GitHub - jakejarvis/awesome-shodan-queries: ๐ A collection of interesting, funny...
source link: https://github.com/jakejarvis/awesome-shodan-queries
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
readme.md
Awesome Shodan Search Queries
Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine. Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild.
Most search filters require a Shodan account.
You can assume these queries only return unsecured/open instances when possible. For your own legal benefit, do not attempt to login (even with default passwords) if they aren't! Narrow down results by adding filters like country:US
or org:"Harvard University"
or hostname:"nasa.gov"
to the end.
The world and its devices are quickly becoming more connected through the shiny new Internet of Things Sh*t โ and exponentially more dangerous as a result. To that end, I hope this list spreads awareness (and, quite frankly, pant-wetting fear) rather than harm.
And as always, discover and disclose responsibly! ๐ค
Table of Contents
- Industrial Control Systems
- Remote Desktop
- Network Infrastructure
- Network Attached Storage (NAS)
- Webcams
- Printers & Copiers
- Home Devices
- Random Stuff
Industrial Control Systems
Samsung Electronic Billboards ๐ โ
"Server: Prismview Player"
Gas Station Pump Controllers ๐ โ
"in-tank inventory" port:10001
Automatic License Plate Readers ๐ โ
P372 "ANPR enabled"
Traffic Light Controllers / Red Light Cameras ๐ โ
mikrotik streetlight
Voting Machines in the United States ๐ โ
"voter system serial" country:US
Telcos Running Cisco Lawful Intercept Wiretaps ๐ โ
"Cisco IOS" "ADVIPSERVICESK9_LI-M"
Wiretapping mechanism outlined by Cisco in RFC 3924:
Lawful intercept is the lawfully authorized interception and monitoring of communications of an intercept subject. The term "intercept subject" [...] refers to the subscriber of a telecommunications service whose communications and/or intercept related information (IRI) has been lawfully authorized to be intercepted and delivered to some agency.
Prison Pay Phones ๐ โ
"[2J[H Encartele Confidential"
Tesla PowerPack Charging Status ๐ โ
http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
Electric Vehicle Chargers ๐ โ
"Server: gSOAP/2.8" "Content-Length: 583"
Maritime Satellites ๐ โ
Shodan made a pretty sweet Ship Tracker that maps ship locations in real time, too!
"Cobham SATCOM" OR ("Sailor" "VSAT")
Submarine Mission Control Dashboards ๐ โ
title:"Slocum Fleet Mission Control"
CAREL PlantVisor Refrigeration Units ๐ โ
"Server: CarelDataServer" "200 Document follows"
Nordex Wind Turbine Farms ๐ โ
http.title:"Nordex Control" "Windows 2000 5.0 x86" "Jetty/3.1 (JSP 1.1; Servlet 2.2; java 1.6.0_14)"
C4 Max Commercial Vehicle GPS Trackers ๐ โ
"[1m[35mWelcome on console"
DICOM Medical X-Ray Machines ๐ โ
Secured by default, thankfully, but these 1,700+ machines still have no business being on the internet.
"DICOM Server Response" port:104
GaugeTech Electricity Meters ๐ โ
"Server: EIG Embedded Web Server" "200 Document follows"
Siemens Industrial Automation ๐ โ
"Siemens, SIMATIC" port:161
Siemens HVAC Controllers ๐ โ
"Server: Microsoft-WinCE" "Content-Length: 12581"
Door / Lock Access Controllers ๐ โ
"HID VertX" port:4070
Railroad Management ๐ โ
"log off" "select the appropriate"
Remote Desktop
Unprotected VNC ๐ โ
"authentication disabled" "RFB 003.008"
Shodan Images is a great supplementary tool to browse screenshots, by the way! ๐ โ
The first result right now. ๐
Windows RDP ๐ โ
99.99% are secured by a secondary Windows login screen.
"\x03\x00\x00\x0b\x06\xd0\x00\x00\x124\x00"
Network Infrastructure
MongoDB ๐ โ
Older versions were insecure by default. Very scary.
"MongoDB Server Information" port:27017 -authentication
Mongo Express Web GUI ๐ โ
Like the infamous phpMyAdmin but for MongoDB.
"Set-Cookie: mongo-express=" "200 OK"
Jenkins CI ๐ โ
"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
Docker APIs ๐ โ
"Docker Containers:" port:2375
Pi-hole Open DNS Servers ๐ โ
"dnsmasq-pi-hole" "Recursion: enabled"
Already Logged-In as root
via Telnet ๐ โ
"root@" port:23 -login -password -name -Session
Android Root Bridges ๐ โ
A tangential result of Google's sloppy fractured update approach. ๐More information here.
"Android Debug Bridge" "Device" port:5555
Lantronix Serial-to-Ethernet Adapter Leaking Telnet Passwords ๐ โ
Lantronix password port:30718 -secured
Citrix Virtual Apps ๐ โ
"Citrix Applications:" port:1604
Cisco Smart Install ๐ โ
Vulnerable (kind of "by design," but especially when exposed).
"smart install client active"
PBX IP Phone Gateways ๐ โ
PBX "gateway console" -password port:23
Polycom Video Conferencing ๐ โ
http.title:"- Polycom" "Server: lighttpd"
Telnet Configuration: ๐ โ
"Polycom Command Shell" -failed port:23
Bomgar Help Desk Portal ๐ โ
"Server: Bomgar" "200 OK"
Intel Active Management CVE-2017-5689 ๐ โ
"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995
HP iLO 4 CVE-2017-12542 ๐ โ
HP-ILO-4 !"HP-ILO-4/2.53" !"HP-ILO-4/2.54" !"HP-ILO-4/2.55" !"HP-ILO-4/2.60" !"HP-ILO-4/2.61" !"HP-ILO-4/2.62" !"HP-iLO-4/2.70" port:1900
Outlook Web Access:
Exchange 2007 ๐ โ
"x-owa-version" "IE=EmulateIE7" "Server: Microsoft-IIS/7.0"
Exchange 2010 ๐ โ
"x-owa-version" "IE=EmulateIE7" http.favicon.hash:442749392
Exchange 2013 / 2016 ๐ โ
"X-AspNet-Version" http.title:"Outlook" -"x-owa-version"
Lync / Skype for Business ๐ โ
"X-MS-Server-Fqdn"
Network Attached Storage (NAS)
SMB (Samba) File Shares ๐ โ
Produces ~500,000 results...narrow down by adding "Documents" or "Videos", etc.
"Authentication: disabled" port:445
Specifically domain controllers: ๐ โ
"Authentication: disabled" NETLOGON SYSVOL -unix port:445
FTP Servers with Anonymous Login ๐ โ
"220" "230 Login successful." port:21
Iomega / LenovoEMC NAS Drives ๐ โ
"Set-Cookie: iomega=" -"manage/login.html" -http.title:"Log In"
Buffalo TeraStation NAS Drives ๐ โ
Redirecting sencha port:9000
Logitech Media Servers ๐ โ
"Server: Logitech Media Server" "200 OK"
Plex Media Servers ๐ โ
"X-Plex-Protocol" "200 OK" port:32400
Tautulli / PlexPy Dashboards ๐ โ
"CherryPy/5.1.0" "/home"
Webcams
Example images not necessary. ๐คฆ
Yawcams ๐ โ
"Server: yawcam" "Mime-Type: text/html"
webcamXP/webcam7 ๐ โ
("webcam 7" OR "webcamXP") http.component:"mootools" -401
Android IP Webcam Server ๐ โ
"Server: IP Webcam Server" "200 OK"
Security DVRs ๐ โ
html:"DVR_H264 ActiveX"
Printers & Copiers:
HP Printers ๐ โ
"Serial Number:" "Built:" "Server: HP HTTP"
Xerox Copiers/Printers ๐ โ
ssl:"Xerox Generic Root"
Epson Printers ๐ โ
"SERVER: EPSON_Linux UPnP" "200 OK"
"Server: EPSON-HTTP" "200 OK"
Canon Printers ๐ โ
"Server: KS_HTTP" "200 OK"
"Server: CANON HTTP Server"
Home Devices
Yamaha Stereos ๐ โ
"Server: AV_Receiver" "HTTP/1.1 406"
Apple AirPlay Receivers ๐ โ
Apple TVs, HomePods, etc.
"\x08_airplay" port:5353
Chromecasts / Smart TVs ๐ โ
"Chromecast:" port:8008
Crestron Smart Home Controllers ๐ โ
"Model: PYNG-HUB"
Random Stuff
OctoPrint 3D Printer Controllers ๐ โ
title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
Etherium Miners ๐ โ
"ETH - Total speed"
Apache Directory Listings ๐ โ
Substitute .pem
with any extension or a filename like phpinfo.php
.
http.title:"Index of /" http.html:".pem"
Too Many Minecraft Servers ๐ โ
"Minecraft Server" "protocol 340" port:25565
Literally Everything in North Korea ๐ฐ๐ต๐ โ
net:175.45.176.0/22,210.52.109.0/24,77.94.35.0/24
TCP Quote of the Day ๐ โ
Port 17 (RFC 865) has a bizarre history...
port:17 product:"Windows qotd"
Find a Job Doing This! ๐ฉโ๐ผ๐ โ
"X-Recruiting:"
If you've found any other juicy Shodan gems, whether it's a search query or a specific example, definitely drop a comment on the blog or open an issue/PR here on GitHub.
Bon voyage, fellow penetrators! ๐
License
To the extent possible under law, Jake Jarvis has waived all copyright and related or neighboring rights to this work.
Mirrored from a blog post at https://jarv.is/notes/shodan-search-queries/.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK