find-exposed-servers

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Find exposed servers

查找暴露的服务器

Internet-wide scanners already scanned your target. Querying their results is passive — you never send a packet to the target, so nothing appears in their logs and nothing is attributable to you. The cost is that every result is a claim about a moment in the past, and the beginner's mistake is reading a banner as the current state of a live host.

全互联网扫描器早已扫描过你的目标。查询这些扫描平台的结果属于被动操作——你不会向目标发送任何数据包，因此目标日志中不会出现相关记录，扫描活动也无法归因于你。其代价是，每条结果都只是对过去某个时刻的陈述；新手常犯的错误，是将 banner 解读为实时主机的当前状态。

Which platform first

首先选择哪个平台

You hold	Reach for	Why
An IP	Shodan host lookup, or the free InternetDB endpoint	One request gives ports, hostnames, and CPEs
A netblock or ASN	Shodan `net:` / `asn:` with port faceting	Shows the shape of the estate before you look at individual hosts
A hostname behind a CDN	Censys certificate-to-host joins	Censys links certs to observed hosts, which is how you find origins
A cert or a distinctive page	Favicon hash and cert subject/serial searches	Finds sibling infrastructure the DNS never links
An org name	`org:` on Shodan, `autonomous_system` on Censys	Both are attribution by network registration, so both inherit its errors
Coverage doubt	A second platform with different sensors	The platforms disagree constantly; disagreement is signal

Shodan has the broadest device and protocol coverage and the friendliest query language. Censys has more structured host records, better certificate joins, and a stricter query syntax. FOFA, ZoomEye, Netlas, Onyphe, BinaryEdge and LeakIX see different slices of the internet and are worth a pass when the first two come up empty — non-Western scanners in particular index hosts the big two miss.

你掌握的信息	优先使用	原因
IP	Shodan host lookup，或免费的 InternetDB endpoint	一次请求即可获取端口、主机名和 CPE
网段或 ASN	Shodan `net:` / `asn:` ，结合端口分面	在查看单台主机之前，先展示整体资产版图
位于 CDN 后方的 hostname	Censys 证书到主机的关联查询	Censys 将证书与观测到的主机关联起来，可借此查找源站
证书或特征明显的页面	Favicon hash 以及证书 subject/serial 搜索	查找 DNS 从未互相关联的同类基础设施
组织名称	Shodan 的 `org:` ，Censys 的 `autonomous_system`	两者都通过网络注册信息进行归属，因此也会继承其中的错误
对覆盖范围存疑	使用具有不同传感器网络的第二个平台	各平台经常得出不同结果；分歧本身就是信号

Shodan 对设备和协议的覆盖最广，查询语言也最好用。Censys 的主机记录更加结构化，证书关联能力更强，查询语法也更严格。FOFA、ZoomEye、Netlas、Onyphe、BinaryEdge 和 LeakIX 分别覆盖互联网的不同切面；当 Shodan 和 Censys 没有结果时，也值得逐一查询。尤其是非西方扫描器，能够索引大型平台经常遗漏的主机。

Shodan

bash

shodan init <api-key>
shodan host 203.0.113.10                                 # everything known about one IP
shodan search --fields ip_str,port,org,hostnames 'ssl.cert.subject.CN:example.com'
shodan count 'net:203.0.113.0/24'                        # cheap: no result credits
shodan stats --facets port,org 'net:203.0.113.0/24'      # the shape of a netblock
shodan download results.json.gz 'asn:AS64500 port:3389'
shodan parse --fields ip_str,port,product results.json.gz

Free and unauthenticated, for a single IP:

bash

curl -s https://internetdb.shodan.io/203.0.113.10 | jq .   # ports, hostnames, cpes, vulns

Filters worth knowing:

net:

port:

hostname:

asn:

org:

isp:

country:

city:

product:

version:

os:

http.title:

http.html:

http.status:

http.favicon.hash:

ssl.cert.subject.CN:

ssl.cert.issuer.CN:

ssl.cert.expired:

ssl.jarm:

ssl:

tag:

vuln:

has_screenshot:

, and

before:

after:

for scan dates.

vuln:

and some others require a paid tier.

Censys uses a structured field path syntax over a host document —

services.port

services.service_name

services.http.response.html_title

services.tls.certificates.leaf_data.subject_dn

dns.names

autonomous_system.asn

location.country

— combined with

and

or

not

. Its API v2 exposes

https://search.censys.io/api/v2/hosts/search?q=…

and

https://search.censys.io/api/v2/hosts/{ip}

with API-ID/secret basic auth.

Side-by-side query equivalents across platforms are in reference/query-cookbook.md.

bash

shodan init <api-key>
shodan host 203.0.113.10                                 # everything known about one IP
shodan search --fields ip_str,port,org,hostnames 'ssl.cert.subject.CN:example.com'
shodan count 'net:203.0.113.0/24'                        # cheap: no result credits
shodan stats --facets port,org 'net:203.0.113.0/24'      # the shape of a netblock
shodan download results.json.gz 'asn:AS64500 port:3389'
shodan parse --fields ip_str,port,product results.json.gz

免费且无需身份验证，可查询单个 IP：

bash

curl -s https://internetdb.shodan.io/203.0.113.10 | jq .   # ports, hostnames, cpes, vulns

值得掌握的过滤器包括：

net:

、

port:

、

hostname:

、

asn:

、

org:

、

isp:

、

country:

、

city:

、

product:

、

version:

、

os:

、

http.title:

、

http.html:

、

http.status:

、

http.favicon.hash:

、

ssl.cert.subject.CN:

、

ssl.cert.issuer.CN:

、

ssl.cert.expired:

、

ssl.jarm:

、

ssl:

、

tag:

、

vuln:

、

has_screenshot:

，以及用于筛选扫描日期的

before:

after:

。

vuln:

和其他一些过滤器需要付费套餐。

Censys 使用基于主机文档的结构化字段路径语法，例如

services.port

、

services.service_name

、

services.http.response.html_title

、

services.tls.certificates.leaf_data.subject_dn

、

dns.names

、

autonomous_system.asn

、

location.country

，并可结合

and

or

not

使用。其 API v2 提供

https://search.censys.io/api/v2/hosts/search?q=…

和

https://search.censys.io/api/v2/hosts/{ip}

，使用 API-ID/secret 进行 Basic auth。

各平台等效查询的并排示例见 reference/query-cookbook.md。

Reading what comes back

解读返回结果

A result is a banner plus metadata, not a verdict. Interpretation of specific service banners — what a version string implies, which fields are self-reported and which are observed — is in reference/banner-interpretation.md. The general discipline:

Check the scan timestamp on every record. Shodan records carry a timestamp; Censys carries a last-observed time. Rescan cadence varies by port and address space, so a record can be days or many months old. Report findings as "observed on <date>", never as "is".
Separate observed from claimed. The open port and the TLS certificate are observed facts. The product name and version are parsed from a banner the host chose to send, and hosts lie — deliberately, or because a distribution backported patches without changing the version string.
CVE tags are inference. They come from matching a version string against a vulnerability database. They are leads for a report, never confirmation of exploitability, and backported fixes make them wrong routinely in both directions.
Hostnames in a record come from reverse DNS and certificates, which means they can belong to a previous tenant of the IP.

一条结果只是 banner 加元数据，并不是最终结论。对具体 service banner 的解读——版本字符串意味着什么、哪些字段是自行声明的、哪些字段是实际观测到的——见 reference/banner-interpretation.md。通用原则如下：

检查每条记录的扫描时间戳。 Shodan 记录带有时间戳，Censys 则带有最后观测时间。重新扫描的频率因端口和地址空间而异，因此一条记录可能是数天或数月之前生成的。报告发现时，应表述为“observed on <date>”，绝不能表述为“is”。
区分观测事实与自我声明。 开放的端口和 TLS certificate 是观测到的事实。产品名称和版本则是从主机选择发送的 banner 中解析出来的，而主机可能会撒谎——无论是故意欺骗，还是因为发行版 backport 了补丁却没有修改版本字符串。
CVE 标签属于推断。 它们来自将版本字符串与漏洞数据库进行匹配。这些标签只是报告线索，绝不能证明漏洞可利用；无论是误报还是漏报，backport 的修复都会使其经常失准。
记录中的 hostname 来自反向 DNS 和证书，因此可能属于该 IP 的前租户。

The pivots that matter

关键 pivot

This is what makes scan platforms more than a port list.

Favicon hash. Shodan indexes a hash of the site's favicon (a MurmurHash3 of the base64-encoded icon bytes; FOFA's

icon_hash

uses the same construction). Because a favicon is usually shipped with an application rather than configured per host, searching the hash finds every host running the same appliance, framework, or the target's own branded portals — across unrelated IPs, ASNs and domains. It is the single best way to find an organization's scattered instances of one product.

TLS certificate. Search on the certificate's subject CN, its subject organization, or its serial number, and you find every host serving that certificate. A certificate serial is unique per issuer, so a serial match is a near-exact identity. Shodan also exposes a certificate fingerprint filter; check its documentation for which hash it expects rather than guessing. Combine with

find-hidden-subdomains

— CT gives you the cert, scan data gives you every host presenting it.

JARM and TLS stack fingerprints. JARM hashes how a server responds to a set of TLS handshakes, so it fingerprints the TLS stack rather than the certificate. It clusters appliances, load balancers and command-and-control frameworks. It is not unique to an organization, so treat it as a filter that narrows a search, not as an identifier.

Response-body fingerprints. A unique string from the target's pages — a tracking ID, an unusual copyright line, a custom header, a build hash — searched via

http.html:

finds other hosts serving the same application, including staging copies and the origin behind a CDN.

这些 pivot 让扫描平台不只是简单的端口列表。

Favicon hash。 Shodan 会索引网站 favicon 的 hash，即 Base64 编码后的图标字节的 MurmurHash3；FOFA 的

icon_hash

使用相同构造方式。由于 favicon 通常随应用程序一同发布，而不是针对每台主机单独配置，因此搜索该 hash 可以找到运行相同设备、框架或目标自身品牌门户的所有主机，包括分布在互不相关的 IP、ASN 和域名中的实例。这是寻找某个组织分散部署的同类产品实例的最佳方式。

TLS certificate。 按证书的 subject CN、subject organization 或 serial number 搜索，可以找到提供该证书的每一台主机。证书 serial 在每个签发机构内唯一，因此 serial 匹配几乎是精确的身份标识。Shodan 还提供证书 fingerprint 过滤器；不要凭猜测使用，应查看其文档以确认需要哪种 hash。还可以与

find-hidden-subdomains

结合使用——CT 提供证书，扫描数据则提供每一台呈现该证书的主机。

JARM 与 TLS stack fingerprint。 JARM 会对服务器响应一组 TLS handshake 的方式进行 hash，因此它指纹标识的是 TLS stack，而不是 certificate。它可以对设备、负载均衡器和 command-and-control 框架进行聚类。它并非某个组织独有的标识，因此应将其视为缩小搜索范围的过滤器，而不是身份标识。

http.html:

搜索，即可找到提供同一应用程序的其他主机，包括 staging 副本和 CDN 后方的源站。

Finding an origin behind a CDN

查找 CDN 后方的源站

When a hostname resolves to Cloudflare or another proxy, the origin still exists and is often reachable by IP. Passive routes to it, in order of reliability:

Search scan data for the target's TLS certificate on IPs outside the CDN's ASNs. Origins commonly serve the real cert directly.
Search a unique HTTP body string or favicon hash and filter out CDN ASNs.
Read historical DNS from before the CDN was adopted (
```
who-owns-this-domain
```
). Origins move less often than people assume.
Check services that bypass the proxy by design: MX hosts,
```
ftp
```
,
```
cpanel
```
,
```
direct
```
,
```
origin
```
, and non-HTTP ports on the same netblock.
Read SPF
```
ip4:
```
mechanisms — organizations authorize their own sending host, which is sometimes the web origin.

A candidate origin is a hypothesis. Confirming it by sending a request with the target's

Host

header is an active step against the target: it needs authorization. Note also that a properly configured origin rejects non-CDN traffic, so failure to confirm does not disprove the candidate.

当 hostname 解析到 Cloudflare 或其他 proxy 时，源站仍然存在，并且通常可以通过 IP 直接访问。按可靠性从高到低排列的被动路径如下：

在 CDN 的 ASN 之外搜索目标 TLS certificate 对应的 IP。源站通常会直接提供真实证书。
搜索独特的 HTTP 正文字符串或 favicon hash，并排除 CDN ASN。
查看接入 CDN 之前的历史 DNS（
```
who-owns-this-domain
```
）。源站发生变更的频率远低于人们的想象。
检查按设计即可绕过 proxy 的服务：同一网段中的 MX 主机、
```
ftp
```
、
```
cpanel
```
、
```
direct
```
、
```
origin
```
以及非 HTTP 端口。
查看 SPF
```
ip4:
```
机制——组织会授权自己的邮件发送主机，而它有时就是 Web 源站。

候选源站只是一种假设。通过向目标发送带有目标

Host

header 的请求来确认它，属于针对目标的主动操作，需要获得授权。另请注意，配置正确的源站会拒绝非 CDN 流量，因此确认失败并不能排除候选源站。

Where this goes wrong

容易出错的地方

Staleness cuts both ways. A closed port may have been open when scanned; an open port may have been closed since. Absence of a result is not absence of a service — scanners do not cover every port on every address.
Honeypots pollute everything. Deliberately exposed decoys inflate results for interesting services. Tells: implausible service combinations on one host, a very large number of open ports, default banners for many unrelated products, and hosting in research-oriented netblocks. Shodan exposes a honeyscore estimate at
```
https://api.shodan.io/labs/honeyscore/{ip}?key=
```
— treat it as a hint, not a ruling.
Targets can game the scanners. Scanner source addresses are publishable, so a defender can serve fabricated banners to them specifically. High-value targets sometimes do.
org:
and
isp:
are network registration, not ownership. On cloud netblocks they name the cloud provider, and on resold space they name a reseller. Attribution by
```
org:
```
alone is how people end up reporting a neighbour's exposed database as the target's.
Shared hosting and shared IPs. One IP can serve hundreds of unrelated sites. Ports and vulnerabilities found there belong to the host, not necessarily to your target.
Screenshots and banners contain personal data. Exposed dashboards and cameras index real people. That is a data-protection problem the moment you save it.
Platforms disagree, and each free tier truncates. A single-platform search that finds nothing means one sensor network saw nothing.

数据过时会产生双向误判。 扫描时开放的端口可能已经关闭；扫描时关闭的端口也可能曾经开放。没有结果并不代表不存在服务——扫描器无法覆盖每台地址上的每个端口。
蜜罐会污染所有结果。 刻意暴露的诱饵会夸大有趣服务的结果。判别线索包括：同一主机上不合常理的服务组合、异常大量的开放端口、许多互不相关产品的默认 banner，以及托管在研究用途网段中。Shodan 在
```
https://api.shodan.io/labs/honeyscore/{ip}?key=
```
提供 honeyscore 估算值——应将其视为提示，而不是裁决。
目标可以操纵扫描器。 扫描器的源地址可以公开，因此防守方可以专门向它们返回伪造 banner。高价值目标有时确实会这样做。
org:
和
isp:
反映的是网络注册信息，而非所有权。在云网段中，它们通常表示云服务商；在转售地址空间中，则可能表示经销商。仅凭
```
org:
```
进行归属判断，正是有人将邻居暴露的数据库报告为目标资产的原因。
共享托管与共享 IP。 一个 IP 可能承载数百个互不相关的网站。在那里发现的端口和漏洞属于该主机，不一定属于你的目标。
截图和 banner 可能包含个人数据。 暴露的管理面板和摄像头会索引真实人员的信息。一旦保存这些内容，就会构成数据保护问题。
各平台会得出不同结果，而且每个免费套餐都会截断结果。 单一平台没有搜索结果，只意味着一个传感器网络没有观测到目标。

Confidence grading

置信度分级

Confirmed exposure — the same service on the same IP and port appears in two independent scan platforms, or in one platform across multiple scan dates, and the IP is tied to the target by a certificate the target demonstrably controls or by a netblock reassigned to the target by name.
Probable — a single recent observation on an IP linked to the target by favicon hash, body-string match or reverse DNS. Or a cross-platform match on an IP whose ownership you have not independently established.
Unconfirmed — attribution resting only on
```
org:
```
/
```
isp:
```
, a shared-hosting IP, a single stale record, a CVE tag with no other evidence, or a host with honeypot characteristics.

Never upgrade a grade by connecting to the service. Record the platform, the query, the scan timestamp and the record identifier for every finding.

已确认暴露——同一服务在同一 IP 和端口上同时出现在两个独立扫描平台中，或在同一个平台的多个扫描日期中出现；并且该 IP 可通过目标明确控制的证书，或通过按名称重新分配给目标的网段，与目标建立关联。
可能——目标近期的一次单独观测记录，且该 IP 通过 favicon hash、正文字符串匹配或反向 DNS 与目标关联。或者，某个所有权尚未独立确认的 IP 在多个平台上出现匹配结果。
未确认——归属依据仅有
```
org:
```
/
```
isp:
```
、共享托管 IP、单条过时记录、没有其他证据支持的 CVE 标签，或具有蜜罐特征的主机。

绝不要通过连接服务来提高置信等级。对于每项发现，都应记录平台、查询语句、扫描时间戳和记录标识符。

Worked example

实例

Target:

example-fintech.test

, authorized external attack-surface review, passive collection only.

The apex resolves into Cloudflare, so port scanning the resolved IP would only have described Cloudflare. Instead, take the cert subject CN from

find-hidden-subdomains

and search scan data for hosts serving it. Three hits: two Cloudflare addresses, and one in a European hosting provider's ASN with 443 and 22 open. That third host is the likely origin.

Its favicon hash, searched back, returns six more hosts. Four are the target's regional portals. Two are unrelated companies — the favicon is a stock icon shipped with the framework, not the target's own. That is the dead end, and the lesson: check whether a favicon is actually distinctive before treating a hash match as attribution.

net:

on the origin's /29 shows a second host with 3306 open and a MySQL banner, scanned four months ago. Old, so it may be gone, but it is reportable as observed. The netblock's RIR record shows a reassignment to the target's legal name, which is what turns "an IP with the right cert" into attribution.

Stop there. Do not connect to 3306, do not send a

Host

header to the origin. Report both, with dates and queries, and hand the reassigned netblock back to

who-owns-this-domain

目标：

example-fintech.test

，已获得授权的外部攻击面审查，仅进行被动收集。

主域名解析到 Cloudflare，因此对解析所得 IP 进行端口扫描只能说明 Cloudflare 的情况。正确的做法是从

find-hidden-subdomains

获取 cert subject CN，再在扫描数据中搜索提供该证书的主机。共得到三个结果：两个是 Cloudflare 地址，另一个位于欧洲某托管服务商的 ASN 中，并开放了 443 和 22 端口。第三台主机很可能是源站。

反向搜索其 favicon hash，又返回六台主机。其中四台是目标的区域门户，另外两台则属于无关公司——该 favicon 是框架自带的通用图标，并非目标自己的图标。因此这是一个死胡同。得出的经验是：将 hash 匹配作为归属依据之前，应先确认 favicon 是否确实具有辨识度。

对源站的 /29 使用

net:

查询，显示第二台主机开放了 3306 端口，并显示 MySQL banner，但该记录已是四个月前的扫描结果。数据较旧，因此服务可能已经消失，但仍可作为已观测发现进行报告。该网段的 RIR 记录显示，它已重新分配给目标的法律实体名称；正是这一点将“持有正确证书的 IP”转化为可归属于目标的证据。

到此停止。不要连接 3306 端口，也不要向源站发送

Host

header。报告上述两项发现，并附上日期和查询语句，然后将重新分配后的网段交回

who-owns-this-domain

继续分析。

Pivots

New selector	Goes to
Certificate subjects and SANs on discovered hosts	`find-hidden-subdomains`
Netblocks, ASNs, reverse-DNS hostnames	`who-owns-this-domain`
Organization names from cert subjects and RIR records	`x-ray-a-company` , `who-really-owns-it`
Exposed repo, CI or registry services	`secrets-in-git-history`
Historical content on a discovered host	`read-deleted-pages`
Indexed paths on a discovered service	`google-like-a-spy`
A host/cert/ASN cluster to lay out	`graph-the-network`

新选择器	转到
已发现主机上的证书 subject 和 SAN	`find-hidden-subdomains`
网段、ASN、反向 DNS 主机名	`who-owns-this-domain`
证书 subject 和 RIR 记录中的组织名称	`x-ray-a-company` 、 `who-really-owns-it`
暴露的 repo、CI 或 registry 服务	`secrets-in-git-history`
已发现主机上的历史内容	`read-deleted-pages`
已发现服务上的已索引路径	`google-like-a-spy`
待梳理的 host/cert/ASN 集群	`graph-the-network`

Legal and ToS notes

法律与 ToS 注意事项

Querying a scan platform is lawful passive research. Acting on the result is where the line is: connecting to an exposed database, opening an admin panel, viewing an exposed camera feed, or fetching a file from an open share can constitute unauthorized access under computer-misuse law in most jurisdictions, and the absence of a password is not a defence. A finding authorizes you to report — to the abuse contact from the netblock's RIR record, or the relevant CERT — and nothing else. Scan-platform terms also restrict redistribution of their data, so quote findings in a report rather than republishing the dataset. Screenshots and banners containing personal data fall under the minimization rules in ../../ETHICS.md.

查询扫描平台属于合法的被动研究。对结果采取行动则是界线所在：连接暴露的数据库、打开管理面板、查看暴露的摄像头画面，或从开放共享中获取文件，在大多数司法辖区都可能构成计算机滥用法律下的未授权访问，而“没有密码”并不能成为抗辩理由。一项发现只授权你进行报告——向网段 RIR 记录中的滥用举报联系人或相关 CERT 报告——仅此而已。扫描平台的条款还会限制其数据的再分发，因此应在报告中引用发现，而不要重新发布整个数据集。包含个人数据的截图和 banner 还应遵守 ../../ETHICS.md 中的数据最小化规则。