### Query Syntax Reference

[](https://github.com/Daemon-AT4/Shodan_Cheet-Sheet#-query-syntax-reference)

| Filter | Usage | Example |
| :---------------: | :-------------------------: | :----------------------: |
| `title:` | Search page title | `title:"Admin Panel"` |
| `product:` | Search product name | `product:"Apache"` |
| `port:` | Search specific port | `port:22` |
| `country:` | Filter by country code | `country:"US"` |
| `city:` | Filter by city | `city:"New York"` |
| `region:` | Filter by state/region | `region:"California"` |
| `org:` | Search by organization | `org:"Google"` |
| `asn:` | Search by ASN | `asn:AS15169` |
| `net:` | Search by IP range | `net:8.8.8.0/24` |
| `geo:` | Search by coordinates | `geo:"40.7128,-74.0060"` |
| `vuln:` | Search by vulnerability | `vuln:heartbleed` |
| `has_screenshot:` | Include/exclude screenshots | `has_screenshot:true` |
| `html:` | Search in HTML content | `html:"server version"` |
| `header:` | Search HTTP headers | `header:"Server: Nginx"` |




"default password"
server has_screenshot:true
hacked
org:"Verizon Business" port:8900(flock_camz)
title:camera
webcam has_screenshot:true
device:"voip"
product:MySQL
"in-tank inventory" port:10001
"Server: Prismview Player"
P372 "ANPR enabled"
mikrotik streetlight
"voter system serial" country:US
"Cisco IOS" "ADVIPSERVICESK9_LI-M"(wire_taps)
"[2J[H Encartele Confidential" (prison_phones)
http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
"Server: gSOAP/2.8" "Content-Length: 583"
"Cobham SATCOM" OR ("Sailor" "VSAT")
title:"Slocum Fleet Mission Control"
"[1m[35mWelcome on console"
"Siemens, SIMATIC" port:161
"Server: Microsoft-WinCE" "Content-Length: 12581"
"HID VertX" port:4070
"authentication disabled" "RFB 003.008"
title:"Weave Scope" http.favicon.hash:567176827
"MongoDB Server Information" port:27017 -authentication
"Set-Cookie: mongo-express=" "200 OK"
"Docker Containers:" port:2375
"dnsmasq-pi-hole" "Recursion: enabled"
"Android Debug Bridge" "Device" port:5555
Lantronix password port:30718 -secured
"Citrix Applications:" port:1604
PBX "gateway console" -password port:23
"Polycom Command Shell" -failed port:23
"Authentication: disabled" port:445
"Authentication: disabled" "Shared this folder to access QuickBooks files OverNetwork" -unix port:445
"Server: Logitech Media Server" "200 OK"

#### **General Search Queries**

Shodan allows users to create queries to locate specific devices, services, or configurations. Here are some of the most widely used queries:

- **city:”[city name]”**: Find devices located in a specific city.
Example: `city:"New York"` searches for devices in New York City.
- **country:”[country code]”**: Search for devices in a specific country.
Example: `country:"US"` finds devices in the United States.
- **geo:”[latitude],[longitude]”**: Search for devices at a specific geographical location.
Example: `geo:"40.7128,-74.0060"` searches around New York City’s coordinates.
- **hostname:”[hostname]”**: Look for devices with a specific hostname.
Example: `hostname:"example.com"` returns devices hosted under example.com.
- **net:”[IP range]”**: Find devices within a certain IP range.
Example: `net:"192.168.1.0/24"` finds devices in the IP range 192.168.1.0-192.168.1.255.
- **os:”[operating system]”**: Search for devices running a specific operating system.
Example: `os:"Windows"` returns devices running Windows.
- **port:”[port number]”**: Find devices with a specific open port.
Example: `port:22` returns devices with SSH running on port 22.
- **org:”[organization name]”**: Search for devices associated with a particular organization.
Example: `org:"Google"` finds devices associated with Google.
- **isp:”[ISP name]”**: Search for devices using a specific ISP.
Example: `isp:"Comcast"` finds devices using Comcast as their ISP.
- **product:”[product name]”**: Find devices running a specific software product.
Example: `product:"Apache"` returns devices running the Apache web server.
- **version:”[version number]”**: Search for devices running a particular version of software.
Example: `version:"5.7"` returns devices running MySQL version 5.7.
- **has_screenshot:”true”**: Find devices with available screenshots.
Example: `has_screenshot:true` returns devices that include a screenshot.
- **ssl.cert.subject.cn:”[common name]”**: Search for SSL certificates with a specific common name.
Example: `ssl.cert.subject.cn:"example.com"` finds certificates for example.com.
- **http.title:”[title text]”**: Find web pages with a specific title.
Example: `http.ti