aeondave/shodan

Shodan CLI

Passive reconnaissance via Shodan — internet-wide host/service discovery without touching targets.

Quick Start

# Initialize with API key
shodan init YOUR_API_KEY

# Search for a service/banner
shodan search "apache 2.4.49"

# Host lookup
shodan host 203.0.113.10

# Account info / credits
shodan info

Core Commands

| Command | Description | |---------|-------------| | shodan search <query> | Search Shodan index | | shodan host <ip> | Detailed host info (open ports, banners, vulns) | | shodan count <query> | Count results (no credits consumed) | | shodan download <file> <query> | Download results to compressed JSON | | shodan parse <file> | Parse downloaded results | | shodan domain <domain> | Domain intelligence | | shodan alert | Manage monitoring alerts | | shodan stats <query> | Statistics for a query | | shodan honeyscore <ip> | Honeypot score (0-1) | | shodan myip | Your public IP |

Search Filters

| Filter | Example | |--------|---------| | hostname: | hostname:example.com | | ip: | ip:1.2.3.0/24 | | org: | org:"Target Corp" | | port: | port:8080 | | product: | product:Apache | | version: | version:2.4.49 | | country: | country:IT | | os: | os:Windows | | vuln: | vuln:CVE-2021-44228 | | http.title: | http.title:"Login" | | html: | html:"admin panel" | | ssl: | ssl:"example.com" | | asn: | asn:AS12345 | | net: | net:192.168.0.0/16 |

Common Workflows

# Find infrastructure for an org
shodan search org:"Target Corp" --fields ip_str,port,product

# Download and parse org results
shodan download results.json.gz org:"Target Corp"
shodan parse --fields ip_str,port,product results.json.gz

# Find exposed login panels
shodan search http.title:"administration" org:"Target"

# CVE-based research
shodan search vuln:CVE-2021-44228

# SSL cert pivot — find all hosts sharing a cert
shodan search ssl:"example.com"

# Count without consuming query credits
shodan count org:"Target Corp"

# Reverse lookup / host details
shodan host 8.8.8.8

Favicon Hash Search

# Get favicon mmh3 hash via httpx
httpx -u https://target.com -favicon
# Outputs: [mmh3:<HASH>]

# Search Shodan for all hosts with same favicon (same product/brand)
shodan search "http.favicon.hash:<HASH>"

Monitor Target (Alerts)

# Create alert for new hosts in an org
shodan alert create "Target Corp Monitor" org:"Target Corp"

# List alerts
shodan alert list

# Download results when triggered
shodan alert download <alert_id>

Resources

| File | When to load | |------|--------------| | references/search-filters.md | Full filter reference, dork recipes, favicon hash lookup, API Python integration |