tools

Overview

Shodan is a search engine for internet-connected devices. Unlike traditional web search engines, Shodan continuously scans the internet for open TCP/IP ports and indexes the banners, certificates, and metadata returned by devices — servers, routers, IoT devices, industrial controllers, cameras, and more. It is used both passively (as a search engine) and actively (via CLI) during OSINT and reconnaissance phases to identify a target organization’s exposed infrastructure.

Target / Context

External infrastructure reconnaissance — identifying exposed services, versions, and open ports for a target organization without directly contacting their systems.

Installation

ℹ︎Installation Commands: 
pip install shodan

Initialize with your API key from account.shodan.io

shodan init <API_KEY>

Basic Usage

ℹ︎Basic Usage:

Search by organization:

shodan search org:"Target Company"

Look up a specific IP:

shodan host <IP>

Flags & Options

ℹ︎Flags & Options:
Flag/CommandDescriptionExample
shodan host <IP>Show open ports, services, and banners for an IPshodan host 8.8.8.8
shodan search <query>Search Shodan for matching hostsshodan search apache 2.4
shodan count <query>Count results for a query without showing detailsshodan count org:“Acme Corp”
shodan download <filename> <query>Download query results to a fileshodan download results org:“Acme”
shodan parse <filename>Parse a downloaded results fileshodan parse results.json.gz
shodan myipShow your current external IP addressshodan myip
shodan stats <query>Return summary stats for a queryshodan stats port:22
shodan alertManage network monitoring alertsshodan alert create “My Network” 1.2.3.0/24

Common Use Cases

Investigate a Target’s IP Addresses

During passive recon, after identifying IP addresses associated with a target organization (via DNS, crt.sh, WHOIS), run each IP through Shodan to see open ports, service banners, and software versions.

ℹ︎Commands:

Single IP:

shodan host <IP>

From a list of IPs:

for i in $(cat ip-addresses.txt); do shodan host $i; done

Identify Exposed Services for an Organization

Search for all hosts associated with an organization name or ASN:

ℹ︎Commands: 
shodan search org:"Target Corporation"
shodan search net:1.2.3.0/24
shodan search hostname:targetcompany.com

Search for Specific Vulnerable Services

Find exposed instances of specific software versions or configurations:

ℹ︎Commands: 
shodan search "Apache/2.4.49"
shodan search "product:OpenSSH version:7.4"

Find exposed Telnet

shodan search port:23
shodan search "default password"

Shodan Web UI Filters (for browser-based searches)

FilterExample
org:org:"Amazon"

| hostname: | hostname:target.com | | net: | net:192.168.1.0/24 | | port: | port:22 | | product: | product:nginx | | version: | version:2.4.49 | | country: | country:US | | os: | os:"Windows Server 2016" | | ssl.cert.subject.cn: | ssl.cert.subject.cn:*.target.com |

  • Service Enumeration

References / Images