Post cover image

August 6, 2026

The Shodan Searches That Should Not Return Results (But Do)

Exposed databases with no password. Surveillance cameras streaming private spaces. Industrial controllers managing water treatment and…

By Mohan Sai Krishna G M

5 min read

Exposed databases with no password. Surveillance cameras streaming private spaces. Industrial controllers managing water treatment and power grids. Admin panels with default credentials. Every query in this article returns live results. Every result is real. Every one of them should not exist.

The previous article introduced Shodan — what it is, how a free account works, and how to spend your first 30 minutes exploring. If you followed along, you have already seen cameras, databases, and admin panels in your search results.

This article goes further. These are the searches that produce results so surprising they change how you think about connected infrastructure. Not hypothetical scenarios. Live queries you can run right now, with a free account, that return real devices on real networks.

Databases With No Password, No Authentication, No Excuse

Exposed databases are the source of some of the largest data breaches in history. Shodan makes them trivially discoverable.

MongoDB. Older versions were insecure by default — no authentication, bound to all network interfaces. Thousands of legacy instances remain exposed years after the security community raised the alarm.

"MongoDB Server Information" port:27017 -authentication

"MongoDB Server Information" port:27017 -authentication

This returns MongoDB instances that accept connections without credentials. Some contain customer records, financial data, and authentication tokens.

None

Elasticsearch. Used to index large datasets — log files, customer records, application data. When exposed without authentication, it provides full read access to every indexed document.

port:9200 "elastic indices"
None

Redis. An in-memory data store commonly used for caching and session management. Older versions were deployed without authentication by default. An exposed Redis instance is particularly dangerous — it can be used to write arbitrary data, including SSH keys and web shells, to the host system.

port:6379 "redis_version"
None

The exposure is almost never intentional. It is the result of default configurations, cloud deployments that bind to 0.0.0.0, firewall rules that were never written, and infrastructure that was deployed quickly and secured never.

The Camera Feed — Not a Metaphor

Shodan indexes cameras from virtually every manufacturer. The queries are specific:

product:"Hikvision"
html:"Dahua"
"Server: GoAhead"
title:"Network Camera"
title:"Live View"

Hikvision cameras commonly appear on ports 80, 443, 554, 8000, 8080. Dahua cameras use ports 80, 443, 554, 8000, 8080, 8081, 8888. GoAhead is an embedded web server used by dozens of camera brands — Foscam, TP-Link, Vivotek, and others.

Filter by city to see the specificity: product:"Hikvision" city:"Mumbai". The results show cameras in specific neighbourhoods — in homes, businesses, parking lots, and private spaces. Many web interfaces show the live view directly in the browser. No player. No plugin. No authentication.

The ethical line is clear: discovering an exposed camera is a finding. Viewing the feed without authorisation is unauthorised access. Responsible practitioners document the exposure and report it.

Industrial Control Systems — The Category That Changes Everything

This is the section that produces the strongest reaction from anyone who sees it for the first time.

Industrial control systems — the software that manages physical infrastructure — are searchable on Shodan. Not in theory. Not in a lab. Right now.

None

Browse by vendor and protocol.

Modbus (port 502) — manufacturing, energy, building automation. Exposed Modbus devices can potentially be read from and written to remotely.

BACnet (port 47808) — HVAC, lighting, fire suppression, access control. An exposed BACnet device means a building's environmental controls are accessible from the public internet.

Siemens S7 (port 102) — programmable logic controllers used in manufacturing, energy, water treatment. They control physical processes — temperatures, pressures, flow rates, motor speeds.

EtherNet/IP (port 44818) — industrial networking in manufacturing and process control.

None

A water treatment facility with an exposed SCADA interface is one default password away from a public safety incident. A manufacturing plant with an exposed PLC is one misconfigured firewall rule away from production disruption. These devices were designed for isolated networks. The decision to connect them to the internet — for remote monitoring, for convenience — was made without considering that Shodan would make them searchable.

Admin Panels With Everything Inside

Beyond Tomcat Manager and phpMyAdmin from the previous article:

Jenkins — CI/CD with command-line access:

"Dashboard [Jenkins]"
"Remember me on this computer"

An exposed Jenkins instance often contains build credentials, deployment keys, API tokens, git repository access, and sometimes the Script Console — a Groovy shell that executes on the server with the same permissions as the Jenkins process.

Kubernetes Dashboard — container orchestration:

title:"Kubernetes Dashboard"
port:10250 "Kubernetes"

Visualisation of the entire container infrastructure — every pod, every service, every secret. Port 10250 can also provide command-line access inside running containers.

Docker API — container management:

port:2375 "Docker"

Docker's management API, when exposed without authentication, provides full control over containers — create, start, stop, delete, and execute commands inside.

VPN Gateways — network access:

"GlobalProtect" port:443
"SonicWall" port:443

VPN management interfaces exposed to the public internet. Some with known vulnerabilities. Some with default credentials. All providing direct access to the organisation's internal network if compromised.

The Searches That Should Not Work (But Do)

The security community maintains a curated collection of Shodan queries that return results so surprising they seem impossible. Each one is real.

None

Exposed WordPress config files — database credentials in plain text:

"DB_PASSWORD" ext:php

QuickBooks default shares — financial data:

"QuickBooks"

Printers with admin panels:

title:"Printer Status" "Supplies Status"

Network-attached storage with file access:

"Synology" "Web Station"
"QNAP" "Login"

Telnet devices — credentials in cleartext:

port:23

Each query returns live results. Each result is a real device on a real network. Each represents a finding that someone should have caught before it was searchable.

The Numbers That Change How You Think

Even with a free account, shodan count tells you how widespread an exposure is:

shodan count port:3389

Exposed Remote Desktop Protocol — direct access to Windows desktops. One of the most common initial access vectors for ransomware.

shodan count vuln:CVE-2017-0144

Hosts still vulnerable to EternalBlue — the exploit behind WannaCry. Patched in 2017. Still exploitable now.

None

The numbers are always higher than people expect. Always.

What This Tells Us

Every device in every search result above is publicly accessible. Shodan did not compromise anything. It connected to open ports and recorded what it found.

The exposures are not edge cases. They are not rare. They are everywhere — in every country, in every industry, in infrastructure operated by organisations of every size.

The gap between "this should not exist" and "this exists and is searchable" is the gap that Shodan makes visible. Run these queries against your own infrastructure. What you find is what the internet already sees.

None

This is the second article in a series on Shodan. The previous piece covered what Shodan is and how to get started. The next piece covers the favicon trick that bypasses firewalls — one 16×16 icon file that revealed 363 hostnames, 373 IPs, and 5,091 open ports from a single search query.