Shodan

Shodan is a specialized search engine and security intelligence platform for discovering and analyzing internet-connected devices, systems, and services across the global internet. Unlike traditional search engines that index web content, Shodan continuously scans and catalogs devices, servers, routers, cameras, industrial control systems, and other internet-facing infrastructure, providing comprehensive visibility into the internet's attack surface.

Category	Threat intelligence
Direction	Query source
Sign-in	Shodan API Key
Query languages	SQLite
Tables	12
Query templates	27
Website	shodan.io

Before you start

Huntbase signs in to Shodan with Shodan API Key. Create the credential in Shodan first, then keep it to hand for the Connect step.

1. Create a free Shodan account, or sign in to your existing one.
2. Copy your API key from your account page at https://account.shodan.io.

For the vendor's own instructions, see Shodan API key requirements.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Shodan

1. Go to Connections and click New connection, or click New connection on the Shodan product page.
2. On Product, pick Shodan and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials

The only Method is Shodan API Key. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
Shodan API Key	Yes	Secret — not shown again after you save it.

Query it

Once connected, Shodan can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 12 tables listed below, alongside every other connected source.

Example: SQLite

List the scans — Uncover the details of all the completed network scans to analyze potential vulnerabilities or security threats.

select
  *
from
  shodan_scan;

Shodan ships with 27 query templates. Find them in Library › Queries — see Query templates.

Tables

Shodan adds 12 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 12 tables

Table	Contains
shodan_account_profile	Information about the Shodan account linked to the caller.
shodan_api_info	Information about the API plan belonging to the given API key.
shodan_dns_reverse	Hostnames defined for the given IP.
shodan_domain	Get all the subdomains and other DNS entries for the given domain.
shodan_exploit	List the exploits requested for this account.
shodan_host	All services that have been found on the given host at IP.
shodan_host_service	All services that have been found on the given host.
shodan_port	Ports returns a list of port numbers that the crawlers are looking for.
shodan_protocol	List of the protocols that can be used when launching an Internet scan.
shodan_scan	List the scans requested for this account.
shodan_search	Search the internet for hosts matching the query parameters.
shodan_service	List of the services Shodan can detect.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog