[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572763-105":53,"doc-detail-572763-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","icsscadaplc-googleshodanhq-cheat-sheet","ICS/SCADA/PLC Google/ShodanHQ Cheat Sheet","","ICS/SCADA/PLC Google/ShodanHQ Cheat Sheet compiles search and reconnaissance strings for identifying industrial control systems in exposed networks. It lists vendor- and product-oriented Google dorks and ShodanHQ queries across Siemens SIMATIC S7 (S7-200/S7-300/PCS7), SCALANCE security modules, WinCC flexible, and SIMATIC HMI miniweb, plus Rockwell Automation (ControlLogix/CompactLogix/PLC5/SLC/MicroLogix), Emerson DeltaV, and Schneider Electric PowerLogic and Modicon families. It focuses on protocol indicators, ports, inurl endpoints, and common web/Telnet/SNMP entry points.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/icsscadaplc-googleshodanhq-cheat-sheet/572763/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/icsscadaplc-googleshodanhq-cheat-sheet/572763.png","ImageObject",442,249,{"name":88,"@type":89},"Mimi","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":9},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What does the cheat sheet compile for ICS/SCADA discovery?","Question",{"text":108,"@type":109},"It compiles Google dork and ShodanHQ query strings tied to vendors and PLC/SCADA products, focusing on network exposure signals like ports, protocols, and web endpoints.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Which Siemens targets are included?",{"text":113,"@type":109},"The sheet includes multiple Siemens SIMATIC S7 lines (S7-200, S7-300/PCS7, Simatic S7), plus SCALANCE security module firewall, WinCC flexible/runtime, and SIMATIC HMI Miniweb.",{"name":115,"@type":106,"acceptedAnswer":116},"How does it identify device services on the network?",{"text":117,"@type":109},"It uses protocol and service clues such as SNMP, Telnet, NetBIOS, HTTP web paths, and specific TCP port numbers embedded in the queries.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572763,1792501399,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":76},2336477974920,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","ICS/SCADA/PLC Google/Shodanhq Cheat Sheet  \nGleb Gritsai, Alexander Timorin, Yuri Goltsev, Roman Ilin  \n[http://scadastrangelove.org/](http://scadastrangelove.org/)  \nvendor product google dork network info  \nSiemens S7-200  \nall models: tcp/udp/102 (by vuln info)  \nS7-300  \nS7-3** , PCS7  \nSimatic S7  \ninurl:/Portal0000.htm  \nsnmp: Siemens, SIMATIC, S7  \n[http: /S7Web.css](http: /S7Web.css)  \nsnmp: Siemens, SIMATIC S7, CPU-1200 Siemens, SIMATIC S7, CPU317-2 PN/DP  \nSiemens, SIMATIC S7, CPU315-2 PN/DP  \ninurl:\"Portal/Portal.mwsl\"  \nAutomation License Manager  \nScalance S,X Security Module firewall  \nWincc flexible  \nWincc flexible runtime / TIA Portal  \nSiemens, SIMATIC S7 ***  \n[http: /S7Web.css](http: /S7Web.css)  \ntcp/4410 (by vuln info)  \ntelnet: Simatic, Scalance  \nsnmp: Scalance S*, Scalance W*, Scalance X*  \nDCP protocol (by vuln info) tcp/80  \nnetbios: WINCC_SRV21 \u003C0x0> SIEMENS \u003C0x0> WINCC_SRV21 \u003C0x20> tcp/2308 (by vuln info)  \ntcp/50523 (by vuln info)  \nSynco OZW (Web server) [http](http)  \nSIMATIC HMI Miniweb intitle:\"Miniweb Start Page\" | \"/CSS/Miniweb.css\" [http: /CSS/Miniweb.css](http: /CSS/Miniweb.css)  \n[Simatic HMI snmp: Siemens](Simatic HMI snmp: Siemens), SIMATIC HMI, ***  \ntelnet:Welcome to the Windows CE Telnet Service on HMI_Panel  \n\n| |  |  |  |  |  |  |\n| --- | --- | --- | --- | --- | --- | --- |\n| vendor | product |  |  |  | google dork | network info |\n| Emerson | DeltaV and DeltaV Workstations/DeltaV ProEssentials Scientifi\u003Cbr>DeltaV Service Inform System Ver3.3 | c Gr\u003Cbr>atio | ap\u003Cbr>n | h |  | tcp/udp/111 (by vuln info) |\n|  |  |  |  |  |  |  |\n\nvendor product google dork network info  \nAllen-Bradley  \nRockwell Automation  \nControlLogix tcp/udp/44818 , [http](http)  \n[CompactLogix intitle:](CompactLogix intitle:)\"[Rockwell](Rockwell) Automation\" \"Device Name\" \"Uptime\"  \nPLC5  \nSLC-5  \nMicrologix  \ninurl:dtm. html intitle:1747-L552  \ninurl:dtm. html intitle:1747-L551  \ninurl:home. htm intitle:1766  \n[http](http), snmp  \n[http](http), snmp  \n[http](http), snmp  \nvendor  \nshodanhq dork  \nnetwork info  \nproduct  \nSchneider Electric  \nPM820SD  \nPM870SDECC21 EGX100MG  \nPowerLogic PM800  \nPowerLogic ION8650 A/B/C  \nSchneider Electric-PM820SD port:161  \nSchneider Electric-PM870SD port:161  \nSchneider Electric-ECC21 port:161  \nSchneider Electric-EGX100MG port:161  \nPowerLogic PM800 port:80  \nION8650  \nPowerLogic ION8650 A/B/C)  \nPowerLogic ION8600  \nPowerLogic ION7650/7550  \nPowerLogic ION7650/7550  \nPowerLogic ION7300  \nPowerLogic ION6200 PowerLogic PM1200  \nPowerLogic DM6200 Powerlogic Enercept  \nPowerlogic Energy Meter  \nPowerLogic Branch Current Monitor  \nPowerLogic EM4800  \n8650 ION  \n8600 ION  \nION 7550  \nION 7650  \nION 7300  \nION6200  \nPM1200  \nDM6200  \nBCM42  \nPowerLogic E5600  \nPowerLogic Ethernet Gateway (EGX)  \nPowerLogic EGX300  \nPowerLogic ION7550RTU  \nEGX100  \nEGX300  \nION 7550RTU schneider electric  \ngoogle dork  \nnetwork info  \nvendor  \nproduct  \nSchneider Electric  \nModicon  \nQuantum/Premiun/Micro  \nCitectSCADA  \nCitectFacilities  \nClearSCADA  \nintitle:\"Quantum CPU Web Server\"  \nintitle:\"Premium CPU Web Server\"  \nintitle:\"Citect Web\" inurl:scada  \nfiletype:htm  \nshodanhq: ClearSCADA  \n\"ViewXCtrl is not supported in this web browser.\"  \nintitle:\"ClearSCADA Home\"  \nUnitelWay Device Driver  \nVijeo Historian Web Server several products  \nModicon M340 snmp: \"Modicon M340\"  \ngoogle dork  \nnetwork info  \nvendor  \nproduct  \nGeneral  \nElectric  \nCimplicity intitle:\"CIMPLICITY WebView\" inurl:main. html [http](http)  \nProficy inurl:ProficyPortal/default.asp [http](http)","cbCaisNhpEAjqgnX","https://ap.wps.com/l/cbCaisNhpEAjqgnX","pdf",287431,9,"English","# Vendor and product search dorks\n## Siemens SIMATIC S7, WinCC flexible, HMI Miniweb\n## Rockwell Automation (ControlLogix, CompactLogix, PLC5/SLC/MicroLogix)\n## Emerson DeltaV\n## Schneider Electric and PowerLogic, Modicon, CitectSCADA/ClearSCADA","[{\"question\":\"What does the cheat sheet compile for ICS/SCADA discovery?\",\"answer\":\"It compiles Google dork and ShodanHQ query strings tied to vendors and PLC/SCADA products, focusing on network exposure signals like ports, protocols, and web endpoints.\"},{\"question\":\"Which Siemens targets are included?\",\"answer\":\"The sheet includes multiple Siemens SIMATIC S7 lines (S7-200, S7-300/PCS7, Simatic S7), plus SCALANCE security module firewall, WinCC flexible/runtime, and SIMATIC HMI Miniweb.\"},{\"question\":\"How does it identify device services on the network?\",\"answer\":\"It uses protocol and service clues such as SNMP, Telnet, NetBIOS, HTTP web paths, and specific TCP port numbers embedded in the queries.\"}]","ICS/SCADA/PLC Google/ShodanHQ Cheat Sheet | PDF",1791929184]