Shodan Search and Web Interfaces Part 2.

It appears that these NetGear devices are the primary users of SSLv2-compliant services on this network.

Example: Telnet exploration. Let’s say we want to explore devices on the Internet that are using Telnet. Let’s combine the previous commands like this:

mkdir telnet-data shodan stream --ports 23,1023,2323 --datadir telnet-data/ --limit 10000

First, we create a telnet-data folder to store Telnet data. Then, we request 10,000 records (–limit 10000) from the data stream for the standard Telnet ports (–ports 23,1023,2323) and save the results to the telnet-data/ folder via –datadir.

Maltego Addon

Maltego is an open source application designed to collect, analyze, and visually explore data from various sources.

The Shodan addon for Maltego provides 2 new entities – Service and Exploit and 5 new transforms:

• searchShodan

• searchShodanbyDomain

• searchShodanbyNetblock

• toShodanHost

• searchExploits

Shodan — overview of capabilities and practical examples

Shodan is an API-driven platform that collects banners and metadata about publicly available services on the Internet. It allows you to automatically retrieve the same information as through the web interface, but in a form that is easy to script and integrate. The REST API is used for searching, getting host information, working with facets, and other auxiliary operations, while the Streaming API provides a “raw” feed of banners in real time – it is used for monitoring and large research tasks. Note: access to the full stream usually requires a paid subscription or data license.

Usage restrictions

Shodan has several types of limits that depend on the tariff plan. First, query credits — they are spent on queries with filters or when moving to the next pages of results; a simple query without filters may not write off credits, but a query like apache country:us and moving to page 2 already write off credits. Second, scan credits — each on-demand scan is requested via the API and spends credits for one scan request. Third, alerts — the number of network alerts (and the number of IPs/ranges in them) is limited by the plan; maximum — ~100 alerts per account. It is important to remember that query and scan credits are renewed at the beginning of the month, so plan your research accordingly.

Facets – how to quickly get a picture

Facets provide aggregated statistics on an area of ​​interest — for example, port distribution, SSL/TLS versions, SSH fingerprints, etc. If a search returns many results, facets allow you to “see from afar” the main patterns and bottlenecks: which ports are the most common, which products are detected most often, which protocol versions are used. Through the API and CLI, you can specify the necessary facets and get snapshots of statistics — this is often the first step before in-depth analysis or selective data downloads.

Getting Started with Python

To work with the API in Python, install the official library:

easy_install shodan
# або оновлення
easy_install -U shodan

Initialization is simple – pass your API key:

import shodan
api = shodan.Shodan('YOUR API KEY')

You can get the key in your account: https://account.shodan.io. After that, you are ready to perform searches, get host details, and work with facets through convenient library methods. It is recommended to always wrap calls in try/except to correctly handle API errors and not stop script execution.

Example of searching and iterating over results

One of the basic examples is searching for a word and displaying IP and banners:

try:
    results = api.search('apache')
    print('Results found: %s' % results['total'])
    for result in results['matches']:
        print('IP: %s' % result['ip_str'])
        print(result['data'])
        print('')
except shodan.APIError as e:
    print('Error: %s' % e)

By default, each page contains up to 100 banners; to navigate to another page, use the page= parameter. If you need to iterate through all banners sequentially without facets, it is convenient to use api.search_cursor(‘apache’) – this makes it easier to automatically process a large number of results.

Host Information and History

To see what Shodan found for a specific IP, use api.host():

host = api.host('217.140.75.46')
print("IP: %s\nOrganization: %s\nOS: %s" %
      (host['ip_str'], host.get('org','n/a'), host.get('os','n/a')))
for item in host['data']:
    print("Port: %s\nBanner: %s" % (item['port'], item['data']))

Optionally, you can get a full history of banners by IP by passing history=True; this will bring back services that are no longer active and help restore past configurations or identify past vulnerabilities.

On-demand scanning

If you need to scan your network immediately, Shodan supports on-demand scans via the API:

scan = api.scan('198.20.69.0/24')
# або список мереж
scan = api.scan(['198.20.49.30', '198.20.74.0/24'])

This is an asynchronous process: after initiation, you will receive the task id, the number of IPs in the scan (count) and credits_left — the remaining credits for scans. Use the id to monitor the status and further process the results.

Streaming API — real-time

Streaming API returns a stream of banners in real time — it is a “raw” stream, without the ability to search within it. It is used to monitor new detections or to track specific patterns (vulnerabilities, certain products). Example of CVE filtering:

def has_vuln(banner, vuln):
    return 'vulns' in banner.get('opts', {}) and vuln in banner['opts']['vulns']

for banner in api.stream.banners():
    if has_vuln(banner, 'CVE-2015-0204'):
        print(banner)

Please note: Standard plans often only give access to a small portion of the stream (~1%), full access requires the purchase of a Data License.

Alerts – Network Alerts and Stream Subscription

Alerts are a convenient way to track events for specific network bands. Create an alert:

alert = api.create_alert('Production network', '198.20.69.0/24')
# або декілька діапазонів
alert = api.create_alert('Prod+Staging', ['198.20.69.0/24','198.20.70.0/24'])

You can make a story temporary by specifying expires. After creation, you get an id — subscribe to it and handle banners the same way as in a standard stream:

for banner in api.stream.alert(alert['id']): print(banner)

You can quickly create, delete, and export alerts through the CLI; this is convenient for real-time monitoring of production networks.

Example – analysis of public MongoDB

Over the years, when MongoDB often did not require authentication, many instances ended up exposed on the internet. Shodan captures the banners of such instances — the banner contains metadata about the version, database lists, totalSize, etc. To bulk download banners:

shodan download --limit -1 mongodb-servers.json.gz product:mongodb

Then we process the file locally: we iterate over the records, extract the JSON part of the banner, sum totalSize and count the most common database names. A simple script will give a summary in human format (GB/TB/PB) and the top 10 database names, which helps to estimate the volume of published data.

Practical research workflow

Recommended approach for public network surface reconnaissance: first assess the scale (shodan count net:… or api.search), then collect aggregates via shodan stats –facets (ports, products, ssl.version), identify anomalies (non-standard ports, old SSL/SSH, public databases), download the necessary results (shodan download) and process them locally with scripts. After that, configure alerts for continuous monitoring of changes and automate routine processing of results.

Conclusion

Shodan is not just a search engine for devices on the Internet, but a powerful analytics tool that combines the convenience of the command line, the flexibility of the API and the depth of data about the global infrastructure. Using the CLI, REST API and Streaming API, you can effectively monitor open ports, services, vulnerabilities, analyze networks and even create your own security monitoring systems.

With facets, alerts, and the ability to work with streaming data in real time, Shodan is becoming a strategic-level tool — for both cybersecurity professionals and infrastructure researchers. When used correctly, it allows not only to identify risks, but also to prevent potential incidents, find configuration errors, and track network changes.

Today, Shodan is one of the basic platforms for OSINT, pentesting, and monitoring open services worldwide. Having mastered its interface and API, you actually get access to the “X-ray” of the Internet — capable of showing what is hidden behind millions of IP addresses and ports.