Shodan

Shodan#

Shodan is a search engine for internet-connected devices. The operator uses it for recon, asset discovery, and tracking exposure to known services across an estate.

Setup#

Install the CLI.

# easy_install shodan

Upgrade existing Shodan Python library.

# easy_install -U shodan

Once installed initialize with the API key from the Shodan account page.

# shodan init YOUR_API_KEY

CLI#

Command

Effect

shodan info

Display Shodan query and scan credits available.

shodan myip

Show your external IP.

shodan host <IPAddress>

Show information about an IP.

shodan count <search string>

Count results for a search.

shodan stats --facets <facet> <string> country:<##>

Show statistical information about a service.

shodan search --fields ip_str,port,org,hostnames <string> | tee search_results.txt

Search banner info for a text string and dump IP, port, org, hostnames.

shodan search --fields ip_str,port,org,hostnames <string> country:<##> | tee search_results.txt

Same, scoped to a specific country.

shodan download <outfile> <search query>

Save JSON results to a file.

shodan scan submit --filename scan_results.txt <IPAddress or CIDR>

Shodan network scanning request.

shodan stream --datadir /dir/path/results

Stream live Shodan scanning results.

shodan stream --ports 80,443,3389

Stream live results scoped to ports.

shodan alert create "Scan results" <IP/CIDR>

Real-time network alert streaming and monitoring.

shodan stream --alert=<Alert ID> --datadir=scan-results/

Stream by alert ID.

shodan scan internet <port> <protocol>

Scan the entire internet (enterprise license).

shodan domain example.com -D

Query and display subdomains, records, IP, and ports.

Web UI#

Shodan IP search.

> 185.30.20.1
> 185.30.20.1/24

Filter search results filter:value.

> city:"Istanbul" port:23,3389

Filters.

Filter

Description

category

ics, malware, category:ics.

city

City name, city:beijing.

country

Country name, country:china.

hostname

Match device hostname, server:"gws" hostname:"google".

net

Show results only in a CIDR range, net:185.30.20.0/24.

org

Narrow by organization, org:"AT&T".

port

Service port, port:23,22,3389.

product

Service running, product:openssh.

geo

Geo coordinates, geo:"56.7492,118.2640".

os

Operating system, os:"windows 10".

before / after

Devices in a time range, apache after:21/01/2019 before:14/02/2019.

Find clones by searching data.0.http.html_hash in the raw data view, then search for the value.

> hash:-1604454775

References#

Contents