Awesome Shodan Search Queries 
Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.
Most search filters require a Shodan account.
You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.
The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t โ and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.
And as always, discover and disclose responsibly! ๐ค
Table of Contents
- Industrial Control Systems
- Remote Desktop
- Network Infrastructure
- Network Attached Storage (NAS)
- Webcams
- Printers & Copiers
- Home Devices
- Random Stuff
Industrial Control Systems
Samsung Electronic Billboards ๐ โ
"Server: Prismview Player"
Gas Station Pump Controllers ๐ โ
"in-tank inventory" port:10001
Automatic License Plate Readers ๐ โ
P372 "ANPR enabled"
Traffic Light Controllers / Red Light Cameras ๐ โ
mikrotik streetlight
Voting Machines in the United States ๐ โ
"voter system serial" country:US
Telcos Running Cisco Lawful Intercept Wiretaps ๐ โ
"Cisco IOS" "ADVIPSERVICESK9_LI-M"
Wiretapping mechanism outlined by Cisco in RFC 3924:
Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.
Prison Pay Phones ๐ โ
"[2J[H Encartele Confidential"
Tesla PowerPack Charging Status ๐ โ
http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Electric Vehicle Chargers ๐ โ
"Server: gSOAP/2.8" "Content-Length: 583"
Maritime Satellites ๐ โ
Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!
"Cobham SATCOM" OR ("Sailor" "VSAT")
Submarine Mission Control Dashboards ๐ โ
title:"Slocum Fleet Mission Control"
CAREL PlantVisor Refrigeration Units ๐ โ
"Server: CarelDataServer" "200 Document follows"
Nordex Wind Turbine Farms ๐ โ
http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"
C4 Max Commercial Vehicle GPS Trackers ๐ โ
"[1m[35mWelcome on console"
DICOM Medical X-Ray Machines ๐ โ
Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.
"DICOM Server Response" port:104
GaugeTech Electricity Meters ๐ โ
"Server: EIG Embedded Web Server" "200 Document follows"
Siemens Industrial Automation ๐ โ
"Siemens, SIMATIC" port:161
Siemens HVAC Controllers ๐ โ
"Server: Microsoft-WinCE" "Content-Length: 12581"
Door / Lock Access Controllers ๐ โ
"HID VertX" port:4070
Railroad Management ๐ โ
"log off" "select the appropriate"
Remote Desktop
Unprotected VNC ๐ โ
"authentication disabled" "RFB 003.008"
Shodan Images is a great supplementary tool to browse screenshots, by the way! ๐ โ
The first result right now. ๐
Windows RDP ๐ โ
99.99% are secured by a secondary Windows login screen.
"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"
Network Infrastructure
Weave Scope Dashboards ๐ โ
Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.
title:"Weave Scope" http.favicon.hash:567176827
MongoDB ๐ โ
Older versions were insecure by default. Very scary.
"MongoDB Server Information" port:27017 -authentication
Mongo Express Web GUI ๐ โ
Like the infamous phpMyAdmin but for MongoDB.
"Set-Cookie: mongo-express=" "200 OK"
Jenkins CI ๐ โ
"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Docker APIs ๐ โ
"Docker Containers:" port:2375
Docker Private Registries ๐ โ
"Docker-Distribution-Api-Version: registry" "200 OK" -gitlab
Pi-hole Open DNS Servers ๐ โ
"dnsmasq-pi-hole" "Recursion: enabled"
Already Logged-In as root via Telnet ๐ โ
"root@" port:23 -login -password -name -Session
Android Root Bridges ๐ โ
A tangential result of Google's sloppy fractured update approach. ๐ More information here.
"Android Debug Bridge" "Device" port:5555
Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords ๐ โ
Lantronix password port:30718 -secured
Citrix Virtual Apps ๐ โ
"Citrix Applications:" port:1604
Cisco Smart Install ๐ โ
Vulnerable (kind of "by design," but especially when exposed).
"smart install client active"
PBX IP Phone Gateways ๐ โ
PBX "gateway console" -password port:23
Polycom Video Conferencing ๐ โ
http.title:"- Polycom" "Server: lighttpd"
Telnet Configuration: ๐ โ
"Polycom Command Shell" -failed port:23
Bomgar Help Desk Portal ๐ โ
"Server: Bomgar" "200 OK"
Intel Active Management CVE-2017-5689 ๐ โ
"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995
HP iLO 4 CVE-2017-12542 ๐ โ
HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900
Outlook Web Access:
Exchange 2007 ๐ โ
"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Exchange 2010 ๐ โ
"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Exchange 2013 / 2016 ๐ โ
"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Lync / Skype for Business ๐ โ
"X-MS-Server-Fqdn"
Network Attached Storage (NAS)
SMB (Samba) File Shares ๐ โ
Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.
"Authentication: disabled" port:445
Specifically domain controllers: ๐ โ
"Authentication: disabled" NETLOGON SYSVOL -unix port:445
Concerning default network shares of QuickBooks files: ๐ โ
"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445
FTP Servers with Anonymous Login ๐ โ
"220" "230 Login successful." port:21
Iomega / LenovoEMC NAS Drives ๐ โ
"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Buffalo TeraStation NAS Drives ๐ โ
Redirecting sencha port:9000
Logitech Media Servers ๐ โ
"Server: Logitech Media Server" "200 OK"
Plex Media Servers ๐ โ
"X-Plex-Protocol" "200 OK" port:32400
Tautulli / PlexPy Dashboards ๐ โ
"CherryPy/5.1.0" "/home"
Webcams
Example images not necessary. ๐คฆ
Yawcams ๐ โ
"Server: yawcam" "Mime-Type: text/html"
webcamXP/webcam7 ๐ โ
("webcam 7" OR "webcamXP") http.component:"mootools" -401
Android IP Webcam Server ๐ โ
"Server: IP Webcam Server" "200 OK"
Security DVRs ๐ โ
html:"DVR_H264 ActiveX"
Printers & Copiers:
HP Printers ๐ โ
"Serial Number:" "Built:" "Server: HP HTTP"
Xerox Copiers/Printers ๐ โ
ssl:"Xerox Generic Root"
Epson Printers ๐ โ
"SERVER: EPSON_Linux UPnP" "200 OK"
"Server: EPSON-HTTP" "200 OK"
Canon Printers ๐ โ
"Server: KS_HTTP" "200 OK"
"Server: CANON HTTP Server"
Home Devices
Yamaha Stereos ๐ โ
"Server: AV_Receiver" "HTTP/1.1 406"
Apple AirPlay Receivers ๐ โ
Apple TVs, HomePods, etc.
"\x08_airplay" port:5353
Chromecasts / Smart TVs ๐ โ
"Chromecast:" port:8008
Crestron Smart Home Controllers ๐ โ
"Model: PYNG-HUB"
Random Stuff
OctoPrint 3D Printer Controllers ๐ โ
title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Etherium Miners ๐ โ
"ETH - Total speed"
Apache Directory Listings ๐ โ
Substitute .pem with any extension or a filename like phpinfo.php.
http.title:"Index of /" http.html:".pem"
Misconfigured WordPress ๐ โ
Exposed wp-config.php files containing database credentials.
http.html:"* The wp-config.php creation script uses this file"
Too Many Minecraft Servers ๐ โ
"Minecraft Server" "protocol 340" port:25565
Literally Everything in North Korea ๐ฐ๐ต ๐ โ
net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24
TCP Quote of the Day ๐ โ
Port 17 (RFC 865) has a bizarre history...
port:17 product:"Windows qotd"
Find a Job Doing This! ๐ฉโ๐ผ ๐ โ
"X-Recruiting:"
If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.
Bon voyage, fellow penetrators! ๐
License
To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.
Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.