WEBVTT 00:00:00.940 --> 00:00:04.750 In this demo, we'll look at using the Shodan command line interface. 00:00:05.140 --> 00:00:07.450 We'll start with the help information from Shodan 00:00:07.940 --> 00:00:09.460 and the command line tool itself. 00:00:10.440 --> 00:00:12.860 Before we can begin using the CLI tool, 00:00:13.340 --> 00:00:16.250 we need to grab our API key from our registered account. 00:00:17.140 --> 00:00:21.740 Then we'll walk through a few commands such as init to set up the tool, 00:00:21.740 --> 00:00:28.530 count, host, and search. Again, this demo will be on the current Kali 00:00:28.530 --> 00:00:32.530 Linux, so we can skip the installation step and start using the command 00:00:32.530 --> 00:00:38.460 line quickly. From the Shodan website, there is a link to the command 00:00:38.460 --> 00:00:39.660 line tool information. 00:00:40.540 --> 00:00:46.840 It's cli.shodan.io for quick reference. Here, you'll find 00:00:46.840 --> 00:00:49.630 information on the installation of the tool if you're not using 00:00:49.630 --> 00:00:53.150 Kali Linux and a link to get your API key. 00:00:54.040 --> 00:00:55.330 Further down the page, 00:00:55.340 --> 00:00:59.120 you'll see a listing of some of the commands available, documentation, and 00:00:59.120 --> 00:01:04.819 some examples for using them. To use the Shodan command line tool, you'll 00:01:04.819 --> 00:01:07.160 need a registered account and an API key. 00:01:08.140 --> 00:01:10.860 First, we select the API Key text and copy it. 00:01:12.340 --> 00:01:19.550 Then we'll flip over to a terminal to configure Shodan. Shodan ‑h will 00:01:19.550 --> 00:01:27.240 display the help text. To configure Shodan, we'll give it our API key. Now we 00:01:27.240 --> 00:01:29.560 have access to use Shodan through the command line. 00:01:29.940 --> 00:01:35.690 Let's start with some simple counting. Count postfix will show us the 00:01:35.690 --> 00:01:39.150 number of postfix email servers that Shodan has found. 00:01:39.540 --> 00:01:42.900 Remember, these are based on banner text searches. 00:01:44.940 --> 00:01:48.250 If we want to know how many Cisco IOS systems have been found, 00:01:48.250 --> 00:01:50.760 we can ask Shodan to count those as well. 00:01:52.840 --> 00:01:56.950 The Shodan command line will also return information for a specific host. 00:01:58.940 --> 00:02:03.320 This host has a few open ports with one being identified as a specific 00:02:03.320 --> 00:02:08.960 product and version. This host has even more network ports open. 00:02:09.940 --> 00:02:12.060 Notice the level of details provided here. 00:02:14.040 --> 00:02:16.950 Shodan will also let you search from the command line. 00:02:19.040 --> 00:02:23.280 This simple search returns systems running the XML server, which is 00:02:23.280 --> 00:02:25.960 currently in the news with a large number of vulnerabilities. 00:02:26.340 --> 00:02:31.050 There's one line per result with up to 1,000 results returned by default. 00:02:31.940 --> 00:02:34.160 You can see the help information here for search. 00:02:35.640 --> 00:02:40.100 Notice that you can display specific fields shown and change the limits. 00:02:42.140 --> 00:02:47.770 Here is the same exim search with specific fields and just 10 results. 00:02:47.770 --> 00:02:52.250 Shodan can bundle search results into a JSON file, 00:02:52.640 --> 00:02:59.060 which you can analyze later, convert to CSV or use for scripting. These 00:02:59.060 --> 00:03:02.360 commands should get you started using Shodan on the command line. 00:03:04.440 --> 00:03:06.930 Next, we'll look at basic searching on the Shodan 00:03:06.930 --> 00:03:09.060 website and the search results.