find-exposed-serverslisted

Find internet-exposed hosts, ports, services and devices using third-party internet-scan data instead of touching the target. Covers Shodan and Censys query syntax, service banners, favicon-hash and TLS-certificate pivots, origin-IP discovery behind Cloudflare or a CDN, and exposed databases, dashboards, cameras and ICS devices. Use when asked what a company has exposed to the internet, to check open ports on an IP or netblock, or to write a Shodan filter query. Applies to external attack-surface management, third-party and vendor security review, M&A technical diligence, and pre-engagement reconnaissance. Reference at useosint.com/skills/find-exposed-servers.
useosint/osint-skills · ★ 16 · DevOps & Infrastructure · score 78

Install: claude install-skill useosint/osint-skills

# Find exposed servers Internet-wide scanners already scanned your target. Querying their results is passive — you never send a packet to the target, so nothing appears in their logs and nothing is attributable to you. The cost is that every result is a claim about a moment in the past, and the beginner's mistake is reading a banner as the current state of a live host. ## Which platform first | You hold | Reach for | Why | |---|---|---| | An IP | Shodan host lookup, or the free InternetDB endpoint | One request gives ports, hostnames, and CPEs | | A netblock or ASN | Shodan `net:`/`asn:` with port faceting | Shows the shape of the estate before you look at individual hosts | | A hostname behind a CDN | Censys certificate-to-host joins | Censys links certs to observed hosts, which is how you find origins | | A cert or a distinctive page | Favicon hash and cert subject/serial searches | Finds sibling infrastructure the DNS never links | | An org name | `org:` on Shodan, `autonomous_system` on Censys | Both are attribution by network registration, so both inherit its errors | | Coverage doubt | A second platform with different sensors | The platforms disagree constantly; disagreement is signal | Shodan has the broadest device and protocol coverage and the friendliest query language. Censys has more structured host records, better certificate joins, and a stricter query syntax. FOFA, ZoomEye, Netlas, Onyphe, BinaryEdge and LeakIX see different slices of the internet and are w