You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US or org:"Harvard University" or hostname:"nasa.gov" to the end.
The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t — and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.
FTP server (MikroTik 7.19.3) ready
MikroTik RouterOS:
\x05!done%=ret=40a146c20421aa031d27849bc899b5fb\x00 port:8728
RouterOS
mbvit
Oracle-HTTP-Server
Server: Oracle-Application-Server-10g
(NetApp/5.3.1R3)
Server: NetCache appliance
* Welcome to D-Link Print Server * * Telnet Console *
HiPath 5 Telnet
INVENTORY REPORT TANK PRODUCT
"Tanker Network"
"PHP/8.2.28"
Integrated Operating System.
Device Model ]
Hardware version
V1.1
Firmware version
V2
Software revision WC.16.11.0018
Confidential computer software
The GPON OLT (Optical Line Terminal) is a key component responsible for connecting the Optical Distribution Network (
Device Model : GPON OLT
"uwu" product:"Jellyfin"
abunch of ssh any port you want use it in filter
"uwu"
Server: CradlepointHTTPService/1.0.0
### pragma
"Pragma: public" "Pragma: private"
### sip
SIP/2.0 200 OK Via: SIP -4 Call-ID: Accept: application/sdp,
### xiaomi
xiaomi -Unauthorized Xiaomi IoT: -Unauthorized
"Server: Apache/2.4" "200"
"HTTP/1.0 407 Proxy Authentication Required"
"Proxy-Authenticate:"
"realm="proxy"" -Unauthorized -Bad -Forbidden
"realm=proxy" -Unauthorized -Bad -Forbidden
"realm=login" -Unauthorized -Bad -Forbidden
"proxy" "CONNECTION: keep-alive" -Unauthorized
Proxy-Authenticate: Basic realm="Invalid proxy credentials or missing IP Authorization."
Proxy-Authenticate: "CONNECTION: keep-alive" -Tinyproxy -Unauthorized
"Proxy-Authenticate: Basic realm=Proxy Manager"
Proxy-Authenticate: Basic realm="Luminati"
" X-OpenSearch-Version:" "200 OK"
" Total Size: "
" gl-events_"
" wazuh-alerts"
wazuh
wazuh "HTTP/1.1 200 OK"
"200" product:"Prometheus Node Exporter"
CONNECTION: keep-alive country:"CN"
DH-NVR ###closed
DH-NVR CONNECTION: keep-alive
Product Chilling Mode Chilling Glycol Product
ad SUCTION RESERVOIR
220-test
"authentication disabled" "RFB 003.008" -FictusVNC -Who -QEMU -HAWK -fixtux -VeNCrypt -x11
"authentication disabled" "RFB 003.008" -FictusVNC -Who -QEMU -HAWK -fixtux -VeNCrypt -x11 " Server Name: PanelView VNC Server"
product:" bandwidth-test server"
202 Accepted product:"Apache httpd"
202 Accepted product:"Jetty"
"201 created"
mDNS mDNS: services: 41800/tcp spotify-connect:
418
"authenticated" -not-authenticated "* CAPABILITY "
"authenticated" -not-authenticated "Server: Microsoft-IIS/10.0"
"authenticated" -not-authenticated product:"nginx"
port:23 "welcome"
port:23 " Model:"
port:23 " Please keyin your password:"
port:23 " Firmware version : "
port:23 " Welcome to the Windows CE Telnet Service"
port:23 " Integrated Operating System. "
port:23 " MiiNePort "
port:23 " MAXFIBER "
port:23 "Welcome To Drcom NOS"
port:23 "Welcome to DZS"
port:23 "zlm60 "
port:23 "Welcome Visiting Huawei Home Gateway"
port:23 "Huawei TERMINAL Multi-service Distribution Module"
port:23 "2006 Huawei Technologies"
port:23 "Welcome to ZXR10 Carrier-Class High-end"
port:23 "CCCC"
port:23 " DASAN Zhone Solutions"
port:23 " help"
port:23 " Available Commands:"
port:23 "Enco control Telnet"
port:23 " AXTEL S.A. de C.V."
port:23 "User Access Verification"
port:23 "CC\r\n\r\n***************************************************************************\r\n*"
port:23 "Cliente:"
port:23 " Telecom Italia"
port:23 "Gaia4"
port:23 " SAS" country:"IT"
port:23 " TiMOS"
port:23 " Esta conectado"
port:23 "(none) login:"
port:23 "kernel" "CentOS "
port:23 "Ingenic linux machine"
port:23 "Windows users "
port:23 "kernel" country:"RU"
X-Include: X-Client-IP, X-Authenticated-Groups, X-Authenticated-User, X-Subscriber-Id
Samsung Electronic Billboards 🔎 →
"Server: Prismview Player"
Gas Station Pump Controllers 🔎 →
"in-tank inventory" port:10001
Automatic License Plate Readers 🔎 →
P372 "ANPR enabled"
Traffic Light Controllers / Red Light Cameras 🔎 →
mikrotik streetlight
"test "
port:554 has_ipv6:true "200 ok"
Voting Machines in the United States 🔎 →
"voter system serial" country:US
Telcos Running Cisco Lawful Intercept Wiretaps 🔎 →
"Cisco IOS" "ADVIPSERVICESK9_LI-M"
Wiretapping mechanism outlined by Cisco in RFC 3924:
Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.
Prison Pay Phones 🔎 →
"[2J[H Encartele Confidential"
Tesla PowerPack Charging Status 🔎 →
http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Electric Vehicle Chargers 🔎 →
"Server: gSOAP/2.8" "Content-Length: 583"
Maritime Satellites 🔎 →
Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!
"Cobham SATCOM" OR ("Sailor" "VSAT")
Submarine Mission Control Dashboards 🔎 →
title:"Slocum Fleet Mission Control"
CAREL PlantVisor Refrigeration Units 🔎 →
"Server: CarelDataServer" "200 Document follows"
Nordex Wind Turbine Farms 🔎 →
http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"
"[1m[35mWelcome on console"
Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.
"DICOM Server Response" port:104
"Server: EIG Embedded Web Server" "200 Document follows"
Siemens Industrial Automation 🔎 →
"Siemens, SIMATIC" port:161
Siemens HVAC Controllers 🔎 →
"Server: Microsoft-WinCE" "Content-Length: 12581"
Door / Lock Access Controllers 🔎 →
"HID VertX" port:4070
""Name: VertX_EVO_V1000" "
""EdgeEH400" "
" door controller: "
"AXIS A1001 Network Door "
Railroad Management 🔎 →
"log off" "select the appropriate"
Unprotected VNC 🔎 →
"authentication disabled" "RFB 003.008"
Shodan Images is a great supplementary tool to browse screenshots, by the way! 🔎 →
The first result right now. 😞
Windows RDP 🔎 →
99.99% are secured by a secondary Windows login screen.
"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"
port:22 "200 ok"
port:22 has_ipv6:true "200 ok"
Weave Scope Dashboards 🔎 →
Command-line access inside Kubernetes pods and Docker containers, and real-time visualization/monitoring of the entire infrastructure.
title:"Weave Scope" http.favicon.hash:567176827
MongoDB 🔎 →
Older versions were insecure by default. Very scary.
"MongoDB Server Information" port:27017 -authentication
Mongo Express Web GUI 🔎 →
Like the infamous phpMyAdmin but for MongoDB.
"Set-Cookie: mongo-express=" "200 OK"
Jenkins CI 🔎 →
"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Docker APIs 🔎 →
"Docker Containers:" port:2375
Docker Private Registries 🔎 →
"Docker-Distribution-Api-Version: registry" "200 OK" -gitlab
"dnsmasq-pi-hole" "Recursion: enabled"
Already Logged-In as root via Telnet 🔎 →
"root@" port:23 -login -password -name -Session
Android Root Bridges 🔎 →
A tangential result of Google's sloppy fractured update approach. 🙄 More information here.
"Android Debug Bridge" "Device" port:5555
Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords 🔎 →
Lantronix password port:30718 -secured
Citrix Virtual Apps 🔎 →
"Citrix Applications:" port:1604
Cisco Smart Install 🔎 →
Vulnerable (kind of "by design," but especially when exposed).
"smart install client active"
PBX IP Phone Gateways 🔎 →
PBX "gateway console" -password port:23
http.title:"- Polycom" "Server: lighttpd"
Telnet Configuration: 🔎 →
"Polycom Command Shell" -failed port:23
Bomgar Help Desk Portal 🔎 →
"Server: Bomgar" "200 OK"
Intel Active Management CVE-2017-5689 🔎 →
"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995
HP iLO 4 CVE-2017-12542 🔎 →
HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900
Exchange 2007 🔎 →
"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Exchange 2010 🔎 →
"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Exchange 2013 / 2016 🔎 →
"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Lync / Skype for Business 🔎 →
"X-MS-Server-Fqdn"
SMB (Samba) File Shares 🔎 →
Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.
"Authentication: disabled" port:445
Specifically domain controllers: 🔎 →
"Authentication: disabled" NETLOGON SYSVOL -unix port:445
Concerning default network shares of QuickBooks files: 🔎 →
"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445
FTP Servers with Anonymous Login 🔎 →
"220" "230 Login successful." port:21
port:21 "IPv6" "220" "230 Login successful."
port:21 "welcome to the" "220" "230 Login successful."
port:21 "welcome to " "220" "230 Login successful."
port:21 "welcome to asus" "220" "230 Login successful."
port:21 "welcome to tp" "220" "230 Login successful."
port:21 "welcome to my" "220" "230 Login successful."
port:21 "private" "220" "230 Login successful."
port:21 "ext.1" "220" "230 Login successful."
port:21 "ext.3" "220" "230 Login successful."
port:21 "porn" "220" "230 Login successful."
port:21 "you" "220" "230 Login successful."
port:21 " legacy FTP " "220" "230 Login successful."
port:21 "German " "220" "230 Login successful."
port:21 "south africa " "220" "230 Login successful."
port:21 "admin " "220" "230 Login successful."
port:21 " compromised " "220" "230 Login successful."
port:21 " owned " "220" "230 Login successful."
port:21 " y?? " "220" "230 Login successful."
port:21 " database" "220" "230 Login successful."
port:21 " FORBIDDEN " "220" "230 Login successful."
port:21 " do not " "220" "230 Login successful."
port:21 " live" "220" "230 Login successful."
port:21 " prod " "220" "230 Login successful."
port:21 " test " "220" "230 Login successful."
port:21 " temporary " "220" "230 Login successful."
port:21 " FileZilla Server " "220" "230 Login successful."
port:21 " door" "220" "230 Login successful."
port:21 "Computers & Control" "220" "230 Login successful."
port:21 "Computers " "220" "230 Login successful."
port:21 "Welcome to open" "220" "230 Login successful."
port:21 "Welcome to our" "220" "230 Login successful."
port:21 "jap" "220" "230 Login successful."
port:21 " research " "220" "230 Login successful."
port:21 " storage" "220" "230 Login successful."
port:21 " archive" "220" "230 Login successful."
port:21 " To upload an " "220" "230 Login successful."
port:21 " upload " "220" "230 Login successful."
port:21 " ware " "220" "230 Login successful."
port:21 "/upload " "220" "230 Login successful."
port:21 "/download " "220" "230 Login successful."
port:21 " Foundation " "220" "230 Login successful."
port:21 " /file " "220" "230 Login successful."
port:21 " dna" "220" "230 Login successful."
port:21 "home" "220" "230 Login successful."
port:21 " Control " "220" "230 Login successful."
port:21 " InterNIC " "220" "230 Login successful."
port:21 " /pub/FreeBSD " "220" "230 Login successful."
port:21 " /pub/ " "220" "230 Login successful."
port:21 " pub/CentOS" "220" "230 Login successful."
Iomega / LenovoEMC NAS Drives 🔎 →
"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Buffalo TeraStation NAS Drives 🔎 →
Redirecting sencha port:9000
Logitech Media Servers 🔎 →
"Server: Logitech Media Server" "200 OK"
"X-Plex-Protocol" "200 OK" port:32400
Tautulli / PlexPy Dashboards 🔎 →
"CherryPy/5.1.0" "/home"
Example images not necessary. 🤦
Yawcams 🔎 →
"Server: yawcam" "Mime-Type: text/html"
webcamXP/webcam7 🔎 →
("webcam 7" OR "webcamXP") http.component:"mootools" -401
Android IP Webcam Server 🔎 →
"Server: IP Webcam Server" "200 OK"
Security DVRs 🔎 →
html:"DVR_H264 ActiveX"
HP Printers 🔎 →
"Serial Number:" "Built:" "Server: HP HTTP"
Xerox Copiers/Printers 🔎 →
ssl:"Xerox Generic Root"
Epson Printers 🔎 →
"SERVER: EPSON_Linux UPnP" "200 OK"
"Server: EPSON-HTTP" "200 OK"
Canon Printers 🔎 →
"Server: KS_HTTP" "200 OK"
"Server: CANON HTTP Server"
Yamaha Stereos 🔎 →
"Server: AV_Receiver" "HTTP/1.1 406"
Apple AirPlay Receivers 🔎 →
Apple TVs, HomePods, etc.
"\x08_airplay" port:5353
Chromecasts / Smart TVs 🔎 →
"Chromecast:" port:8008
Crestron Smart Home Controllers 🔎 →
"Model: PYNG-HUB"
OctoPrint 3D Printer Controllers 🔎 →
title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Etherium Miners 🔎 →
"ETH - Total speed"
Apache Directory Listings 🔎 →
Substitute .pem with any extension or a filename like phpinfo.php.
http.title:"Index of /" http.html:".pem"
Misconfigured WordPress 🔎 →
Exposed wp-config.php files containing database credentials.
http.html:"* The wp-config.php creation script uses this file"
Too Many Minecraft Servers 🔎 →
"Minecraft Server" "protocol 340" port:25565
Literally Everything in North Korea 🇰🇵 🔎 →
net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24
TCP Quote of the Day 🔎 →
Port 17 (RFC 865) has a bizarre history...
port:17 product:"Windows qotd"
Find a Job Doing This! 👩💼 🔎 →
"X-Recruiting:"
If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.
Bon voyage, fellow penetrators! 😉
To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.
Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.