repository·master·Indexed 25 days ago
https://github.com/achillean/shodan-pythonOfficial Python wrapper for the Shodan REST API and experimental Streaming API. It provides programmatic access to Shodan's search engine for Internet-connected devices, allowing developers to automate bulk IP lookups, interact with the exploit database via shodan.Shodan.Exploits, consume real-time data streams via shodan.Shodan.Stream, and manage network alerts through a CLI.
Shodan is a search engine for Internet-connected devices. The library provides access to:
shodan Python library is the official wrapper for the Shodan REST API and the experimental Streaming API. It also provides functionality to search for exploits using the Shodan Exploits REST API.To use the GIF Creator example, you need to install the arrow and shodan Python packages, as well as the ImageMagick system software. ImageMagick provides the convert command required to merge images into an animated GIF.
On Ubuntu or other Debian-based distributions, use apt-get to install ImageMagick.
sudo easy_install arrow shodan
sudo apt-get install imagemagickTo use the Shodan library, initialize the Shodan object with your API key. You can then perform host lookups, search for banners using a cursor for streaming results, or count specific query results.
from shodan import Shodan
api = Shodan('MY API KEY')
# Lookup an IP
ipinfo = api.host('8.8.8.8')
print(ipinfo)
# Search for websites that have been "hacked"
for banner in api.search_cursor('http.title:"hacked by"'):
print(banner)
# Get the total number of industrial control systems services on the Internet
ics_services = api.count('tag:ics')
print('Industrial Control Systems: {}'.format(ics_services['total']))Install the Shodan library via the cheeseshop using easy_install. To upgrade to the latest version, use the -U flag.
$ easy_install shodan
# To upgrade
$ easy_install -U shodanTo connect to the Shodan service, import the shodan module and initialize the shodan.Shodan class with your API key.
import shodan
SHODAN_API_KEY = "insert your API key here"
api = shodan.Shodan(SHODAN_API_KEY)shodan alert command group allows you to manage network alerts, which monitor specific IP addresses or network ranges for changes and triggers. You can create, list, remove, and export these alerts.The Shodan Radar is a console-based application that displays an ASCII world map with real-time data points from the Shodan stream. It uses ncurses to render the map and displays information about recent banners (IP, port, country, and city) at specific geographic coordinates.
Controls:
q: Quit the application.r: Redraw the window (useful for fixing encoding/rendering bugs or hiding messages).Shodan class with your API key. You can optionally provide a proxies dictionary for the requests library to route your traffic through a proxy.To search Shodan using Python, initialize the shodan.Shodan client with your API key. Use the api.search(query) method to execute a search. The returned object contains a 'matches' key, which is a list of dictionaries representing the search results. You can iterate through these matches to access specific fields, such as 'ip_str' to retrieve the IP address of each service found.
import shodan
import sys
# Configuration
API_KEY = "YOUR_API_KEY"
# Setup the api
api = shodan.Shodan(API_KEY)
# Perform the search
query = 'apache'
result = api.search(query)
# Loop through the matches and print each IP
for service in result['matches']:
print service['ip_str']You can create animated GIFs of an IP address's historical screenshots by using the Shodan API to retrieve host history and ImageMagick to process the images.
Workflow:
screenshots.json.gz) using the Shodan CLI: shodan download screenshots.json.gz has_screenshot:true.shodan.helpers.iterate_files() to loop through the downloaded data.api.host(ip_str, history=True) to retrieve all historical banners for that IP.screenshot data from the opts field in the banner.convert command from ImageMagick to compile the images into a GIF.Note: The script requires a valid API_KEY and uses the arrow library to sort screenshots by timestamp for a smooth loop.
import arrow
import os
import shodan
import shodan.helpers as helpers
import sys
# Settings
API_KEY = 'YOUR_API_KEY'
MIN_SCREENS = 5
MAX_SCREENS = 24
api = shodan.Shodan(API_KEY)
# Iterate through the downloaded json.gz file
for result in helpers.iterate_files(sys.argv[1]):
# Get the historic info using the history=True flag
host = api.host(result['ip_str'], history=True)
screenshots = []
for banner in host['data']:
if 'opts' in banner and 'screenshot' in banner['opts']:
# Sort by time of day using arrow
timestamp = arrow.get(banner['timestamp']).time()
sort_key = timestamp.hour
screenshots.append((sort_key, banner['opts']['screenshot']['data']))
if len(screenshots) >= MAX_SCREENS:
break
if len(screenshots) >= MIN_SCREENS:
# Save individual frames to /tmp
for (i, screenshot) in enumerate(sorted(screenshots, key=lambda x: x[0], reverse=True)):
open('/tmp/gif-image-{}.jpg'.format(i), 'w').write(screenshot[1].decode('base64'))
# Create GIF using ImageMagick
os.system('convert -layers OptimizePlus -delay 5x10 /tmp/gif-image-*.jpg -loop 0 +dither -colors 256 -depth 8 data/{}.gif'.format(result['ip_str']))
os.system('rm -f /tmp/gif-image-*.jpg')
print(result['ip_str'])The Shodan Streaming API allows for large-scale, real-time consumption of data being gathered by Shodan. You can use api.stream.ports() to listen for data on specific ports.
Important Requirements & Limitations:
sales@shodan.io.import shodan
import sys
# Configuration
API_KEY = 'YOUR API KEY'
try:
# Setup the api
api = shodan.Shodan(API_KEY)
print('Listening for certs...')
# Stream data from specific ports
for banner in api.stream.ports([443, 8443]):
if 'ssl' in banner:
# Print out all the SSL information that Shodan has collected
print(banner['ssl'])
except Exception as e:
print('Error: {}'.format(e))
sys.exit(1)