> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/shodan-searching.md). # Shodan Searching [Shodan](https://www.shodan.io/) is a search engine for internet-connected devices. Unlike traditional search engines like Google, which indexes web pages, Shodan indexes information about devices such as servers, routers, webcams, and more. It provides insights into the devices' operating systems, software versions, open ports, and other technical details. #### ⚡ **Why is Shodan Important for Security Testing?** * **Identify exposed devices** (routers, webcams, ICS, databases, etc.). * **Check for vulnerabilities** (CVEs, misconfigurations, outdated software). * **Find open ports/services** (RDP, SSH, FTP, Telnet, etc.). * **Discover leaked sensitive data** (configuration files, credentials, API keys). *** ### **Shodan Filters & Their Uses** Shodan has multiple filters that help in **advanced searching**. Here is The Complete List of filter Tags ### **🔹 General Filters** | **Filter** | **Usage** | **Example** | | ---------------- | ---------------------------------------------------------- | --------------------------- | | `all` | Shows all search results without filters. | `all` | | `asn` | Finds devices by ASN (Autonomous System Number). | `asn:AS15169` | | `city` | Filters results by city. | `city:New York` | | `country` | Finds devices in a specific country (ISO code). | `country:US` | | `cpe` | Searches for a specific CPE (Common Platform Enumeration). | `cpe:/a:apache:http_server` | | `device` | Filters by device type. | `device:router` | | `geo` | Finds devices within specific coordinates. | `geo:37.7749,-122.4194` | | `has_ipv6` | Filters results to IPv6-enabled devices. | `has_ipv6:true` | | `has_screenshot` | Filters results that include a screenshot. | `has_screenshot:true` | | `has_ssl` | Searches for devices with SSL/TLS enabled. | `has_ssl:true` | | `has_vuln` | Filters results that contain known vulnerabilities. | `has_vuln:true` | | `hash` | Searches based on a hash of the banner data. | `hash:123456789` | | `hostname` | Finds results based on the hostname. | `hostname:example.com` | | `ip` | Searches for a specific IP address. | `ip:192.168.1.1` | | `isp` | Filters results by ISP (Internet Service Provider). | `isp:Google` | | `link` | Filters by the type of connection. | `link:ethernet` | | `net` | Filters results by IP range. | `net:192.168.1.0/24` | | `org` | Searches for a specific organization. | `org:Microsoft` | | `os` | Finds devices based on their OS. | `os:Windows` | | `port` | Filters results by open ports. | `port:22` | | `postal` | Finds results based on postal codes. | `postal:10001` | | `product` | Filters by software or service running on the device. | `product:Apache` | | `region` | Filters results by region. | `region:California` | | `scan` | Searches within specific Shodan scan IDs. | `scan:123456789` | | `shodan.module` | Filters by specific Shodan scanning module. | `shodan.module:ssh` | | `state` | Searches within a specific state. | `state:Texas` | | `version` | Filters results by software version. | `version:2.4.7` | *** ### **🖼 Screenshots Filters** | **Filter** | **Usage** | **Example** | | ------------------ | -------------------------------------------- | ------------------------------ | | `screenshot.hash` | Searches by screenshot hash. | `screenshot.hash:abcdef123456` | | `screenshot.label` | Filters by recognized labels in screenshots. | `screenshot.label:login` | *** ### **☁ Cloud Filters** | **Filter** | **Usage** | **Example** | | ---------------- | -------------------------- | ------------------------ | | `cloud.provider` | Filters by cloud provider. | `cloud.provider:AWS` | | `cloud.region` | Filters by cloud region. | `cloud.region:us-east-1` | | `cloud.service` | Filters by cloud service. | `cloud.service:S3` | *** ### **🌐 HTTP Filters** | **Filter** | **Usage** | **Example** | | ------------------------- | ----------------------------------------------------- | ------------------------------ | | `http.component` | Finds websites running a specific component. | `http.component:WordPress` | | `http.component_category` | Filters results by component category. | `http.component_category:CMS` | | `http.favicon.hash` | Searches based on favicon hash. | `http.favicon.hash:-123456789` | | `http.headers_hash` | Filters by HTTP header hash. | `http.headers_hash:987654321` | | `http.html` | Searches for specific text in the HTML page. | `http.html:"admin panel"` | | `http.html_hash` | Searches by HTML content hash. | `http.html_hash:123456789` | | `http.robots_hash` | Filters by robots.txt hash. | `http.robots_hash:abcdef` | | `http.securitytxt` | Searches for security.txt files. | `http.securitytxt:true` | | `http.status` | Filters by HTTP status code. | `http.status:200` | | `http.title` | Finds web pages with a specific title. | `http.title:"Login Page"` | | `http.waf` | Searches for WAF (Web Application Firewall) presence. | `http.waf:Cloudflare` | *** ### **💰 Bitcoin Filters** | **Filter** | **Usage** | **Example** | | ------------------ | ---------------------------------------------- | ------------------------ | | `bitcoin.ip` | Finds Bitcoin nodes by IP. | `bitcoin.ip:1.1.1.1` | | `bitcoin.ip_count` | Filters by Bitcoin IP count. | `bitcoin.ip_count:100` | | `bitcoin.port` | Searches for Bitcoin nodes on a specific port. | `bitcoin.port:8333` | | `bitcoin.version` | Filters Bitcoin nodes by version. | `bitcoin.version:0.21.0` | *** ### **🔒 SSL Filters** | **Filter** | **Usage** | **Example** | | ---------------------- | ------------------------------------------- | ----------------------------------- | | `ssl` | Filters devices with SSL enabled. | `ssl:true` | | `ssl.alpn` | Filters by ALPN protocol. | `ssl.alpn:h2` | | `ssl.cert.alg` | Searches by SSL certificate algorithm. | `ssl.cert.alg:RSA` | | `ssl.cert.expired` | Finds expired SSL certificates. | `ssl.cert.expired:true` | | `ssl.cert.fingerprint` | Filters by SSL fingerprint. | `ssl.cert.fingerprint:abcdef` | | `ssl.cert.issuer.cn` | Searches by certificate issuer common name. | `ssl.cert.issuer.cn:Let's Encrypt` | | `ssl.cert.pubkey.bits` | Filters by SSL public key bits. | `ssl.cert.pubkey.bits:2048` | | `ssl.cert.pubkey.type` | Searches by public key type. | `ssl.cert.pubkey.type:RSA` | | `ssl.cert.subject.cn` | Searches for SSL subject common name. | `ssl.cert.subject.cn:example.com` | | `ssl.chain_count` | Filters by SSL chain length. | `ssl.chain_count:2` | | `ssl.cipher.bits` | Filters by cipher bit strength. | `ssl.cipher.bits:128` | | `ssl.cipher.name` | Searches by SSL cipher name. | `ssl.cipher.name:AES128-GCM-SHA256` | | `ssl.cipher.version` | Filters by SSL version. | `ssl.cipher.version:TLSv1.2` |