Home / Linux / System utilities

πŸ” A collection of interesting, funny, and depressing search queries to plug into https://shodan.io/ πŸ‘©β€πŸ’»

πŸ” A collection of interesting, funny, and depressing search queries to plug into https://shodan.io/ πŸ‘©β€πŸ’»
Information
Category: Linux / System utilities
Watchers: 154
Star: 4.1k
Fork: 692
Last update: May 18, 2023
Resource links
https://github.com/jakejarvis/awesome-shodan-queries

Awesome Shodan Search Queries Awesome

Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.


Most search filters require a Shodan account.

You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.

The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t β€” and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.

And as always, discover and disclose responsibly! πŸ€“

Table of Contents

Industrial Control Systems

Samsung Electronic Billboards πŸ”Ž β†’

"Server: Prismview Player"
Example: Electronic Billboards

Gas Station Pump Controllers πŸ”Ž β†’

"in-tank inventory" port:10001
Example: Gas Station Pump Inventories

Automatic License Plate Readers πŸ”Ž β†’

P372 "ANPR enabled"
Example: Automatic License Plate Reader

Traffic Light Controllers / Red Light Cameras πŸ”Ž β†’

mikrotik streetlight

Voting Machines in the United States πŸ”Ž β†’

"voter system serial" country:US

Telcos Running Cisco Lawful Intercept Wiretaps πŸ”Ž β†’

"Cisco IOS" "ADVIPSERVICESK9_LI-M"

Wiretapping mechanism outlined by Cisco in RFC 3924:

Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.

Prison Pay Phones πŸ”Ž β†’

"[2J[H Encartele Confidential"

Tesla PowerPack Charging Status πŸ”Ž β†’

http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Example: Tesla PowerPack Charging Status

Electric Vehicle Chargers πŸ”Ž β†’

"Server: gSOAP/2.8" "Content-Length: 583"

Maritime Satellites πŸ”Ž β†’

Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!

"Cobham SATCOM" OR ("Sailor" "VSAT")
Example: Maritime Satellites

Submarine Mission Control Dashboards πŸ”Ž β†’

title:"Slocum Fleet Mission Control"

CAREL PlantVisor Refrigeration Units πŸ”Ž β†’

"Server: CarelDataServer" "200 Document follows"
Example: CAREL PlantVisor Refrigeration Units

Nordex Wind Turbine Farms πŸ”Ž β†’

http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"

C4 Max Commercial Vehicle GPS Trackers πŸ”Ž β†’

"[1m[35mWelcome on console"
Example: C4 Max Vehicle GPS

DICOM Medical X-Ray Machines πŸ”Ž β†’

Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.

"DICOM Server Response" port:104

GaugeTech Electricity Meters πŸ”Ž β†’

"Server: EIG Embedded Web Server" "200 Document follows"
Example: GaugeTech Electricity Meters

Siemens Industrial Automation πŸ”Ž β†’

"Siemens, SIMATIC" port:161

Siemens HVAC Controllers πŸ”Ž β†’

"Server: Microsoft-WinCE" "Content-Length: 12581"

Door / Lock Access Controllers πŸ”Ž β†’

"HID VertX" port:4070

Railroad Management πŸ”Ž β†’

"log off" "select the appropriate"

Remote Desktop

Unprotected VNC πŸ”Ž β†’

"authentication disabled" "RFB 003.008"

Shodan Images is a great supplementary tool to browse screenshots, by the way! πŸ”Ž β†’

Example: Unprotected VNC
The first result right now. 😞

Windows RDP πŸ”Ž β†’

99.99% are secured by a secondary Windows login screen.

"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"

Network Infrastructure

Weave Scope Dashboards πŸ”Ž β†’

Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.

title:"Weave Scope" http.favicon.hash:567176827
Example: Weave Scope Dashboards

MongoDB πŸ”Ž β†’

Older versions were insecure by default. Very scary.

"MongoDB Server Information" port:27017 -authentication
Example: MongoDB

Mongo Express Web GUI πŸ”Ž β†’

Like the infamous phpMyAdmin but for MongoDB.

"Set-Cookie: mongo-express=" "200 OK"
Example: Mongo Express GUI

Jenkins CI πŸ”Ž β†’

"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Example: Jenkins CI

Docker APIs πŸ”Ž β†’

"Docker Containers:" port:2375

Docker Private Registries πŸ”Ž β†’

"Docker-Distribution-Api-Version: registry" "200 OK" -gitlab

Pi-hole Open DNS Servers πŸ”Ž β†’

"dnsmasq-pi-hole" "Recursion: enabled"

Already Logged-In as root via Telnet πŸ”Ž β†’

"root@" port:23 -login -password -name -Session

Android Root Bridges πŸ”Ž β†’

A tangential result of Google's sloppy fractured update approach. πŸ™„ More information here.

"Android Debug Bridge" "Device" port:5555

Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords πŸ”Ž β†’

Lantronix password port:30718 -secured

Citrix Virtual Apps πŸ”Ž β†’

"Citrix Applications:" port:1604
Example: Citrix Virtual Apps

Cisco Smart Install πŸ”Ž β†’

Vulnerable (kind of "by design," but especially when exposed).

"smart install client active"

PBX IP Phone Gateways πŸ”Ž β†’

PBX "gateway console" -password port:23

Polycom Video Conferencing πŸ”Ž β†’

http.title:"- Polycom" "Server: lighttpd"

Telnet Configuration: πŸ”Ž β†’

"Polycom Command Shell" -failed port:23
Example: Polycom Video Conferencing

Bomgar Help Desk Portal πŸ”Ž β†’

"Server: Bomgar" "200 OK"

Intel Active Management CVE-2017-5689 πŸ”Ž β†’

"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995

HP iLO 4 CVE-2017-12542 πŸ”Ž β†’

HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900

Outlook Web Access:

Exchange 2007 πŸ”Ž β†’

"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Example: OWA for Exchange 2007

Exchange 2010 πŸ”Ž β†’

"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Example: OWA for Exchange 2010

Exchange 2013 / 2016 πŸ”Ž β†’

"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Example: OWA for Exchange 2013/2016

Lync / Skype for Business πŸ”Ž β†’

"X-MS-Server-Fqdn"

Network Attached Storage (NAS)

SMB (Samba) File Shares πŸ”Ž β†’

Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.

"Authentication: disabled" port:445

Specifically domain controllers: πŸ”Ž β†’

"Authentication: disabled" NETLOGON SYSVOL -unix port:445

Concerning default network shares of QuickBooks files: πŸ”Ž β†’

"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445

FTP Servers with Anonymous Login πŸ”Ž β†’

"220" "230 Login successful." port:21

Iomega / LenovoEMC NAS Drives πŸ”Ž β†’

"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Example: Iomega / LenovoEMC NAS Drives

Buffalo TeraStation NAS Drives πŸ”Ž β†’

Redirecting sencha port:9000
Example: Buffalo TeraStation NAS Drives

Logitech Media Servers πŸ”Ž β†’

"Server: Logitech Media Server" "200 OK"
Example: Logitech Media Servers

Plex Media Servers πŸ”Ž β†’

"X-Plex-Protocol" "200 OK" port:32400

Tautulli / PlexPy Dashboards πŸ”Ž β†’

"CherryPy/5.1.0" "/home"
Example: PlexPy / Tautulli Dashboards

Webcams

Example images not necessary. 🀦

Yawcams πŸ”Ž β†’

"Server: yawcam" "Mime-Type: text/html"

webcamXP/webcam7 πŸ”Ž β†’

("webcam 7" OR "webcamXP") http.component:"mootools" -401

Android IP Webcam Server πŸ”Ž β†’

"Server: IP Webcam Server" "200 OK"

Security DVRs πŸ”Ž β†’

html:"DVR_H264 ActiveX"

Printers & Copiers:

HP Printers πŸ”Ž β†’

"Serial Number:" "Built:" "Server: HP HTTP"
Example: HP Printers

Xerox Copiers/Printers πŸ”Ž β†’

ssl:"Xerox Generic Root"
Example: Xerox Copiers/Printers

Epson Printers πŸ”Ž β†’

"SERVER: EPSON_Linux UPnP" "200 OK"

"Server: EPSON-HTTP" "200 OK"
Example: Epson Printers

Canon Printers πŸ”Ž β†’

"Server: KS_HTTP" "200 OK"

"Server: CANON HTTP Server"
Example: Canon Printers

Home Devices

Yamaha Stereos πŸ”Ž β†’

"Server: AV_Receiver" "HTTP/1.1 406"
Example: Yamaha Stereos

Apple AirPlay Receivers πŸ”Ž β†’

Apple TVs, HomePods, etc.

"\x08_airplay" port:5353

Chromecasts / Smart TVs πŸ”Ž β†’

"Chromecast:" port:8008

Crestron Smart Home Controllers πŸ”Ž β†’

"Model: PYNG-HUB"

Random Stuff

OctoPrint 3D Printer Controllers πŸ”Ž β†’

title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Example: OctoPrint 3D Printers

Etherium Miners πŸ”Ž β†’

"ETH - Total speed"
Example: Etherium Miners

Apache Directory Listings πŸ”Ž β†’

Substitute .pem with any extension or a filename like phpinfo.php.

http.title:"Index of /" http.html:".pem"

Misconfigured WordPress πŸ”Ž β†’

Exposed wp-config.php files containing database credentials.

http.html:"* The wp-config.php creation script uses this file"

Too Many Minecraft Servers πŸ”Ž β†’

"Minecraft Server" "protocol 340" port:25565

Literally Everything in North Korea πŸ‡°πŸ‡΅ πŸ”Ž β†’

net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24

TCP Quote of the Day πŸ”Ž β†’

Port 17 (RFC 865) has a bizarre history...

port:17 product:"Windows qotd"

Find a Job Doing This! πŸ‘©β€πŸ’Ό πŸ”Ž β†’

"X-Recruiting:"

If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.

Bon voyage, fellow penetrators! πŸ˜‰

License

CC0

To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.

Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.

10 Open More issues
Closed

OR Operator not working?

I know you can effectively do an OR operator for multiple items in the same field such as a comma separated list of IP addresses, but is it possible to do an OR operator on different fields such as:

ssl.cert.subject.cn:google.com OR hostname:google.com

With the OR word or something like a pipe symble (|).

I've seen examples like this on the web, but they don't seem to work anymore.

I tried asking here: https://twitter.com/paul_masek/status/1578431147482435585 , but no response to my latest question about different fields.

opened Oct 11, 2022 by itpropaul 0
Closed

add ThinVNC vulnerable desktops

https://gist.github.com/Gusted/ff545600e60b0fa03d1fbaf95d237751 ThinVNC are vulnerable for authentication bypass

opened Oct 19, 2019 by Gusted 0
Open

Shodan

null

opened May 24, 2023 by CrowMRG90 0
Open

added threat hunting queries

appended threathunting queries

  • table of content entry "Threathunting"
  • content entry "Threathunting" ++ added entries {C2 traffic, Cobalt Strike, Metasploit Framework, Covenant, Mythic, Brute Ratel C4}
  • Sources/ credits entries
opened Jul 27, 2022 by H3liumBoy 0
Open

"voter system serial" country:US

The (voter system serial" country:US) query does not identify voting machines, but a specific serial radio (AM, FM) system.

http://wvraclub.org/technical-documents/what-is-a-receiver-voting-system/

opened Mar 14, 2022 by RoseSecurity 0
Open

Ebook Libraries

This is typically what I use:

server: calibre country:"US"

Of course, remove or change the country bit to expand the results.

opened Dec 28, 2021 by ninjanerdbgm 0
Open

New query

"rdesktop" or "remote desktop protocol" If you have rdesktop, you may be able to connect to them. To get a login screen, all you need is the IP address.

opened Dec 23, 2021 by SilentFist 0
Open

Update ILO

New query:

HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" !"HP-iLO-4/2.71" !"HP-iLO-4/2.72" !"HP-iLO-4/2.73" !"HP-iLO-4/2.74" !"HP-iLO-4/2.75" !"HP-iLO-4/2.76" port:1900
opened Nov 18, 2020 by craftbyte 2

Contents

    aqhmal Automated script for F5 BIG-IP scanner (CVE-2020-5902) using hosts retrieved from Shodan API.
    pielco11 IP lookup by favicon using Shodan
    blackhatethicalhacking A Python Tool that uses Shodan API's to perform quick recon for vulnerabilities
    RoseSecurity A Proof-of-Concept tool utilizing open DNS resolvers to produce an amplification attack against web servers. Using Shodan APIs and native Linux commands, this tool is in development to cripple web servers using spoofed DNS recursive queries.
    eclipse-embed-cdt The Eclipse Embedded CDT plug-ins for Arm & RISC-V C/C++ developers (formerly known as the GNU MCU Eclipse plug-ins)
    JLospinoso Use your Shodan API Key to dump all the contents of exposed memcached servers.
    whtsky vuex-queries - Vuex-Queries helps you write query functions in Vuex
    Naategh A collection of funny bash scripts
    flintlok A Python-based application demonstrating various search algorithms, namely Depth-First Search (DFS), Breadth-First Search (BFS), and A* Search (Manhattan Distance Heuristic)
    kensho-technologies Turn complex GraphQL queries into optimized database queries.
    m4ll0k Get ports,vulnerabilities,informations,banners,..etc for any IP with Shodan
    ninoseki Learning Shodan through katas
    woj-ciech Create visualization from Shodan query
    denysdovhan A list of funny and tricky JavaScript examples
    haofanwang Search photos on Unsplash based on OpenAI's CLIP model, support search with joint image+text queries and attention visualization.
    SilenceDut A Funny ToggleButton for day and night change
    npgall Ultra-fast SQL-like queries on Java collections
    e-neuman Funny, human-memorable, sha-256 fingerprints
    MisakaCenter πŸ€Chi is a subset of Common Lisp, implemented in Python3. Yet another mal, but with a funny lexer.
    JorgeCastilloPrz Android fillable progress view working with SVG paths. This is a nice option too if you want to create an interesting branding logo for your app. Based on the iOS project: https://github.com/poolqf/FillableLoaders
    lwdgit gitbook powerful search plugin
    Share this repo

    Related Repos


    System utilities
    24
    Files used for reproducing Fuzzware's experiments
    fuzzware-fuzzer Fuzzware Experiments This directory contains the data required to reproduce the experiments from our USENIX 2022 publication Fuzzware: Using Precise M
     
    System utilities
    25
    Presentation plugin for neovim written in lua
    Chaitanyabsprip Presenting.nvim A Presentation plugin written for Neovim in Lua Installation You can install Present with your plugin manager of choice with packer.nv
     
    System utilities
    3
    Static analysis tool for Go that finds vulnerabilities using SSA (single static assignment...
    bryk-io GitHub Action: GoKart Security Static Analysis GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA (single static assignm
     
    System utilities
    3
    Railway for Alist
    alist-org alist-railway Railway for Alist Usage Fork this repo Open Railway and click New Object Choose the repo that you forked and select the mysql branch Add
     
    System utilities
    19
    Basic Recon For Bug Bounty Hunter - "HuntTheBug" is Basic Scripts For Sub Domain Enumerati...
    vikrantbatra05 Basic Recon For Bug Bounty Hunter - "HuntTheBug" is Basic Scripts For Sub Domain Enumeration> Live Domain Enumeration > Sub Domain Hijack > URL + JavaScript Scan > Dir Brute Forcing > Open Port Check With Telegram Bot Notification
     
    System utilities
    84
    Extensible Neovim Scrollbar
    petertriho nvim-scrollbar Extensible Neovim Scrollbar 🚧 WORK IN PROGRESS 🚧 This is a work in progress and breaking changes to the setup/config could occur in t
     
    System utilities
    5
    😎😘 Free Windows 11 VPS for 4 Hours ! Easy Method!
    kmille36 Windows 11 RDP Here this tutorial using Azure Cloud Shell to create Virtual Machine on Microsoft Learn Sandbox. 😎 Its Four Hours RDP Completely Free
     
    System utilities
    3
    My configuraion files
    3Kevi Welcome! Here you can find my Void Linux dotfiles. Overview OS: Void Window manager: bspwm Terminal: kitty Shell: zsh Bar: Polybar Compositor: picom P
     
    System utilities
    3
    An especially small & quick & simple Algolia docsearch Indices upload action
    guzhongren algolia-docsearch-upload-action An especially small & quick & simple Algolia docsearch Indices upload action Usage - name: Algolia Docsearch Uploa
     
    System utilities
    35
    A simple and transparent alternative to boot2docker (backed by Vagrant)
    shyiko docker-vm The easiest way to get started with Docker on Mac OS X (tested on OS X Yosemite 10.10.1) and Windows (tested on Windows 10 Pro Insider Previ
     
    System utilities
    518
    GitOps powered K8s app suite with developer self-service
    redkubes Shift left with Otomi Otomi makes developers self-serving and helps DevOps teams to guarantee application security and availability at the earliest st
     
    System utilities
    102
    Awesome Bug bounty builder Project
    0xJin Awesome Bug Bounty Builder Β―\(ツ)/Β― Awesome Bug bounty builder Project - ALL common Tools for find your Vulnerabilities. Tested on Debian. Installation
     
    System utilities
    2
    Ready-to-use VSCode setup to preview/convert markdown documents
    logwolvy Ready-to-use VSCode setup to preview/convert markdown documents
     
    System utilities
    6.9k
    Testing TLS/SSL encryption anywhere on any port
    drwetter Testing TLS/SSL encryption anywhere on any port
     
    System utilities
    519
    Vegile - Ghost In The Shell
    Screetsec Vegile is a tool for Post exploitation Techniques in linux. Post Exploitation techniques will ensure that we maintain some level of access and can potentially lead to deeper footholds into our targets trusted network.