Shodan Cheat Sheet

by sir_slammington via cheatography.com/147122/cs/31955/

Common General Search Filters Common CLI Commands Common CLI Stats Facets (cont)

ip: Filter results by specific IP count Returns the number of results version
address. for a search.
These will return statis​tical inform​ation
asn: Filter results by specific ASN domain View all available inform​ation about a given series of devices found on the
ID. for a domain. public facing Internet. For example, it could
hostname: Filter results by specific download Download search results and be used to return the most common version
hostname. save them in a compressed found among devices running MariaDB in a
JSON file. particular ASN.
port: Filter results by specific port
number of service. honeyscore Check whether the IP is a
Use Case Examples
net: Filter results from specified honeypot or not.
CIDR block. host View all available inform​ation host: shodan host Display
for an IP address. 8.8.8.8 8.8.8.8 inform​ation
isp: Filter results by devices
about a
assigned a particular address parse Extract inform​ation out of
Google's
(space) from a specified ISP. compressed JSON files.
public DNS.
city: Filter results by specific city. scan Scan an IP/ netblock using
asn:15169 shodan Show inform​‐
country: Filter results by specific two- Shodan.
produc​‐ stats ation about
digit country code. search Search the Shodan
t:mysql asn:15169 devices within
os: Filter results by particular OS. database.
produc​‐ Google's
product: Filter results by particular t:mysql ASN that run
Common CLI Search Fields
software. MySQL.
ip_str microsoft shodan Detect IIS
version: Filter results by specified
version of software. port iis 6.0 search -- servers
org fields running on
Common Premium API Search Filters ip_str​,po​rt,​‐ 6.0.
hostnames
org​,ho​‐
vuln: Filter results by particular vulner​‐ os
stnames
ability ID (commonly CVE).
country microsoft iis
tag: Filter results by tags on device.
city 6.0

These will display their values upon a Navigate to shodan Detect if

HTTP Filters
search, but won't provide statis​tics. https:​//h​‐ honeyscore given target is
http.c​‐ Filter results by a particular web one​ysc​‐ [TARGET] a honeypot or
omp​‐ techno​logy. ore.sh​oda​‐ not.
Common CLI Stats Facets
onent: n.io/ and
asn
http.s​‐ Filter results by specific status enter target
tatus: code. city IP.
http.html: Filter results by strings found in country
Column one is the search you would
HTML of files served. cloud.p​ro​vider perform in the Web UI. Column two is the
http.t​itle: Filter results by string found in cloud.s​ervice search you would perform using the CLI
title of web pages served. utility, and the third column is an explan​ation
device
of the search.
domain
ip
org
os

By sir_slammington Published 2nd May, 2022. Sponsored by ApolloPad.com

cheatography.com/sir- Last updated 2nd May, 2022. Everyone has a novel in them. Finish
slammington/ Page 1 of 1. Yours!
https://apollopad.com