Shodan Cheat Sheet

Shodan is a search engine for devices, not web pages — it continuously scans the internet and indexes what's listening on every port it finds: banners, headers, TLS certificates, and default landing pages. Where a normal search engine finds content by domain name, Shodan finds a target by what it is — a specific product, version, or misconfiguration — regardless of what domain it happens to sit behind.

Red Team / Offensive Use

Shodan turns "find every internet-facing instance of a vulnerable product" from a manual, days-long sweep into a single search. During recon it's used two ways: narrowing in on a specific target's exposed infrastructure (via org: or net: filters), or the reverse — starting from a known-vulnerable product/version and finding every exposed instance of it, which is exactly how mass-exploitation campaigns identify targets and exactly why understanding this tool matters defensively too. On an authorized engagement, it's one of the fastest ways to confirm whether a client has anything exposed to the internet that they think is internal-only.

Established Cheatsheet

Shodan Search Query Fundamentals — the official documentation for filter syntax, available filters, and how they combine.

PWNMI's Top 6 Use Cases

• org:"Example Corp" — every host Shodan has indexed under a target organization's registered name; a fast way to confirm the true extent of their internet-facing footprint
• net:203.0.113.0/24 — search within a specific IP block; useful once you have a target's ranges from WHOIS or ASN lookups
• port:22 product:"OpenSSH" version:"7.2" — find exposed instances of a specific product and version, the reverse-recon use case for confirming exposure of a known CVE
• http.title:"Index of /" — directory listings left exposed on web servers, often a quick source of unintended file exposure
• ssl.cert.subject.cn:"example.com" — find hosts by TLS certificate rather than DNS, which surfaces infrastructure that never shows up in a normal subdomain enumeration pass
• product:"MongoDB" -authentication — a classic pairing: find a specific product, then exclude results reporting authentication enabled, surfacing the ones that aren't

Next step

New to OSINT entirely? Start with OSINT Fundamentals for the methodology this tool fits into, or see theHarvester for pulling emails and subdomains rather than searching by device fingerprint.