Shodan Query Builder
Build a Shodan search from filters: port, org, net, product, http.title, certificate fields and more, with validation and a ready link.
Runs in your browser Your input never leaves your device.
Authorised use only. This tool writes a search query; it does not touch any target. Run it for your own assets or for work you have permission to do.
Report a problem with this tool
About this tool
Shodan searches are made of filters such as port:443, org:"Example Corp" or http.title:"Dashboard", separated by spaces. Writing them by hand means remembering the filter names, quoting values that contain spaces, escaping quotes and keeping port lists, country codes and dates in the right form. This tool does that for you: pick a filter from the list, type the value, add as many rows as you need, and the query appears below. Choose "is not" on a row to put a minus sign in front of it, which excludes matches. Several ports can be given at once (80,443) and are written as one port filter. Country codes are upper-cased, AS numbers get their AS prefix, and values are checked as you type: ports must be 1-65535, net must be an IPv4 range, and so on. The free-text box adds plain words that Shodan looks for in the service banner. Starter queries cover common checks of your own estate, such as databases or remote desktop open to the internet, and expired certificates. Shodan itself decides what each filter returns and which filters your account may use (some, such as vuln, need a paid plan), so adjust to what your account allows. Search engines index what is already public, so a query is not an attack, but use it only for your own assets or for work you are authorised to do. The query is built in your browser; nothing is sent until you open the link.
How to use it
- Choose a starter query or add a filter.
- Pick the filter, then type its value. Use "is not" to exclude.
- Fix anything the tool flags in red.
- Copy the query, or open it in Shodan (you may need to sign in).
Example
Spaces in a value are quoted, ports are joined, and "is not" adds a minus.
org: Example Corp port: 3306,5432 product (is not): nginx
org:"Example Corp" port:3306,5432 -product:nginx
Common problems
- Shodan says the filter needs a plan
- Some filters are limited to paid accounts. Remove the filter or use a different one.
- No results for a query that should match
- Shodan only lists what its scanners saw recently. Loosen the filters, check the spelling of org names, and try the net or hostname filter instead.
- The query is rejected as invalid
- Check the red messages under the rows. Values with spaces are quoted for you, but a filter such as port needs numbers only.