shodan-censys-recon

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Shodan & Censys Recon

Shodan与Censys侦察

Shodan and Censys continuously scan the internet and expose the results. You query their data, so reconnaissance stays passive — you never send a packet to the target.

Shodan和Censys持续扫描互联网并公开扫描结果。你查询的是他们的数据，因此侦察属于被动操作——你永远不会向目标发送数据包。

Tools

工具

Shodan — broadest device/banner coverage. Web, API, and
```
shodan
```
CLI.
Censys — strong on certificates and structured host data.
FOFA / ZoomEye / Netlas — useful alternatives with different coverage.

Shodan —— 覆盖最广泛的设备/横幅信息。支持网页端、API和
```
shodan
```
命令行工具。
Censys —— 在证书和结构化主机数据方面表现出色。
FOFA / ZoomEye / Netlas —— 覆盖范围不同的实用替代工具。

Query patterns (Shodan)

查询模式（Shodan）

text

org:"Example Corp"            # everything attributed to an org
net:203.0.113.0/24           # a CIDR range
hostname:example.com         # by hostname
ssl.cert.subject.CN:example.com
product:"MongoDB" port:27017 # exposed databases
http.title:"index of"        # open directories
http.favicon.hash:<hash>     # sites sharing a favicon (find siblings)

text

org:"Example Corp"            # everything attributed to an org
net:203.0.113.0/24           # a CIDR range
hostname:example.com         # by hostname
ssl.cert.subject.CN:example.com
product:"MongoDB" port:27017 # exposed databases
http.title:"index of"        # open directories
http.favicon.hash:<hash>     # sites sharing a favicon (find siblings)

What it reveals

可获取的信息

Attack surface — open ports, running services and versions, and known vulns (Shodan tags CVEs).
Tech stack — server software, frameworks, and device types from banners.
Exposed assets — unauthenticated databases, dashboards, cameras, and ICS/SCADA devices (report responsibly; do not access them).
Pivots —
```
http.favicon.hash
```
and shared certs cluster an org's scattered infrastructure; feed IPs back to
```
whois-dns-recon
```
.

攻击面 —— 开放端口、运行中的服务及其版本，以及已知漏洞（Shodan会标记CVE）。
技术栈 —— 从横幅信息中获取服务器软件、框架和设备类型。
暴露的资产 —— 未认证的数据库、仪表板、摄像头以及ICS/SCADA设备（请负责任地报告；请勿访问这些资产）。
拓展线索 ——
```
http.favicon.hash
```
和共享证书可将某组织分散的基础设施关联起来；可将获取的IP反馈至
```
whois-dns-recon
```
进行进一步侦察。

Rules

规则

Observing exposure via Shodan is passive and legal; connecting to or accessing the exposed service is not unless authorized. See ../../ETHICS.md.

通过Shodan观察暴露情况属于被动操作且合法；但连接或访问暴露的服务则不合法，除非获得授权。详见../../ETHICS.md。