Offensive Security Researcher & Quantum Cryptography Analyst

Extracting information from servers with shodan

Abdul Wahab Junaid
Extracting information from servers with shodan

Shodan is a search engine that allows you to scan the internet for open ports and services. This can be a valuable tool for security researchers, penetration testers, and anyone who wants to learn more about the overall security posture of the internet.

Extracting information from servers with Shodan can be done using a variety of methods, including:

Once you have found the servers that you are interested in, you can extract information from them using a variety of methods, including:

Once you have extracted information from servers with Shodan, you can use that information to:

Some additional tips for extracting information from servers with Shodan:

Shodan is a powerful tool that can be used to extract information from servers. By using Shodan and the methods described above, you can gather valuable intelligence about the overall security posture of the internet.

Shodan offers a suite of services that provide access to its vast database of internet-connected devices, enabling users to gather insights into the overall security posture of the internet. These services cater to different needs and skill levels, offering a range of functionalities and usage options.

Accessing Shodan’s primary services:

1. Shodan Search:

2. Shodan Monitor:

3. Shodan Maps:

4. Shodan Images:

5. Shodan API:

6. Shodan Developer Portal:

Shodan’s services offer valuable tools for researchers, security professionals, and organizations to gain insights into the internet’s connected devices, assess potential security risks, and track changes in the cyber landscape. By utilizing these services effectively, users can enhance their understanding of the ever-evolving digital world and make informed decisions to protect their systems and data.

The Shodan RESTful API

The Shodan RESTful API is a powerful tool that allows users to programmatically access Shodan’s vast database of internet-connected devices. It provides a comprehensive set of endpoints for searching, filtering, and analyzing Shodan data, enabling developers, researchers, and security professionals to integrate Shodan’s capabilities into their own applications and workflows.

Key Features of the Shodan RESTful API:

Prerequisites for Using the Shodan RESTful API:

Getting Started with the Shodan RESTful API:

  1. Create a Shodan account and obtain an API key.
  2. Explore the Shodan API documentation: The Shodan API documentation provides detailed explanations of API endpoints, parameters, and response formats.
  3. Choose a programming language and development environment: Select a programming language that suits your preferred development workflow and tools.
  4. Install the Shodan API client library: Install the appropriate API client library for your chosen programming language to simplify API interactions.
  5. Write code to interact with the Shodan API: Use the Shodan API client library to make API requests, parse responses, and process results.

Setting Shodan API Key as an Environment Variable

This Python script demonstrates how to set the Shodan API key as an environment variable for use in other scripts.

1. Importing the Required Module:

Python
import os

The script imports the os library for handling environment variables.

2. Setting the Shodan API Key as an Environment Variable:

Python
# Set the Shodan API key as an environment variable
os.environ['SHODAN_API_KEY'] = 'SET_YOUR_OWN_API_KEY'

The Shodan API key is set as an environment variable using os.environ['SHODAN_API_KEY']. Make sure to replace 'SET_YOUR_OWN_API_KEY' with your actual Shodan API key.

3. Verifying the Environment Variable:

Python
# Verify that the environment variable is set correctly
if 'SHODAN_API_KEY' not in os.environ:
    print("Error: SHODAN_API_KEY environment variable not set.")
    exit(1)

The script checks if the environment variable 'SHODAN_API_KEY' is set. If not, it prints an error message and exits with code 1.

4. Success Message:

Python
print("SHODAN_API_KEY environment variable set successfully.")

If the environment variable is set correctly, the script prints a success message.

Explanation Summary:

Before running this script, make sure to replace 'SET_YOUR_OWN_API_KEY' with your actual Shodan API key. This script is typically run once to set the environment variable for use in other scripts.

Python
import os

# Set the Shodan API key as an environment variable
os.environ['SHODAN_API_KEY'] = 'SET_YOUR_OWN_API_KEY'

# Verify that the environment variable is set correctly
if 'SHODAN_API_KEY' not in os.environ:
    print("Error: SHODAN_API_KEY environment variable not set.")
    exit(1)

print("SHODAN_API_KEY environment variable set successfully.")
Python
import os

shodan_api_key = os.environ['SHODAN_API_KEY']
print(shodan_api_key)

Using Shodan API to Obtain Information for an IP Address

This Python script utilizes the Shodan API to retrieve information about a specified IP address.

1. Importing the Required Modules:

Python
import requests
import os

The script imports the requests library for making HTTP requests and the os library for handling environment variables.

2. Retrieving Shodan API Key and Setting Target IP:

Python
SHODAN_API_KEY = os.environ['SHODAN_API_KEY']
ip = '1.1.1.1'

The Shodan API key is obtained from the environment variables using os.environ. The target IP address (ip) is set to ‘1.1.1.1’ for demonstration purposes.

3. Defining ShodanInfo Function:

Python
def ShodanInfo(ip):
    try:
        result = requests.get(f"https://api.shodan.io/shodan/host/{ip}?key={SHODAN_API_KEY}&minify=True").json()
    except Exception as exception:
        result = {"error": "Information not available"}
    return result

A function ShodanInfo is defined, which takes an IP address as an argument. It makes a GET request to the Shodan API endpoint for the specified IP address, passing the API key. The minify=True parameter reduces the amount of data returned. Any exceptions are caught, and an error message is returned if information is not available.

4. Calling the ShodanInfo Function:

Python
print(ShodanInfo(ip))

The script calls the ShodanInfo function with the target IP address and prints the result.

Python
#!/usr/bin/env python

import requests
import os

SHODAN_API_KEY = os.environ['SHODAN_API_KEY']
ip = '1.1.1.1'

def ShodanInfo(ip):
    try:
        result = requests.get(f"https://api.shodan.io/shodan/host/{ip}?key={SHODAN_API_KEY}&minify=True").json()
    except Exception as exception:
        result = {"error":"Information not available"}
    return result

print(ShodanInfo(ip))

Explanation Summary:

Using Shodan Python Library to Perform a Shodan Search

This Python script demonstrates how to use the Shodan Python library to perform a Shodan search for devices using the keyword ‘nginx’. It assumes you have set your Shodan API key as an environment variable.

1. Importing Required Modules:

Python
#!/usr/bin/python

import shodan
import os

The script imports the shodan library for interfacing with the Shodan API and the os library for handling environment variables.

2. Retrieving Shodan API Key:

Python
SHODAN_API_KEY = os.environ['SHODAN_API_KEY']
print(SHODAN_API_KEY)

The script retrieves the Shodan API key from the environment variable 'SHODAN_API_KEY' and prints it for verification.

3. Initializing Shodan API Object:

Python
shodan = shodan.Shodan(SHODAN_API_KEY)

An instance of the Shodan class is created using the API key.

4. Performing Shodan Search:

Python
try:
    resultados = shodan.search('nginx')
    print("results :",resultados.items())
except Exception as exception:
    print(str(exception))

A Shodan search is performed for devices with the keyword ‘nginx’ using the search method. The results are printed, and any exceptions are caught and printed.

Explanation Summary:

Python
#!/usr/bin/python

import shodan
import os

SHODAN_API_KEY = os.environ['SHODAN_API_KEY']
print(SHODAN_API_KEY)
shodan = shodan.Shodan(SHODAN_API_KEY)

try:
    resultados = shodan.search('nginx')
    print("results :",resultados.items())
except Exception as exception:
    print(str(exception))

Shodan Search Script with Argument Parsing

This Python script performs Shodan searches based on user-provided arguments. It uses the Shodan Python library for interacting with the Shodan API and the argparse module for parsing command-line arguments.

1. Importing Required Modules:

Python
#!/usr/bin/env python

import shodan
import argparse
import socket
import sys
import os

The script imports the necessary modules: shodan for accessing the Shodan API, argparse for parsing command-line arguments, socket for resolving hostnames to IP addresses, sys for system-related functions, and os for handling environment variables.

2. Setting Shodan API Key:

Python
SHODAN_API_KEY = os.environ['SHODAN_API_KEY']
api = shodan.Shodan(SHODAN_API_KEY)

The Shodan API key is retrieved from the environment variable 'SHODAN_API_KEY', and an instance of the Shodan class is created using this key.

3. Command-Line Argument Parsing:

Python
parser = argparse.ArgumentParser(description='Shodan search')

parser.add_argument("--target", dest="target", help="target IP / domain", required=None)
parser.add_argument("--search", dest="search", help="search", required=None)

parsed_args = parser.parse_args()

The script uses the argparse module to create a command-line parser. It defines two optional arguments, --target for specifying a target IP/domain and --search for performing a Shodan search. The parsed arguments are stored in the parsed_args variable.

4. Shodan Search Based on Arguments:

Python
if len(sys.argv)>1 and sys.argv[1] == '--search':
    try:
        results = api.search(parsed_args.search)
        print('Results: %s' % results['total'])
        for result in results['matches']:
            print('IP: %s' % result['ip_str'])
            print(result['data'])
    except shodan.APIError as exception:
        print('Error: %s' % exception)

If the --search argument is provided, a Shodan search is performed using the specified search query. The results, including IP addresses and data, are printed.

5. Shodan Host Information Based on Arguments:

Python
if len(sys.argv)>1 and sys.argv[1] == '--target':
    try:
        hostname = socket.gethostbyname(parsed_args.target)
        results = api.host(hostname)
        print("""
                IP: %s
                Organization: %s
                Operating System: %s
        """ % (results['ip_str'], results.get('org', 'n/a'), results.get('os', 'n/a')))

        for item in results['data']:
            print("""Port: %s Banner: %s""" % (item['port'], item['data']))

    except shodan.APIError as exception:
        print('Error: %s' % exception)

If the --target argument is provided, the script resolves the target hostname to an IP address, retrieves information about the host from Shodan, and prints relevant details, including IP, organization, and operating system. Additionally, it prints information about open ports and banners.

Explanation Summary:

Usage Examples:

Python
#!/usr/bin/env python

import shodan
import argparse
import socket
import sys
import os

SHODAN_API_KEY = os.environ['SHODAN_API_KEY']

api = shodan.Shodan(SHODAN_API_KEY)

parser = argparse.ArgumentParser(description='Shodan search')

parser.add_argument("--target", dest="target", help="target IP / domain", required=None)
parser.add_argument("--search", dest="search", help="search", required=None)

parsed_args = parser.parse_args()

if len(sys.argv)>1 and sys.argv[1] == '--search':
    try:
        results = api.search(parsed_args.search)
        print('Results: %s' % results['total'])
        for result in results['matches']:
            print('IP: %s' % result['ip_str'])
            print(result['data'])
    except shodan.APIError as exception:
        print('Error: %s' % exception)
        
if len(sys.argv)>1 and sys.argv[1] == '--target':
    try:
        hostname = socket.gethostbyname(parsed_args.target)
        results = api.host(hostname)
        print("""
                IP: %s
                Organization: %s
                Operating System: %s
        """ % (results['ip_str'], results.get('org', 'n/a'), results.get('os', 'n/a')))

        for item in results['data']:
            print("""Port: %s Banner: %s""" % (item['port'], item['data']))
        
    except shodan.APIError as exception:
        print('Error: %s' % exception)

Shodan DNS Resolution and Host Information Script

This Python script utilizes the Shodan API to perform DNS resolution for a given domain and retrieves detailed information about the corresponding IP address.

1. Importing Required Modules:

Python
import shodan
import requests
import os

The script imports the necessary modules: shodan for accessing the Shodan API, requests for making HTTP requests, and os for handling environment variables.

2. Setting Shodan API Key:

Python
SHODAN_API_KEY = os.environ['Shodan_api_key'] 
api = shodan.Shodan(SHODAN_API_KEY)

The Shodan API key is retrieved from the environment variable 'Shodan_api_key', and an instance of the Shodan class is created using this key.

3. Performing DNS Resolution and Retrieving Host Information:

Python
domain = 'www.python.org'
dnsResolve = f"https://api.shodan.io/dns/resolve?hostnames={domain}&key={SHODAN_API_KEY}"

try:
    resolved = requests.get(dnsResolve)
    hostIP = resolved.json()[domain]

    host = api.host(hostIP)
    print("IP: %s" % host['ip_str'])
    print("Organization: %s" % host.get('org', 'n/a'))
    print("Operating System: %s" % host.get('os', 'n/a'))

    for item in host['data']:
        print("Port: %s" % item['port'])
        print("Banner: %s" % item['data'])

except shodan.APIError as exception:
    print('Error: %s' % exception)

Usage Example:

Summary:

Python
import shodan
import requests
import os

SHODAN_API_KEY = os.environ['Shodan_api_key'] 
api = shodan.Shodan(SHODAN_API_KEY)

domain = 'www.python.org'

dnsResolve = f"https://api.shodan.io/dns/resolve?hostnames={domain}&key={SHODAN_API_KEY}"

try:
    resolved = requests.get(dnsResolve)
    hostIP = resolved.json()[domain]
   
    host = api.host(hostIP)
    print("IP: %s" % host['ip_str'])
    print("Organization: %s" % host.get('org', 'n/a'))
    print("Operating System: %s" % host.get('os', 'n/a'))


    for item in host['data']:
        print("Port: %s" % item['port'])
        print("Banner: %s" % item['data'])

except shodan.APIError as exception:
        print('Error: %s' % exception)

Shodan Search Script for FTP Servers

This Python script utilizes the Shodan API to search for FTP servers that have anonymous users logged in.

1. Importing Required Modules:

Python
import shodan
import re
import os

The script imports the necessary modules: shodan for accessing the Shodan API, re for regular expressions, and os for handling environment variables.

2. Setting Shodan API Key and Initializing Shodan API:

Python
servers =[]
shodanKeyString = os.environ['SHODAN_API_KEY']
shodanApi = shodan.Shodan(shodanKeyString)

The Shodan API key is retrieved from the environment variable 'SHODAN_API_KEY', and an instance of the Shodan class is created using this key.

3. Performing Shodan Search:

Python
results = shodanApi.search("port: 21 Anonymous user logged in")
print("hosts number: " + str(len( results['matches'])))
for result in results['matches']:
    if result['ip_str'] is not None:
        servers.append(result['ip_str'])

The script performs a Shodan search using the query string "port: 21 Anonymous user logged in". It retrieves matching results and prints the total number of hosts found. The IP addresses of the matching hosts are stored in the servers list.

4. Displaying FTP Server IP Addresses:

Python
for server in servers:
    print(server)

Finally, the script iterates over the servers list and prints each FTP server’s IP address.

Usage Example:

Summary:

Python
#!/usr/bin/env python

import shodan
import re
import os

servers =[]
shodanKeyString = os.environ['SHODAN_API_KEY']
shodanApi = shodan.Shodan(shodanKeyString)

results = shodanApi.search("port: 21 Anonymous user logged in")
print("hosts number: " + str(len( results['matches'])))
for result in results['matches']:
	if result['ip_str'] is not None:
		servers.append(result['ip_str'])
		
for server in servers:
    print(server)
Exit mobile version