[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572704-105":53,"doc-detail-572704-en":127},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":120,"head_meta":122,"extra_data":124,"updated_unix":126},105,"en","shodan-cheat-sheet-cli-and-search-filters","Shodan Cheat Sheet - CLI and Search Filters","","Concise reference covering Shodan search syntax, including common general filters (IP, ASN, hostname, port, CIDR netblocks, ISP, city, country, OS) and premium API filters such as vulnerability IDs and tag-based searches. Includes HTTP-related filters for web technologies, HTTP status codes, HTML string matching, and page title matching. Summarizes frequently used CLI commands, search fields that display values, and CLI stats facets for producing device distribution metrics, plus practical use case examples and honeypot detection guidance.",{"@graph":63,"@context":119},[64,80,102],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/shodan-cheat-sheet-cli-and-search-filters/572704/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/shodan-cheat-sheet-cli-and-search-filters/572704.png","ImageObject",442,249,{"name":88,"@type":89},"Maya Linwood","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":101},"InteractionCounter",{"@type":100},"ViewAction",6,{"@type":103,"mainEntity":104},"FAQPage",[105,111,115],{"name":106,"@type":107,"acceptedAnswer":108},"What are the common general search filters in Shodan?","Question",{"text":109,"@type":110},"Common general filters include ip, asn, hostname, port, net (CIDR), isp, city, country (two-digit code), os, and product/version for software matching.","Answer",{"name":112,"@type":107,"acceptedAnswer":113},"Which premium API filters are listed in the cheat sheet?",{"text":114,"@type":110},"Premium API filters shown are vuln (vulnerability IDs such as CVE) and tag (device tag matching).",{"name":116,"@type":107,"acceptedAnswer":117},"What CLI commands and stats facets does the sheet highlight?",{"text":118,"@type":110},"It highlights commands like search, count, host, domain, scan, download, parse, and honeyscore. For stats, it lists facets such as asn, city, country, cloud.provider, cloud.service, device, domain, ip, org, os, and version to compute device distributions.","https://schema.org",{"og:url":78,"og:type":121,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":123,"canonical":78},"index,follow",{"doc_id":125,"site_id":56},572704,1792033723,{"code":4,"msg":5,"data":128},{"doc_id":125,"user_id":129,"nickname":88,"user_avatar":130,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":101,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":9,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":4},962084928432,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","Shodan Cheat Sheet  \n[by](by sir_slammington via cheatography.com/147122/cs/31955/)[ sir_slammington](by sir_slammington via cheatography.com/147122/cs/31955/)[ via](by sir_slammington via cheatography.com/147122/cs/31955/)[ cheatography.com/147122/cs/31955/](by sir_slammington via cheatography.com/147122/cs/31955/)  \nCommon General Search Filters  \n| ip: | Filter results by specific IP address. |\n| --- | --- |\n| asn: | Filter results by specific ASNID. |\n| hostname: | Filter results by specific hostname. |\n| port: | Filter results by specific port number of service. |\n| net: | Filter results from specified CIDR block. |\n| isp: | Filter results by devices assigned a particular address (space) from a specified ISP. |\n| city: | Filter results by specific city. |\n| country: | Filter results by specific twodigit country code. |\n| os: | Filter results by particular OS. |\n| product: | Filter results by particular software. |\n| version: | Filter results by specified version of software. |\n\nCommon Premium API Search Filters  \nvuln: Filter results by particular vulner‐  \nability ID (commonly CVE) .  \ntag: Filter results by tags on device.  \nHTTP Filters  \n| http.c‐ omp‐ onent: | Filter results by a particular web technology. |\n| --- | --- |\n| http.s‐\u003Cbr>tatus: | Filter results by specific status code. |\n| http.html: | Filter results by strings found in HTML of files served. |\n| http.title: | Filter results by string found in title of web pages served. |\n\nBy sir_slammington  \n[cheatography.com/sir](cheatography.com/sir)slammington/  \nCommon CLI Commands  \n| count | Returns the number of results for a search. |\n| --- | --- |\n| domain | View all available information for a domain. |\n| download | Download search results and save them in a compressed JSON file. |\n| honeyscore | Check whether the IP is a\u003Cbr>honeypot or not. |\n| host | View all available information for an IP address. |\n| parse | Extract information out of\u003Cbr>compressed JSON files. |\n| scan | Scan an IP/ netblock using Shodan. |\n| search | Search the Shodan\u003Cbr>database. |\n\nCommon CLI Search Fields  \nip_str  \nport  \norg  \nhostnames  \nos  \ncountry  \ncity  \nThese will display their values upon a search , but won't provide statistics.  \nCommon CLI Stats Facets  \nasn  \ncity  \ncountry  \ncloud.provider  \ncloud.service  \ndevice  \ndomain  \nip  \norg  \nos  \nPublished 2nd May , 2022. Last updated 2nd May , 2022. Page 1 of 1.  \nCommon CLI Stats Facets (cont)  \nversion  \nThese will return statistical information about a given series of devices found on the public facing Internet. For example , it could be used to return the most common version found among devices running MariaDB in a particular ASN.  \nUse Case Examples  \n\n| host: 8.8.8.8 | shodan host 8.8.8.8 | Display information about a Google's public DNS. |\n| --- | --- | --- |\n| asn:15169 produc‐ t:mysql | shodan stats asn:15169 produc‐ t:mysql | Show inform‐\u003Cbr>ation about\u003Cbr>devices within\u003Cbr>Google's\u003Cbr>ASN that run\u003Cbr>MySQL. |\n| microsoft iis 6.0 | shodan\u003Cbr>search--\u003Cbr>fields\u003Cbr>ip_str, port,‐ org, ho‐\u003Cbr>stnames\u003Cbr>microsoft iis\u003Cbr>6.0 | Detect IIS servers\u003Cbr>running on 6.0. |\n| Navigate to https://h‐\u003Cbr>oneysc‐\u003Cbr>ore.shoda‐\u003Cbr>n.io/ and\u003Cbr>enter target\u003Cbr>IP. | shodan honeyscore\u003Cbr>[TARGET] | Detect if\u003Cbr>given target is\u003Cbr>a honeypot or not. |\n\nColumn one is the search you would perform in the Web UI. Column two is the search you would perform using the CLI utility , and the third column is an explanation of the search.  \nSponsored by Readable.com Measure your website readability!  \n[https://readable.com](https://readable.com)","cbCaiht7fFa7Yosx","https://ap.wps.com/l/cbCaiht7fFa7Yosx","pdf",36586,"English","# Common General Search Filters\n## Common Premium API Search Filters\n## HTTP Filters\n# Common CLI Commands\n## Common CLI Search Fields\n## Common CLI Stats Facets\n# Use Case Examples","[{\"question\":\"What are the common general search filters in Shodan?\",\"answer\":\"Common general filters include ip, asn, hostname, port, net (CIDR), isp, city, country (two-digit code), os, and product/version for software matching.\"},{\"question\":\"Which premium API filters are listed in the cheat sheet?\",\"answer\":\"Premium API filters shown are vuln (vulnerability IDs such as CVE) and tag (device tag matching).\"},{\"question\":\"What CLI commands and stats facets does the sheet highlight?\",\"answer\":\"It highlights commands like search, count, host, domain, scan, download, parse, and honeyscore. For stats, it lists facets such as asn, city, country, cloud.provider, cloud.service, device, domain, ip, org, os, and version to compute device distributions.\"}]","Shodan Cheat Sheet - CLI and Search Filters | PDF",1791928940]