Shodan CLI

Information Gathering

Beginnerlow risk

The Shodan Command-Line Interface allows you to interact with the Shodan search engine database directly from the terminal to query internet-connected assets and vulnerability data feeds.

Installation

sudo apt install shodan && shodan init <API_KEY>

Basic Syntax

shodan [command] [options]

Quick Facts

Full Name

Shodan CLI

License

Freemium

Author

John Matherly (achillean)

Written In

Python

Platforms

Linux, macOS, Windows

Category

OSINT / Device Search

First Release

2009

API Key Required

Yes (free tier available)

Tool Overview

Shodan CLI is the command-line interface for the Shodan search engine, the world's first search engine for internet-connected devices. It allows you to query Shodan's massive database of internet devices directly from your terminal.

Created by John Matherly in 2009, Shodan indexes banners, ports, vulnerabilities, and metadata from internet-connected devices worldwide. The CLI provides access to host lookups, vulnerability scans, and infrastructure searches without using the web interface.

Shodan is invaluable for security professionals who need to discover exposed infrastructure, check for vulnerabilities, and understand their organization's internet footprint. It provides historical data that real-time scanners cannot match.

Common Commands

shodan host 8.8.8.8Host lookup - View historical open ports, vulnerabilities, and location info for a public IP

shodan search apache port:22Global engine search - Find exposed servers indexing specific technologies globally

shodan init API_KEYInitialize API key

shodan search "apache"Search devices

shodan search "port:22 country:US"Filtered search

shodan stats --facets country port:22Statistics

shodan infoShow API plan and query count

shodan myipGet your public IP address

shodan search http.title:"Login" --fields ip_str,port,org --limit 20Search for login pages with field filtering

shodan scan submit --periodic 1week 192.168.1.0/24Schedule recurring scan

shodan network 192.168.1.0/24 --filename network-report.jsonNetwork report to JSON file

shodan download --filename apache-scan 200 apache country:USDownload scan results as compressed archive

shodan parse --filename apache-scan.json.gz --limit 100Parse downloaded scan results

shodan honeyscore 192.168.1.1Check if IP is a honeypot

shodan scan status --id SCAN_IDCheck scan progress

Step-by-Step Guide

1Acquire a valid API key from your registered Shodan account
2Authenticate your terminal session using: shodan init <YOUR_KEY>
3Perform specific queries to locate target infrastructure or exposed technologies
4Retrieve detailed historical port and vulnerability data for specific IP addresses
5Save the JSON or tabular output for offline analysis

Warnings

Shodan only indexes publicly available data but using it to plan unauthorized access is illegal
Free tier API keys have rate limits that can result in temporary bans if exceeded
Querying Shodan for specific targets may reveal your investigation interest in the data
Vulnerability data may be outdated and should be verified before taking action
Shodan results should be combined with active scanning for comprehensive assessments

Use Cases

Host Intelligence

Look up any public IP to see its historical open ports, services, and vulnerabilities.

Infrastructure Discovery

Search for exposed devices by technology, country, port, or organization.

Vulnerability Scanning

Check if specific IPs or domains have known vulnerabilities in Shodan's database.

Attack Surface Monitoring

Monitor your organization's internet-facing assets for unauthorized exposure.

IoT Device Search

Discover cameras, routers, industrial systems, and other IoT devices online.

Key Features

Host Lookup: Detailed information on any public IP address.
Search Syntax: Filter by port, country, org, product, and more.
Statistics: Aggregate data on search results with facets.
DNS Tools: Resolve and reverse DNS lookups.
Vulnerability Data: Historical CVE information on discovered services.
JSON Export: Save results in machine-readable formats.

Related Tools

Nmap

Information Gathering

Active scanner for real-time port and service detection.

Nuclei

Web Application

Vulnerability scanner for testing discovered services.

Frequently Asked Questions

What is Shodan CLI used for?

Shodan CLI is the command-line interface for the Shodan search engine, used for searching internet-connected devices, discovering exposed infrastructure, checking vulnerabilities, and gathering intelligence on IP addresses and domains.

Is Shodan free?

Shodan CLI is free to install and use with a free API key. However, the free tier has limited queries (1 per second). Paid plans offer higher query rates and more data access.

What can Shodan find?

Shodan can find web servers, databases, IoT devices, industrial control systems, cameras, routers, and any internet-connected service. It indexes banners, ports, vulnerabilities, and location data.

Is Shodan legal?

Shodan itself is legal — it only indexes publicly available information. However, using Shodan to discover targets for unauthorized access is illegal. Always use Shodan for defensive security or authorized testing.

How is Shodan different from Nmap?

Shodan is a passive search engine that indexes pre-scanned data from the entire internet. Nmap actively scans targets. Shodan provides historical data; Nmap provides real-time results.

How do I install Shodan CLI?

Install Shodan using: sudo apt install shodan on Kali Linux. On other systems, install via pip: pip install shodan.

How do I initialize Shodan CLI?

Run shodan init YOUR_API_KEY to authenticate. Get a free API key by creating an account at shodan.io.

How do I search for devices with Shodan?

Use shodan search 'apache' to find devices running Apache. Add filters like port:22 or country:US to narrow results.

What are the most common Shodan commands?

Common commands include: shodan host IP (host lookup), shodan search 'query' (search devices), shodan stats (statistics).

How do I check vulnerabilities with Shodan?

Use shodan host IP to see known CVEs for a host. Also use shodan search 'vuln:CVE-2021-44228' to find vulnerable devices.

What is the shodan host command?

The shodan host command shows all data Shodan has on an IP address including ports, services, banners, and vulnerabilities.

How do I save Shodan results?

Use --filename results.json with search commands to save results to a file for offline analysis.

What are Shodan search filters?

Common filters include: port:22, country:US, org:'Google', product:'Apache', os:'Windows', vuln:'CVE-2021-44228'.

Can Shodan find my own devices?

Yes, use shodan stats --facets org to see what Shodan knows about your organization's internet-facing devices.

How do I limit Shodan queries?

Free tier allows 1 query per second. Pace your queries or upgrade to a paid plan for higher rate limits.

What is the shodan stats command?

The shodan stats command shows aggregate statistics for search results, useful for understanding the distribution of devices.

How does Shodan compare to Censys?

Both are internet search engines. Shodan is more established with better IoT coverage. Censys offers more detailed certificate and web data.

Output Explanation

Shodan CLI output shows internet-connected devices matching your search query. Results include IP addresses, open ports, service banners, vulnerabilities (CVEs), organization, and geolocation data. Host lookups reveal historical port data and known vulnerabilities.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.