Cyber Search Engines

Shodan is often called the "Hacker's Search Engine". Shodan has servers scanning the entire internet for devices. Once it finds them, it maps their ports and collects other useful information. Shodan has advanced search commands similar to google dorks. Shodan also has a flexible API that can be leveraged into many other tools.

Shodan Dorking

Cyber Search Tools

Asset Search Engines are fantastic tools that regular scan the internet taking inventory of every entity that they can detect. Using large networks of sensors and scanners, they can document items like registration information, open ports, documented network traffic, and much more.

Internet Asset Search Engines
  • Spyse - The Internet Asset Search Engine. Spyse has some advanced scanning features that can allow you to discover seen vulnerabilities by CVE score or subdomains, on top of detailed metadata on your target. With its heavy toolset and API functionality, it is a popular choice for automated enrichment.

  • https://fullhunt.io/ - FullHunt is the attack surface database of the entire Internet.

  • Maltiverse - A search engine for threat based indicators. Maltiverse also has multiple threat feeds you can ingest into your intel platform for alerting.

  • Onyphe - A Cyber Defense Search Engine for open-source and cyber threat intelligence data collected by crawling various sources available on the Internet or by listening to Internet background noise. ONYPHE does correlate this information with data gathered by performing active Internet scanning for connected devices and also by crawling Web site URLs.

  • IntellX - Search Engine that allows searching with selectors, i.e. specific search terms such as email addresses, domains, URLs, IPs, CIDRs, Bitcoin addresses, IPFS hashes, etc. It searches in places such as the darknet, document sharing platforms, whois data, public data leaks and others. It also keeps a historical data archive of results, similar to how the Wayback Machine from archive.org stores historical copies of websites.

  • https://synapsint.com/ - The unified OSINT research tool that allows you to search for various data points about different indicators.

  • https://natlas.io/ - Scaling Network Scanning Utility

  • Netlas.io - Discover, Research and Monitor any Assets Available Online

  • Pulsedive - Provides a great balance between technical information and enriched intelligence

  • Guardicore Threat Intelligence - Intelligence feeds and enrichment by Gaurdicore's research group and sensor network.

  • ThreatMiner - ThreatMiner is a threat intelligence portal designed to enable analysts to research under a single interface. It is used in the SANS FOR578 Cyber Threat Intelligence course

  • OPSWAT Metadefender - Contextual database of Indicators, vulnerabilities, and other data parseable for enrichment.

  • ShadowServer - A free utility that has a huge amount of data from gathered honeypots, malware samples, and internet wide scan data.

  • Threat Encyclopedia by Trend Micro - Huge intelligence repository for looking up information on malware, vulnerabilities, and even threat actors.

  • https://threatview.io/ - Collection of useable threat intelligence feeds and resources by purpose.

  • BinaryEdge - Another internet scanning platform. Has the search ability to look for any Indicator of Compromise, database, webcam, or even public facing Industrial Control Systems.

  • Censys.io - A cyber search engine focused around asset management. Helps with asset discovery and alerting.

  • https://leakix.net/ - Search LeakIX for host data leaks, open ports, software and geoip.

  • Riddler - Allows you to search in a high quality dataset

Favicon tools

Last updated