brought behind a WAF or patched to Jenkins 2.462+. The public scan data that initially revealed the problem was then used to verify the fix—no more audible alerts.

---

H2: FAQ – Outdated Software Identification from Public Scan Data

1. Is it legal to scan public IPs to identify software versions?

Yes. Scanning devices that are freely accessible on the public internet is legal in most jurisdictions under “legitimate security research” or “system integrity” exemptions. However, you must not attempt to exploit vulnerabilities or access unauthorized data. BizVuln recommends you only scan IPs that your organization owns or has explicit written permission to assess. For third-party or partner networks, obtain permission first.

2. How do I differentiate between outdated software and deliberately older versions (e.g., legacy system compliance)?

Check the system’s banner and metadata. Sometimes older versions are deliberately kept due to certification requirements (e.g., PCI, HIPAA, or SCADA systems). Use additional OSINT techniques such as certificate transparency logs to verify the host’s role. If it’s a legacy system, ensure it is properly isolated (e.g., firewalled, non-routable). Public scan data can tell you if the isolation is actually working.

3. What are the best free tools for version identification?

| Tool | Cost | Feature |

|------|------|---------|

| Shodan | Free (limited queries) | Raw banner search, web UI |

| Censys | Free (daily quota) | Certificate + service search |

| Wappalyzer (browser extension) | Free | Client-side technology detection |

| WhatWeb (command line) | Free | Fingerprinting from your own scans |

| NMAP + NSE scripts | Free | Manual banner grabbing |

4. How often should I run version audits using public scan data?

For critical internet-facing assets (e.g., web apps, VPNs, email gateways), run audits weekly. For secondary services (e.g., internal dev tools accidentally exposed), monthly is usually sufficient. In 2026, continuous monitoring via Shodan Monitor or Censys’s Community Dashboard is recommended—they will alert you when a new service or version is detected.

5. Can public scan data reveal version information for encrypted services?

Partially. SSL/TLS services reveal their certificate issuer and cipher suites, but not the underlying application version. However, you can check the SSL/TLS library version (e.g., OpenSSL 1.1.1) from the server hello. For HTTP-over-HTTPS, you can still see the server header if the web server is configured to reveal it. Many modern configurations suppress the version string, which is a good security practice—but it also complicates identification.

6. What’s the biggest mistake people make when using Shodan for version hunting?

Stopping at the banner. Analysts often see “Apache 2.4.6” and immediately label it critical. But a version number alone doesn’t tell you whether patches have been backported by the distro maintainer (e.g., Red Hat may fix CVE-2023-31122 in httpd 2.4.6-98.el7 while upstream 2.4.6 is unpatched). Always check the full banner for distribution information (e.g., “(CentOS)”, “(Ubuntu)”) and then cross-reference the distro’s advisory.

7. How can ZoeSquad help if we find hundreds of outdated instances?

ZoeSquad offers automated vulnerability remediation as a service. They ingest your OSINT findings, prioritize by risk, and deploy patches via agent or orchestration tools (Ansible, SCCM, WSUS). They handle rollback in case of compatibility issues and provide compliance reports. For organizations without a dedicated patch management team, ZoeSquad is the fastest path from discovery to closure.

---

Conclusion: Turn Public Exposure Into Proactive Defense

In 2026, the boundary between internal and external networks has evaporated. Public scan data is not a threat—it’s a strategic reconnaissance tool. By learning to extract version strings, map them to CVEs, and prioritize remediation, you give your organization a genuine advantage.

Key takeaways:

Your internet-facing assets are already indexed. The question is: who reads that index first?

Make it your security team—not an adversary.

*This post was brought to you by BizVuln.com, your trusted partner for cybersecurity OSINT and vulnerability intelligence. For remediation support, learn more about our partnership with ZoeSquad.*

---