find-exposed-servers

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Find exposed servers

查找暴露的服务器

Internet-wide scanners already scanned your target. Querying their results is passive — you never send a packet to the target, so nothing appears in their logs and nothing is attributable to you. The cost is that every result is a claim about a moment in the past, and the beginner's mistake is reading a banner as the current state of a live host.

全网扫描器已经对目标进行过扫描。查询它们的扫描结果属于被动操作——你不会向目标发送任何数据包，因此不会在对方日志中留下痕迹，也不会被追踪到你的身份。缺点是所有结果都只是过去某个时刻的记录，新手常犯的错误是将横幅信息当作目标主机当前的实时状态。

Which platform first

优先选择哪个平台

You hold	Reach for	Why
An IP	Shodan host lookup, or the free InternetDB endpoint	One request gives ports, hostnames, and CPEs
A netblock or ASN	Shodan `net:` / `asn:` with port faceting	Shows the shape of the estate before you look at individual hosts
A hostname behind a CDN	Censys certificate-to-host joins	Censys links certs to observed hosts, which is how you find origins
A cert or a distinctive page	Favicon hash and cert subject/serial searches	Finds sibling infrastructure the DNS never links
An org name	`org:` on Shodan, `autonomous_system` on Censys	Both are attribution by network registration, so both inherit its errors
Coverage doubt	A second platform with different sensors	The platforms disagree constantly; disagreement is signal

Shodan has the broadest device and protocol coverage and the friendliest query language. Censys has more structured host records, better certificate joins, and a stricter query syntax. FOFA, ZoomEye, Netlas, Onyphe, BinaryEdge and LeakIX see different slices of the internet and are worth a pass when the first two come up empty — non-Western scanners in particular index hosts the big two miss.

你拥有的信息	推荐使用	原因
单个IP	Shodan主机查询，或免费的InternetDB端点	一次请求即可获取端口、主机名和CPE信息
网段或ASN	带端口分面的Shodan `net:` / `asn:` 查询	在查看单个主机之前，先了解整个资产集群的概况
CDN后的主机名	Censys证书与主机关联查询	Censys会将证书与探测到的主机关联，这是查找源IP的方法
证书或独特页面	网站图标哈希和证书主体/序列号搜索	查找DNS未关联的同源基础设施
组织名称	Shodan的 `org:` 查询，Censys的 `autonomous_system` 查询	两者均基于网络注册信息进行归属判定，因此都存在固有误差
对覆盖范围存疑	使用另一款拥有不同探测节点的平台	不同平台的结果经常不一致，这种不一致本身就是一种信号

Shodan的设备和协议覆盖范围最广，查询语言也最友好。Censys拥有更结构化的主机记录、更完善的证书关联功能，以及更严格的查询语法。FOFA、ZoomEye、Netlas、Onyphe、BinaryEdge和LeakIX能覆盖互联网的不同领域，当前两个平台无结果时，值得尝试这些工具——尤其是非西方扫描器，它们能收录大型平台遗漏的主机。

Shodan

bash

shodan init <api-key>
shodan host 203.0.113.10                                 # everything known about one IP
shodan search --fields ip_str,port,org,hostnames 'ssl.cert.subject.CN:example.com'
shodan count 'net:203.0.113.0/24'                        # cheap: no result credits
shodan stats --facets port,org 'net:203.0.113.0/24'      # the shape of a netblock
shodan download results.json.gz 'asn:AS64500 port:3389'
shodan parse --fields ip_str,port,product results.json.gz

Free and unauthenticated, for a single IP:

bash

curl -s https://internetdb.shodan.io/203.0.113.10 | jq .   # ports, hostnames, cpes, vulns

Filters worth knowing:

net:

port:

hostname:

asn:

org:

isp:

country:

city:

product:

version:

os:

http.title:

http.html:

http.status:

http.favicon.hash:

ssl.cert.subject.CN:

ssl.cert.issuer.CN:

ssl.cert.expired:

ssl.jarm:

ssl:

tag:

vuln:

has_screenshot:

, and

before:

after:

for scan dates.

vuln:

and some others require a paid tier.

Censys uses a structured field path syntax over a host document —

services.port

services.service_name

services.http.response.html_title

services.tls.certificates.leaf_data.subject_dn

dns.names

autonomous_system.asn

location.country

— combined with

and

or

not

. Its API v2 exposes

https://search.censys.io/api/v2/hosts/search?q=…

and

https://search.censys.io/api/v2/hosts/{ip}

with API-ID/secret basic auth.

Side-by-side query equivalents across platforms are in reference/query-cookbook.md.

bash

shodan init <api-key>
shodan host 203.0.113.10                                 # 获取单个IP的所有已知信息
shodan search --fields ip_str,port,org,hostnames 'ssl.cert.subject.CN:example.com'
shodan count 'net:203.0.113.0/24'                        # 低成本操作：不消耗结果额度
shodan stats --facets port,org 'net:203.0.113.0/24'      # 查看网段的资产概况
shodan download results.json.gz 'asn:AS64500 port:3389'
shodan parse --fields ip_str,port,product results.json.gz

针对单个IP的免费无认证查询方式：

bash

curl -s https://internetdb.shodan.io/203.0.113.10 | jq .   # 获取端口、主机名、cpes、漏洞信息

值得了解的过滤器：

net:

、

port:

、

hostname:

、

asn:

、

org:

、

isp:

、

country:

、

city:

、

product:

、

version:

、

os:

、

http.title:

、

http.html:

、

http.status:

、

http.favicon.hash:

、

ssl.cert.subject.CN:

、

ssl.cert.issuer.CN:

、

ssl.cert.expired:

、

ssl.jarm:

、

ssl:

、

tag:

、

vuln:

、

has_screenshot:

，以及用于扫描日期的

before:

after:

。

vuln:

等部分过滤器需要付费版权限。

Censys对主机文档使用结构化字段路径语法——

services.port

、

services.service_name

、

services.http.response.html_title

、

services.tls.certificates.leaf_data.subject_dn

、

dns.names

、

autonomous_system.asn

、

location.country

——结合

and

or

not

逻辑运算符。其API v2提供

https://search.censys.io/api/v2/hosts/search?q=…

和

https://search.censys.io/api/v2/hosts/{ip}

接口，使用API-ID/密钥进行基础认证。

各平台的等效查询示例可参考reference/query-cookbook.md。

Reading what comes back

解读返回结果

A result is a banner plus metadata, not a verdict. Interpretation of specific service banners — what a version string implies, which fields are self-reported and which are observed — is in reference/banner-interpretation.md. The general discipline:

Check the scan timestamp on every record. Shodan records carry a timestamp; Censys carries a last-observed time. Rescan cadence varies by port and address space, so a record can be days or many months old. Report findings as "observed on <date>", never as "is".
Separate observed from claimed. The open port and the TLS certificate are observed facts. The product name and version are parsed from a banner the host chose to send, and hosts lie — deliberately, or because a distribution backported patches without changing the version string.
CVE tags are inference. They come from matching a version string against a vulnerability database. They are leads for a report, never confirmation of exploitability, and backported fixes make them wrong routinely in both directions.
Hostnames in a record come from reverse DNS and certificates, which means they can belong to a previous tenant of the IP.

返回结果是横幅信息加元数据，而非最终判定。特定服务横幅的解读——版本字符串的含义、哪些字段是主机自报的、哪些是探测到的——可参考reference/banner-interpretation.md。通用准则如下：

检查每条记录的扫描时间戳。Shodan记录包含时间戳；Censys包含最后探测时间。扫描频率因端口和地址段而异，记录可能是几天或数月前的。报告结果时应注明“于<日期>探测到”，而非“当前存在”。
区分观测事实与自报信息。开放端口和TLS证书是观测到的事实。产品名称和版本是从主机主动发送的横幅中解析出来的，而主机可能会提供虚假信息——或是故意为之，或是因为发行版在不修改版本字符串的情况下回传了补丁。
CVE标签是推断结果。它们通过将版本字符串与漏洞数据库匹配得出。这些标签是报告的线索，而非可利用性的确认，回传补丁经常会导致CVE标签在正反两个方向上出现错误。
记录中的主机名来自反向DNS和证书，这意味着它们可能属于该IP的前租户。

The pivots that matter

关键的关联分析方法

This is what makes scan platforms more than a port list.

Favicon hash. Shodan indexes a hash of the site's favicon (a MurmurHash3 of the base64-encoded icon bytes; FOFA's

icon_hash

uses the same construction). Because a favicon is usually shipped with an application rather than configured per host, searching the hash finds every host running the same appliance, framework, or the target's own branded portals — across unrelated IPs, ASNs and domains. It is the single best way to find an organization's scattered instances of one product.

TLS certificate. Search on the certificate's subject CN, its subject organization, or its serial number, and you find every host serving that certificate. A certificate serial is unique per issuer, so a serial match is a near-exact identity. Shodan also exposes a certificate fingerprint filter; check its documentation for which hash it expects rather than guessing. Combine with

find-hidden-subdomains

— CT gives you the cert, scan data gives you every host presenting it.

JARM and TLS stack fingerprints. JARM hashes how a server responds to a set of TLS handshakes, so it fingerprints the TLS stack rather than the certificate. It clusters appliances, load balancers and command-and-control frameworks. It is not unique to an organization, so treat it as a filter that narrows a search, not as an identifier.

Response-body fingerprints. A unique string from the target's pages — a tracking ID, an unusual copyright line, a custom header, a build hash — searched via

http.html:

finds other hosts serving the same application, including staging copies and the origin behind a CDN.

这正是扫描平台超越单纯端口列表的价值所在。

网站图标哈希。Shodan会索引网站图标的哈希值（基于base64编码图标字节的MurmurHash3；FOFA的

icon_hash

使用相同的算法）。由于网站图标通常随应用程序一起分发，而非按主机配置，因此搜索该哈希值可找到所有运行相同设备、框架或目标自有品牌门户的主机——跨越无关的IP、ASN和域名。这是查找组织中分散部署的同一产品实例的最佳方法。

TLS证书。通过证书的主体CN、主体组织或序列号进行搜索，可找到所有使用该证书的主机。证书序列号在颁发机构范围内是唯一的，因此序列号匹配几乎是精确的身份识别。Shodan还提供证书指纹过滤器；请查看其文档了解所需的哈希算法，不要自行猜测。结合

find-hidden-subdomains

工具——证书透明度（CT）提供证书信息，扫描数据提供所有使用该证书的主机。

JARM和TLS栈指纹。JARM通过服务器对一系列TLS握手的响应生成哈希值，因此它是对TLS栈而非证书进行指纹识别。它可对设备、负载均衡器和命令控制框架进行聚类。它并非组织独有的，因此应将其视为缩小搜索范围的过滤器，而非标识符。

http.html:

进行搜索，可找到其他运行相同应用程序的主机，包括 staging 副本和CDN背后的源IP。

Finding an origin behind a CDN

查找CDN背后的源IP

When a hostname resolves to Cloudflare or another proxy, the origin still exists and is often reachable by IP. Passive routes to it, in order of reliability:

Search scan data for the target's TLS certificate on IPs outside the CDN's ASNs. Origins commonly serve the real cert directly.
Search a unique HTTP body string or favicon hash and filter out CDN ASNs.
Read historical DNS from before the CDN was adopted (
```
who-owns-this-domain
```
). Origins move less often than people assume.
Check services that bypass the proxy by design: MX hosts,
```
ftp
```
,
```
cpanel
```
,
```
direct
```
,
```
origin
```
, and non-HTTP ports on the same netblock.
Read SPF
```
ip4:
```
mechanisms — organizations authorize their own sending host, which is sometimes the web origin.

A candidate origin is a hypothesis. Confirming it by sending a request with the target's

Host

header is an active step against the target: it needs authorization. Note also that a properly configured origin rejects non-CDN traffic, so failure to confirm does not disprove the candidate.

当主机名解析到Cloudflare或其他代理时，源IP仍然存在，且通常可通过IP直接访问。以下是可靠性从高到低的被动查找方法：

在扫描数据中搜索目标TLS证书，筛选出CDN ASN之外的IP。源主机通常会直接提供真实证书。
搜索唯一的HTTP体字符串或网站图标哈希，并排除CDN的ASN。
查看CDN启用前的历史DNS记录（
```
who-owns-this-domain
```
工具）。源IP的变动频率往往低于预期。
检查设计上绕过代理的服务：MX主机、
```
ftp
```
、
```
cpanel
```
、
```
direct
```
、
```
origin
```
，以及同一网段上的非HTTP端口。
查看SPF记录中的
```
ip4:
```
机制——组织会授权自己的发送主机，而该主机有时就是Web源IP。

候选源IP只是一个假设。通过发送带有目标

Host

头的请求来确认属于主动接触目标的行为：需要获得授权。另外，配置正确的源主机会拒绝非CDN流量，因此无法确认并不代表候选源IP不成立。

Where this goes wrong

常见误区

Staleness cuts both ways. A closed port may have been open when scanned; an open port may have been closed since. Absence of a result is not absence of a service — scanners do not cover every port on every address.
Honeypots pollute everything. Deliberately exposed decoys inflate results for interesting services. Tells: implausible service combinations on one host, a very large number of open ports, default banners for many unrelated products, and hosting in research-oriented netblocks. Shodan exposes a honeyscore estimate at
```
https://api.shodan.io/labs/honeyscore/{ip}?key=
```
— treat it as a hint, not a ruling.
Targets can game the scanners. Scanner source addresses are publishable, so a defender can serve fabricated banners to them specifically. High-value targets sometimes do.
org:
and
isp:
are network registration, not ownership. On cloud netblocks they name the cloud provider, and on resold space they name a reseller. Attribution by
```
org:
```
alone is how people end up reporting a neighbour's exposed database as the target's.
Shared hosting and shared IPs. One IP can serve hundreds of unrelated sites. Ports and vulnerabilities found there belong to the host, not necessarily to your target.
Screenshots and banners contain personal data. Exposed dashboards and cameras index real people. That is a data-protection problem the moment you save it.
Platforms disagree, and each free tier truncates. A single-platform search that finds nothing means one sensor network saw nothing.

记录时效性的双向影响。已关闭的端口在扫描时可能是开放的；当前开放的端口可能在扫描后已关闭。没有结果并不代表服务不存在——扫描器不会覆盖每个地址的每个端口。
蜜罐污染结果。故意暴露的诱饵会夸大热门服务的结果。识别特征：单主机上存在不合理的服务组合、大量开放端口、多个无关产品的默认横幅，以及部署在研究导向的网段中。Shodan在
```
https://api.shodan.io/labs/honeyscore/{ip}?key=
```
提供蜜罐评分估算——将其视为提示，而非最终判定。
目标可以欺骗扫描器。扫描器的源地址是公开的，因此防御者可以专门向这些地址提供伪造的横幅信息。高价值目标有时会这么做。
org:
和
isp:
基于网络注册信息，而非实际所有权。在云网段中，它们指向云服务商；在转售空间中，它们指向转售商。仅通过
```
org:
```
进行归属判定会导致误将邻居暴露的数据库当作目标的资产。
虚拟主机与共享IP。单个IP可托管数百个无关站点。在该IP上发现的端口和漏洞属于主机，而非必然属于你的目标。
截图和横幅包含个人数据。暴露的控制面板和摄像头会收录真实人物信息。一旦你保存这些内容，就会涉及数据保护问题。
平台结果不一致，且免费版存在限制。单个平台搜索无结果仅代表该探测网络未发现任何信息。

Confidence grading

可信度分级

Confirmed exposure — the same service on the same IP and port appears in two independent scan platforms, or in one platform across multiple scan dates, and the IP is tied to the target by a certificate the target demonstrably controls or by a netblock reassigned to the target by name.
Probable — a single recent observation on an IP linked to the target by favicon hash, body-string match or reverse DNS. Or a cross-platform match on an IP whose ownership you have not independently established.
Unconfirmed — attribution resting only on
```
org:
```
/
```
isp:
```
, a shared-hosting IP, a single stale record, a CVE tag with no other evidence, or a host with honeypot characteristics.

Never upgrade a grade by connecting to the service. Record the platform, the query, the scan timestamp and the record identifier for every finding.

确认暴露——同一IP和端口上的同一服务出现在两个独立扫描平台中，或在同一平台的多个扫描日期中出现，且该IP通过目标明确控制的证书或已重新分配给目标名称的网段与目标关联。
可能暴露——在与目标通过网站图标哈希、体字符串匹配或反向DNS关联的IP上有单次近期观测记录。或在未独立确认所有权的IP上有跨平台匹配记录。
未确认暴露——仅基于
```
org:
```
/
```
isp:
```
、共享主机IP、单次过期记录、无其他证据的CVE标签，或具有蜜罐特征的主机进行归属判定。

切勿通过连接服务来提升可信度等级。记录每个发现对应的平台、查询语句、扫描时间戳和记录标识符。

Worked example

实战示例

Target:

example-fintech.test

, authorized external attack-surface review, passive collection only.

The apex resolves into Cloudflare, so port scanning the resolved IP would only have described Cloudflare. Instead, take the cert subject CN from

find-hidden-subdomains

and search scan data for hosts serving it. Three hits: two Cloudflare addresses, and one in a European hosting provider's ASN with 443 and 22 open. That third host is the likely origin.

Its favicon hash, searched back, returns six more hosts. Four are the target's regional portals. Two are unrelated companies — the favicon is a stock icon shipped with the framework, not the target's own. That is the dead end, and the lesson: check whether a favicon is actually distinctive before treating a hash match as attribution.

net:

on the origin's /29 shows a second host with 3306 open and a MySQL banner, scanned four months ago. Old, so it may be gone, but it is reportable as observed. The netblock's RIR record shows a reassignment to the target's legal name, which is what turns "an IP with the right cert" into attribution.

Stop there. Do not connect to 3306, do not send a

Host

header to the origin. Report both, with dates and queries, and hand the reassigned netblock back to

who-owns-this-domain

目标：

example-fintech.test

，授权进行外部攻击面审查，仅允许被动收集。

apex域名解析到Cloudflare，因此对解析后的IP进行端口扫描只能获取Cloudflare的信息。取而代之的是，从

find-hidden-subdomains

工具中获取证书主体CN，在扫描数据中搜索使用该证书的主机。得到三个结果：两个Cloudflare地址，以及一个位于欧洲服务商ASN中的IP，开放了443和22端口。第三个主机很可能是源IP。

搜索该主机的网站图标哈希，返回了另外六个主机。其中四个是目标的区域门户，另外两个属于无关公司——该图标是框架自带的通用图标，并非目标自有。这是一个死胡同，教训是：在将哈希匹配当作归属依据之前，先确认网站图标是否具有独特性。

对源IP所在的/29网段执行

net:

查询，发现第二个主机开放了3306端口，带有MySQL横幅，扫描时间为四个月前。记录较旧，可能已不存在，但仍需作为探测结果上报。该网段的RIR记录显示已重新分配给目标的法定名称，这正是将“带有正确证书的IP”转化为归属判定的依据。

到此为止。不要连接到3306端口，不要向源IP发送

Host

头。将两个发现连同日期和查询语句一起上报，并将重新分配的网段反馈给

who-owns-this-domain

工具。

Pivots

关联拓展

New selector	Goes to
Certificate subjects and SANs on discovered hosts	`find-hidden-subdomains`
Netblocks, ASNs, reverse-DNS hostnames	`who-owns-this-domain`
Organization names from cert subjects and RIR records	`x-ray-a-company` , `who-really-owns-it`
Exposed repo, CI or registry services	`secrets-in-git-history`
Historical content on a discovered host	`read-deleted-pages`
Indexed paths on a discovered service	`google-like-a-spy`
A host/cert/ASN cluster to lay out	`graph-the-network`

新选择器	关联工具
已发现主机的证书主体和SAN	`find-hidden-subdomains`
网段、ASN、反向DNS主机名	`who-owns-this-domain`
证书主体和RIR记录中的组织名称	`x-ray-a-company` , `who-really-owns-it`
暴露的代码仓库、CI或注册表服务	`secrets-in-git-history`
已发现主机上的历史内容	`read-deleted-pages`
已发现服务上的索引路径	`google-like-a-spy`
主机/证书/ASN集群的可视化	`graph-the-network`

Legal and ToS notes

法律与服务条款说明

Querying a scan platform is lawful passive research. Acting on the result is where the line is: connecting to an exposed database, opening an admin panel, viewing an exposed camera feed, or fetching a file from an open share can constitute unauthorized access under computer-misuse law in most jurisdictions, and the absence of a password is not a defence. A finding authorizes you to report — to the abuse contact from the netblock's RIR record, or the relevant CERT — and nothing else. Scan-platform terms also restrict redistribution of their data, so quote findings in a report rather than republishing the dataset. Screenshots and banners containing personal data fall under the minimization rules in ../../ETHICS.md.

查询扫描平台属于合法的被动研究。对结果采取行动才是界限所在：连接到暴露的数据库、打开控制面板、查看暴露的摄像头画面，或从开放共享中获取文件，在大多数司法管辖区可能构成未经授权的访问，而没有密码不能作为抗辩理由。发现结果仅授权你进行上报——上报给网段RIR记录中的滥用联系人或相关CERT——除此之外无其他权限。扫描平台的服务条款还限制其数据的再分发，因此在报告中引用发现结果即可，不要重新发布数据集。包含个人数据的截图和横幅需遵循../../ETHICS.md中的最小化规则。