Query
MeowQL Search
0
results
Tab
Page 1 of 1
>_
MeowQL Search
Query your network scan data with MeowQL. Type a query above or try one of these examples:
port:443
country:US
service:ssh
cloud:aws
http.title:"login"
port:{22,80,443}
port:443 and country:US
not cloud:*
MeowQL Reference
| field:value | Contains (LIKE %value%) |
| field="exact" | Exact match |
| field!=value | Not equal |
| field=~pattern | Regex match (GLOB) |
| field*=wild* | Wildcard (GLOB) |
| field>10 | Greater than |
| field<100 | Less than |
| field:* | Field exists (IS NOT NULL) |
| field:{a,b,c} | Set / IN (multiple values) |
| expr1 and expr2 | AND (explicit) |
| expr1 expr2 | AND (implicit, like Shodan) |
| expr1 or expr2 | OR |
| not expr | Negation |
| -field:value | Negation prefix |
| (expr) | Grouping |
Service Fields
| port | Port number |
| service | Service name |
| product | Product name |
| version | Version string |
| banner | Service banner |
JSON Dynamic Fields
| enrichment.* | Enrichment JSON data |
| fingerprint.* | Fingerprint JSON data |
| http.headers.* | HTTP headers |
HTTP Fields
| http.title | Page title |
| http.server | Server header |
| http.status | HTTP status code |
| http.body | Response body |
| http.webserver | Webserver software |
| http.ssl | Uses SSL/TLS |
| http.body_hash | Body SHA256 hash |
| tech | Technologies |
Host Fields
| ip | IP address (supports CIDR) |
| hostname | Hostname |
| domain | Associated domains |
| domain.source | Domain source |
| country | Country code |
| city | City name |
| asn | AS number |
| org | AS organization |
| cloud | Cloud provider |
| cloud.region | Cloud region |
| timezone | Timezone |
TLS Fields
| tls.cert.cn | Subject CN |
| tls.cert.issuer | Issuer CN |
| tls.cert.names | SANs |
| tls.cert.issuer_org | Issuer organization |
| tls.cert.not_before | Not before timestamp |
| tls.cert.is_ca | Is CA certificate |
| tls.cert.sig_algo | Signature algorithm |
| tls.cert.serial | Serial number (hex) |
| tls.jarm | JARM fingerprint |
| tls.chain_position | Chain position |
| tls.self_signed | Self-signed cert |
port:443 country:FR
HTTPS servers in France
http.title:"login" and not cloud:aws and country:FR
Login pages not hosted on AWS in France
ip:192.168.1.0/24 and service:ssh
SSH servers in a specific subnet
(port:8443 or port:443) and tls.cert.cn:"*.com"
Web servers with *.com cert
port:{22,80,443} and org:"Google"
Common ports at Google AS
enrichment.anonymous_login:true and service:ftp
FTP servers with anonymous login
http.headers.Vary:RSC
Servers using Vary header containing RSC string
enrichment.nfs_found:true
NFS servers with exported shares