Awesome Shodan Search Queries
Last updated
Last updated
Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into , the () internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.
You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.
The world and its devices are quickly becoming more connected through the shiny new — and exponentially as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.
And as always, ! 🤓
Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.
99.99% are secured by a secondary Windows login screen.
Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.
Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.
Example images not necessary. 🤦
Apple TVs, HomePods, etc.
Substitute .pem with any extension or a filename like phpinfo.php.
Bon voyage, fellow penetrators! 😉
Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.
Wiretapping mechanism outlined by Cisco in :
Shodan made a pretty sweet that maps ship locations in real time, too!
Secured by default, thankfully, but these 1,700+ machines still being on the internet.
is a great supplementary tool to browse screenshots, by the way!
The first result right now. 😞
Older versions were insecure by default.
Like the but for MongoDB.
A tangential result of Google's sloppy fractured update approach. 🙄
(kind of "by design," but especially when exposed).
Telnet Configuration:
Specifically domain controllers:
Concerning files:
Exposed files containing database credentials.
Port 17 () has a ...
If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely on the blog or .
To the extent possible under law, has waived all copyright and related or neighboring rights to this work.
