Categorised queries
Grouped by device and service class, each with a note on what it exposes.
← Store · // advanced
Advanced Shodan Queries
A curated collection of Shodan search queries for attack-surface discovery — the interesting, the alarming and the genuinely useful — with guidance on scoping and responsible use. Learning material, not software.
from $149collection & updates
⚠ Education & authorized research onlyA reference collection for learning and authorized attack-surface work. Do not log in to systems you do not own, even with default credentials.
// what it is
What it is
This is a curated reference collection — a categorised set of Shodan search queries that surface exposed and misconfigured devices and services, with notes on what each one reveals. It is learning material you read and apply, not a program you run.
It pairs the queries with the filtering technique that makes them useful in practice: narrowing by country:, org: or hostname: to scope results to an estate you are authorized to assess, and reading results without ever touching the exposed systems.
// what's included
What’s included
Scoping with filters
How to pin results to an organisation, country or hostname you are allowed to assess.
Reading results safely
How to assess exposure from Shodan’s data without logging into anything.
Attack-surface mapping
Turning a domain or org into a picture of what it has facing the internet.
// who it's for
Who it’s for
Penetration testers and OSINT analysts scoping an external attack surface, and defenders who want to find their own exposure before someone else does.
// the fine print
Terms & liability
Education & authorized research only. This is written learning material. Applying these techniques to systems, cards or networks you do not own or lack written permission to test is illegal in most jurisdictions — always get authorization first.
No liability. The material is provided as-is for study; Cyber Sec and Stephan Botes accept no liability for how it is used.
What you pay for. A curated, maintained guide and the author’s time — updates and questions answered, not access to public facts.
Questions about scope, licensing or authorization? Get in touch first.