Shodan Search Engine

The website that started it all. The Shodan search engine is the main website that lets you search for devices across the Internet. We recommend learning the query syntax to help you find exactly what you're looking for.

Themes

Outrun? Dark? Cyberpunk? Shodan has a few different themes available to let you explore the Internet in style. Visit your account settings page to set the theme.

IP Lookup API

You can do unlimited IP lookups using the Shodan API. All you need is an upgraded Shodan API key and you're good to go! Note that the website only shows a small fraction of the data that's collected - with the API you will see everything.

Network Monitoring

Keep track of the devices that you have exposed to the Internet. Setup notifications, launch scans and gain complete visibility into what you have connected. Check the Developer dashboard to see how many IPs you can monitor as part of your account level.

Search via the API

Use the website to find the right query syntax and then take it to the API so you can automate the process. You can also use the API to download the search results to your local computer for additional processing.

from shodan import Shodan
from shodan.cli.helpers import get_api_key

api = Shodan(get_api_key())
for banner in api.search_cursor("product:mongodb"):
    print(banner)
      

Shodan CLI

The Shodan command-line interface exposes most of the API in a user-friendly way so you can access the Shodan database without needing to write your own scripts.

Historical IP Lookups

When did an IP first expose a service? When was it compromised? How quickly are patches deployed to the IP? You can lookup the history of an IP using the website, API or CLI.

Shodan Images

Shodan collects screenshots for many different services and as a member you get access to a new search interface that makes browsing those screenshots much easier. Shodan Images uses the has_screenshot:true search filter to only show you results that have images. Note that Shodan extracts the text from the images so you can search within the content of a screenshot.

Shodan Maps

Explore the world of Internet-connected devices using a map. Zoom in, pan around and narrow down results based on the GeoIP information. Shodan Maps uses the geo search filter to only show you results that are within your browser view.

Shodan Trends

How have remote work, government policies or the IoT changed the Internet? Shodan Trends lets you search across the Internet's history to discover trends. The main Shodan search engine only indexes recent data so if you're looking to search across our historical archives then use Trends.

Shodan Chrono

Want to see how a cronjob in Kubernetes is progressing or if your shell script finished? Use Chrono to have a progress bar on the web for your scripts or containers.

Shodan Snippets

Share one-line command-line snippets with descriptions written in Markdown. We wrote this initially for our own support team to share snippets with customers.

DNS Lookups

Shodan has its own DNS database containing information about subdomains. It's sourced using a variety of OSINT techniques and API users commonly access it to get a list of subdomains. With a Membership or higher you can access the information via the CLI or API.

Search by Vulnerability

Shodan does both verified and unverified vulnerability assessments. Everybody can see that information when searching or doing IP lookups but starting with the Small Business subscription you can search across the Internet based on a vulnerability.

{
    "CVE-2008-2939": {
        "references": [
            "http://lists.apple.com/archives...009/May/msg00002.html",
            "http://lists.opensuse.org/ope...ce/2008-11/msg00000.html",
            "http://marc.info/?l=bugtraq&m=123376588623823&w=2",
            "http://marc.info/?l=bugtraq&m=125631037611762&w=2",
            "http://rhn.redhat.com/errata/RHSA-2008-0967.html",
            "http://sunsolve.sun.com...nt.do?assetkey=1-26-247666-1",
            "http://support.apple.com/kb/HT3549",
        ],
        "verified": false,
        "cvss": 4.3,
        "summary": "Cross-site scripting (XSS) vul..."
    }
}
      

Search by Tags

Tags are used by Shodan to classify services at a higher level. That often involves doing additional validation of the data. For example, the ics tag is applied to industrial control systems that have responded with the proper protocol and don't look like honeypots.

Memberships for the Organization

Starting with the Corporate subscription you can upgrade other Shodan accounts at your organization with the Membership. Only your primary/ administrative account will have the Corporate-level access but if you have analysts that want to use the website then this gives them the necessary access.

Bulk Data Files

Shodan provides daily bulk data files which contain all the information that crawlers collected during a given day. Each file is compressed using Gzip and contains a single JSON-encoded banner per line. The most recent 30 days are always available for download and depending on your account you may also have access to historical data.

Real-Time Firehose

The Shodan Firehose is a real-time data feed containing all the information that the Shodan crawlers are collecting. The stream is provided as a web service – once a client connects to the Streaming API it starts receiving JSON-encoded banners until it disconnects from the server. The individual banners are separated by newlines which means you can process the firehose lineby-line and each one contains a banner.

Streaming Search Queries

Instead of running a search query every day to ask for new results you can stay connected to a new API endpoint and Shodan will send you any banners that meet the search criteria. Read on to learn more about streaming queries.

DNS Database

Shodan has been curating its own database of DNS information on domains and their subdomains for the purpose of identifying services that only respond if you send the correct hostname or that are deployed to the cloud. Enterprise users can download the entire DNS database to have an on-premise copy of this information for fast subdomain discovery.

Hostname Scan of the Internet

Once a month Shodan does a hostname-based scan of the Internet where we check a few hundred million hostnames. This includes sending the correct Host and SNI headers. The main search engine indexes by IP and port so those banners get munged together on the regular API but Enterprise customers can see it in their bulk data files or firehose.

{
    "_shodan": {
        "crawler": "65683fa99d390e0163b89adb344e9233c7422efb",
        "id": "2581f30d-6df7-4111-af8b-a429c46f1d69",
        "module": "smtp",
        "options": {
            "hostname": "testserver.com",
            "referrer": "2581ab0d-6ce7-4111-af8b-a429c46a248c"
        }
    }
}
      

InternetDB

InternetDB is a relatively small, embeddable Shodan database that contains information about recently-seen banners for devices and lets you do fast IP lookups without calling an external API. Similar to a local GeoIP database but instead of providing location information we provide network information. It's small enough to fit on a USB drive and is what powers the InternetDB API.

{
    "ip": "51.83.59.99",
    "ports": [
        443,
        500
    ],
    "cpes": [
        "cpe:/a:igor_sysoev:nginx"
    ],
    "hostnames": [],
    "tags": [
        "vpn"
    ],
    "vulns": []
}
      

Full Access for the Organization

Every team, department or business unit at the organization gets full access to everything that Shodan offers. You're nolonger limited to having a single Shodan account with elevated access - everybody at the organization can get it now.