GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → jakejarvis → Awesome Shodan Queries

jakejarvis / Awesome Shodan Queries

Licence: cc0-1.0
🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

Labels

securityawesomeawesome-listiothackingcloudsecurity-toolspentestingpenetration-testinginfosecinternet-of-thingssecurity-scannershodandorksnetwork-infrastructureshodan-dorks

Projects that are alternatives of or similar to Awesome Shodan Queries

Resources
A Storehouse of resources related to Bug Bounty Hunting collected from different sources. Latest guides, tools, methodology, platforms tips, and tricks curated by us.
Stars: ✭ 62 (-97.75%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing, infosec
Crithit
Takes a single wordlist item and tests it one by one over a large collection of websites before moving onto the next. Create signatures to cross-check vulnerabilities over multiple hosts.
Stars: ✭ 182 (-93.4%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing, infosec
Cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
Stars: ✭ 2,775 (+0.62%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing, infosec
Scilla
🏴‍☠️ Information Gathering tool 🏴‍☠️ DNS / Subdomains / Ports / Directories enumeration
Stars: ✭ 116 (-95.79%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
Passphrase Wordlist
Passphrase wordlist and hashcat rules for offline cracking of long, complex passwords
Stars: ✭ 556 (-79.84%)
Mutual labels:  hacking, pentesting, penetration-testing, infosec
Habu
Hacking Toolkit
Stars: ✭ 635 (-76.98%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
A Red Teamer Diaries
RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.
Stars: ✭ 382 (-86.15%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
Changeme
A default credential scanner.
Stars: ✭ 928 (-66.35%)
Mutual labels:  security-tools, penetration-testing, infosec, security-scanner
Evillimiter
Tool that monitors, analyzes and limits the bandwidth of devices on the local network without administrative access.
Stars: ✭ 764 (-72.3%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
Active Directory Exploitation Cheat Sheet
A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.
Stars: ✭ 870 (-68.46%)
Mutual labels:  hacking, pentesting, penetration-testing, infosec
Cloakify
CloakifyFactory - Data Exfiltration & Infiltration In Plain Sight; Convert any filetype into list of everyday strings, using Text-Based Steganography; Evade DLP/MLS Devices, Defeat Data Whitelisting Controls, Social Engineering of Analysts, Evade AV Detection
Stars: ✭ 1,136 (-58.81%)
Mutual labels:  hacking, security-tools, pentesting, infosec
Reconnoitre
A security tool for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.
Stars: ✭ 1,824 (-33.87%)
Mutual labels:  hacking, security-tools, penetration-testing, security-scanner
Security Tools
Collection of small security tools, mostly in Bash and Python. CTFs, Bug Bounty and other stuff.
Stars: ✭ 509 (-81.54%)
Mutual labels:  hacking, security-tools, pentesting, infosec
Hosthunter
HostHunter a recon tool for discovering hostnames using OSINT techniques.
Stars: ✭ 427 (-84.52%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
Dirsearch
Web path scanner
Stars: ✭ 7,246 (+162.73%)
Mutual labels:  hacking, pentesting, penetration-testing, infosec
Nmap
Idiomatic nmap library for go developers
Stars: ✭ 391 (-85.82%)
Mutual labels:  hacking, pentesting, penetration-testing, infosec
Dumpsterfire
"Security Incidents In A Box!" A modular, menu-driven, cross-platform tool for building customized, time-delayed, distributed security events. Easily create custom event chains for Blue- & Red Team drills and sensor / alert mapping. Red Teams can create decoy incidents, distractions, and lures to support and scale their operations. Build event sequences ("narratives") to simulate realistic scenarios and generate corresponding network and filesystem artifacts.
Stars: ✭ 775 (-71.9%)
Mutual labels:  hacking, security-tools, pentesting, infosec
Cheatsheet God
Penetration Testing Reference Bank - OSCP / PTP & PTX Cheatsheet
Stars: ✭ 3,521 (+27.66%)
Mutual labels:  hacking, security-tools, pentesting, penetration-testing
Infosec reference
An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.
Stars: ✭ 4,162 (+50.91%)
Mutual labels:  hacking, pentesting, penetration-testing, infosec
Minesweeper
A Burpsuite plugin (BApp) to aid in the detection of scripts being loaded from over 23000 malicious cryptocurrency mining domains (cryptojacking).
Stars: ✭ 162 (-94.13%)
Mutual labels:  hacking, security-tools, penetration-testing, security-scanner
View All Similar Projects ➔

Awesome Shodan Search Queries Awesome

Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.


Most search filters require a Shodan account.

You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.

The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t — and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.

And as always, discover and disclose responsibly! 🤓

Table of Contents

Industrial Control Systems

Samsung Electronic Billboards 🔎 →

"Server: Prismview Player"
Example: Electronic Billboards

Gas Station Pump Controllers 🔎 →

"in-tank inventory" port:10001
Example: Gas Station Pump Inventories

Automatic License Plate Readers 🔎 →

P372 "ANPR enabled"
Example: Automatic License Plate Reader

Traffic Light Controllers / Red Light Cameras 🔎 →

mikrotik streetlight

Voting Machines in the United States 🔎 →

"voter system serial" country:US

Telcos Running Cisco Lawful Intercept Wiretaps 🔎 →

"Cisco IOS" "ADVIPSERVICESK9_LI-M"

Wiretapping mechanism outlined by Cisco in RFC 3924:

Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.

Prison Pay Phones 🔎 →

"[2J[H Encartele Confidential"

Tesla PowerPack Charging Status 🔎 →

http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Example: Tesla PowerPack Charging Status

Electric Vehicle Chargers 🔎 →

"Server: gSOAP/2.8" "Content-Length: 583"

Maritime Satellites 🔎 →

Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!

"Cobham SATCOM" OR ("Sailor" "VSAT")
Example: Maritime Satellites

Submarine Mission Control Dashboards 🔎 →

title:"Slocum Fleet Mission Control"

CAREL PlantVisor Refrigeration Units 🔎 →

"Server: CarelDataServer" "200 Document follows"
Example: CAREL PlantVisor Refrigeration Units

Nordex Wind Turbine Farms 🔎 →

http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"

C4 Max Commercial Vehicle GPS Trackers 🔎 →

"[1m[35mWelcome on console"
Example: C4 Max Vehicle GPS

DICOM Medical X-Ray Machines 🔎 →

Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.

"DICOM Server Response" port:104

GaugeTech Electricity Meters 🔎 →

"Server: EIG Embedded Web Server" "200 Document follows"
Example: GaugeTech Electricity Meters

Siemens Industrial Automation 🔎 →

"Siemens, SIMATIC" port:161

Siemens HVAC Controllers 🔎 →

"Server: Microsoft-WinCE" "Content-Length: 12581"

Door / Lock Access Controllers 🔎 →

"HID VertX" port:4070

Railroad Management 🔎 →

"log off" "select the appropriate"

Remote Desktop

Unprotected VNC 🔎 →

"authentication disabled" "RFB 003.008"

Shodan Images is a great supplementary tool to browse screenshots, by the way! 🔎 →

Example: Unprotected VNC
The first result right now. 😞

Windows RDP 🔎 →

99.99% are secured by a secondary Windows login screen.

"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"

Network Infrastructure

Weave Scope Dashboards 🔎 →

Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.

title:"Weave Scope" http.favicon.hash:567176827
Example: Weave Scope Dashboards

MongoDB 🔎 →

Older versions were insecure by default. Very scary.

"MongoDB Server Information" port:27017 -authentication
Example: MongoDB

Mongo Express Web GUI 🔎 →

Like the infamous phpMyAdmin but for MongoDB.

"Set-Cookie: mongo-express=" "200 OK"
Example: Mongo Express GUI

Jenkins CI 🔎 →

"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Example: Jenkins CI

Docker APIs 🔎 →

"Docker Containers:" port:2375

Docker Private Registries 🔎 →

"Docker-Distribution-Api-Version: registry" "200 OK" -gitlab

Pi-hole Open DNS Servers 🔎 →

"dnsmasq-pi-hole" "Recursion: enabled"

Already Logged-In as root via Telnet 🔎 →

"root@" port:23 -login -password -name -Session

Android Root Bridges 🔎 →

A tangential result of Google's sloppy fractured update approach. 🙄 More information here.

"Android Debug Bridge" "Device" port:5555

Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords 🔎 →

Lantronix password port:30718 -secured

Citrix Virtual Apps 🔎 →

"Citrix Applications:" port:1604
Example: Citrix Virtual Apps

Cisco Smart Install 🔎 →

Vulnerable (kind of "by design," but especially when exposed).

"smart install client active"

PBX IP Phone Gateways 🔎 →

PBX "gateway console" -password port:23

Polycom Video Conferencing 🔎 →

http.title:"- Polycom" "Server: lighttpd"

Telnet Configuration: 🔎 →

"Polycom Command Shell" -failed port:23
Example: Polycom Video Conferencing

Bomgar Help Desk Portal 🔎 →

"Server: Bomgar" "200 OK"

Intel Active Management CVE-2017-5689 🔎 →

"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995

HP iLO 4 CVE-2017-12542 🔎 →

HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900

Outlook Web Access:

Exchange 2007 🔎 →

"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Example: OWA for Exchange 2007

Exchange 2010 🔎 →

"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Example: OWA for Exchange 2010

Exchange 2013 / 2016 🔎 →

"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Example: OWA for Exchange 2013/2016

Lync / Skype for Business 🔎 →

"X-MS-Server-Fqdn"

Network Attached Storage (NAS)

SMB (Samba) File Shares 🔎 →

Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.

"Authentication: disabled" port:445

Specifically domain controllers: 🔎 →

"Authentication: disabled" NETLOGON SYSVOL -unix port:445

Concerning default network shares of QuickBooks files: 🔎 →

"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445

FTP Servers with Anonymous Login 🔎 →

"220" "230 Login successful." port:21

Iomega / LenovoEMC NAS Drives 🔎 →

"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Example: Iomega / LenovoEMC NAS Drives

Buffalo TeraStation NAS Drives 🔎 →

Redirecting sencha port:9000
Example: Buffalo TeraStation NAS Drives

Logitech Media Servers 🔎 →

"Server: Logitech Media Server" "200 OK"
Example: Logitech Media Servers

Plex Media Servers 🔎 →

"X-Plex-Protocol" "200 OK" port:32400

Tautulli / PlexPy Dashboards 🔎 →

"CherryPy/5.1.0" "/home"
Example: PlexPy / Tautulli Dashboards

Webcams

Example images not necessary. 🤦

Yawcams 🔎 →

"Server: yawcam" "Mime-Type: text/html"

webcamXP/webcam7 🔎 →

("webcam 7" OR "webcamXP") http.component:"mootools" -401

Android IP Webcam Server 🔎 →

"Server: IP Webcam Server" "200 OK"

Security DVRs 🔎 →

html:"DVR_H264 ActiveX"

Printers & Copiers:

HP Printers 🔎 →

"Serial Number:" "Built:" "Server: HP HTTP"
Example: HP Printers

Xerox Copiers/Printers 🔎 →

ssl:"Xerox Generic Root"
Example: Xerox Copiers/Printers

Epson Printers 🔎 →

"SERVER: EPSON_Linux UPnP" "200 OK"

"Server: EPSON-HTTP" "200 OK"
Example: Epson Printers

Canon Printers 🔎 →

"Server: KS_HTTP" "200 OK"

"Server: CANON HTTP Server"
Example: Canon Printers

Home Devices

Yamaha Stereos 🔎 →

"Server: AV_Receiver" "HTTP/1.1 406"
Example: Yamaha Stereos

Apple AirPlay Receivers 🔎 →

Apple TVs, HomePods, etc.

"\x08_airplay" port:5353

Chromecasts / Smart TVs 🔎 →

"Chromecast:" port:8008

Crestron Smart Home Controllers 🔎 →

"Model: PYNG-HUB"

Random Stuff

OctoPrint 3D Printer Controllers 🔎 →

title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Example: OctoPrint 3D Printers

Etherium Miners 🔎 →

"ETH - Total speed"
Example: Etherium Miners

Apache Directory Listings 🔎 →

Substitute .pem with any extension or a filename like phpinfo.php.

http.title:"Index of /" http.html:".pem"

Misconfigured WordPress 🔎 →

Exposed wp-config.php files containing database credentials.

http.html:"* The wp-config.php creation script uses this file"

Too Many Minecraft Servers 🔎 →

"Minecraft Server" "protocol 340" port:25565

Literally Everything in North Korea 🇰🇵 🔎 →

net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24

TCP Quote of the Day 🔎 →

Port 17 (RFC 865) has a bizarre history...

port:17 product:"Windows qotd"

Find a Job Doing This! 👩‍💼 🔎 →

"X-Recruiting:"

If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.

Bon voyage, fellow penetrators! 😉

License

CC0

To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.

Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].