Skip to content

Instantly share code, notes, and snippets.

@achillean
achillean / gifcreator.py
Last active December 15, 2021 21:17
Create GIFs from a Shodan json.gz file using the API
#!/usr/bin/env python
# Dependencies:
# - arrow
# - shodan
# - ImageMagick
#
# Installation:
# sudo easy_install arrow shodan
# sudo apt-get install imagemagick
#
@achillean
achillean / dump-images.py
Created January 17, 2016 21:56
Shodan script to parse out screenshot data from banners and store it in a separate directory.
#!/usr/bin/env python
# dump-images.py
#
# Extract all the image data from the banners and store them as separate images
# in a provided output directory.
#
# Example:
# shodan download --limit -1 screenshots.json.gz has_screenshot:true
# ./dump-images.py screenshots.json.gz images/
@achillean
achillean / roku-apps.csv
Last active February 1, 2025 12:32
Ranking of Most Popular Roku Apps based on Shodan (https://www.shodan.io)
Netflix 863
Roku Home News 767
Amazon Video 733
Movie Store and TV Store 717
Hulu 694
HBO Now 683
Showtime 678
VUDU 633
Pandora 569
YouTube 550
@achillean
achillean / hacking-team-c2.json
Created March 1, 2016 02:10
Hacking Team C2 History: 212.71.254.212
{
"region_code": null,
"ip": 3561488084,
"area_code": null,
"latitude": 51.5,
"hostnames": ["li635-212.members.linode.com"],
"postal_code": null,
"dma_code": null,
"country_code": "GB",
"org": "Linode",
#!/usr/bin/python
'''
Python 3.5 compatible
This will create a comma delimited file
it requires you to have a GeoIP2-City database from MaxMind.
https://www.maxmind.com/en/geoip2-databases
https://www.maxmind.com/en/geolite2-developer-package
If you do not wish to purchase this you can comment out the GeoDB class
and use the ShodanNode class. You will also need to remove the code for
any of the MaxMind variable and keys
#!/usr/bin/env python
import shodan
import sys
# Configuration
API_KEY = "apikey"
# Input validation
if len(sys.argv) == 1:
@achillean
achillean / http-components.csv
Last active June 29, 2021 08:31
Sample output from the Shodan CLI running: shodan stats --facets http.component:100,port:20 http-components http
Query http
http.component port
jQuery 1250676 80 56553138
Zepto 483672 7547 50655465
PHP 266668 443 26476433
Twitter Bootstrap 255045 4567 11633390
Google Font API 211921 8080 8631875
WordPress 139645 1900 4540344
Font Awesome 133483 49152 3028740
@achillean
achillean / dlink-products.csv
Created June 30, 2016 20:35
Ranking of D-Link Products Sold (source: https://www.shodan.io)
#!/usr/bin/python
import string
import mechanize
import socket
import Queue
import threading
import time
import sys
@ethackal
ethackal / shodan-mp.py
Created February 9, 2017 05:25
Monkey patch wrapper around official shodan-python CLI to support a proxy
#!/usr/local/opt/python/bin/python2.7
import imp
import os
import shodan
import shodan.cli.helpers
def mp_init(self, key):
self._original___init__(key)
self.base_url=os.environ.get('SHODAN_API_PROXY', 'https://api.shodan.io')
self.base_exploits_url=os.environ.get('SHODAN_EXPLOITS_API_PROXY', 'https://exploits.shodan.io')