In this demo, we'll look at using the Shodan command line interface.
We'll start with the help information from Shodan
and the command line tool itself.
Before we can begin using the CLI tool,
we need to grab our API key from our registered account.
Then we'll walk through a few commands such as init to set up the tool,
count, host, and search. Again, this demo will be on the current Kali
Linux, so we can skip the installation step and start using the command
line quickly. From the Shodan website, there is a link to the command
line tool information.
It's cli.shodan.io for quick reference. Here, you'll find
information on the installation of the tool if you're not using
Kali Linux and a link to get your API key.
Further down the page,
you'll see a listing of some of the commands available, documentation, and
some examples for using them. To use the Shodan command line tool, you'll
need a registered account and an API key.
First, we select the API Key text and copy it.
Then we'll flip over to a terminal to configure Shodan. Shodan ‑h will
display the help text. To configure Shodan, we'll give it our API key. Now we
have access to use Shodan through the command line.
Let's start with some simple counting. Count postfix will show us the
number of postfix email servers that Shodan has found.
Remember, these are based on banner text searches.
If we want to know how many Cisco IOS systems have been found,
we can ask Shodan to count those as well.
The Shodan command line will also return information for a specific host.
This host has a few open ports with one being identified as a specific
product and version. This host has even more network ports open.
Notice the level of details provided here.
Shodan will also let you search from the command line.
This simple search returns systems running the XML server, which is
currently in the news with a large number of vulnerabilities.
There's one line per result with up to 1,000 results returned by default.
You can see the help information here for search.
Notice that you can display specific fields shown and change the limits.
Here is the same exim search with specific fields and just 10 results.
Shodan can bundle search results into a JSON file,
which you can analyze later, convert to CSV or use for scripting. These
commands should get you started using Shodan on the command line.
Next, we'll look at basic searching on the Shodan
website and the search results.