Table: shodan_search - Query Shodan Search Results using SQL

Shodan is a search engine for internet-connected devices. It provides a way to discover devices, where they are located and who is using them. Shodan is used for various purposes including cybersecurity research, software development, and educational research.

Table Usage Guide

The shodan_search table provides insights into internet-connected devices as indexed by Shodan. As a cybersecurity analyst, explore device-specific details through this table, including IP addresses, hostnames, and potential vulnerabilities. Utilize it to uncover information about devices, such as their geographic location, the software they are running, and their exposure to potential cyber threats.

Important Notes

• You must specify the query in the where clause to query this table.

Examples

List all services for a network range

Explore all the services associated with a specific network range. This is useful for gaining insights into the various operations within a particular network segment, helping to better manage and secure your network infrastructure.

select
  *
from
  shodan_search
where
  query = 'net:34.98.0.0/26';

Error: SQLite does not support CIDR operations.

Find all Windows XP hosts

Determine the areas in which Windows XP is still being used to understand potential security vulnerabilities and outdated systems in your network.

select
  *
from
  shodan_search
where
  query = 'os:"windows xp"';

select
  *
from
  shodan_search
where
  query = 'os:"windows xp"';

Find all services for the GitHub organization

Discover all the services associated with a particular organization, in this case, GitHub. This is useful for gaining insights into the various services that an organization utilizes or is associated with.

select
  *
from
  shodan_search
where
  query = 'org:"GitHub"';

select
  *
from
  shodan_search
where
  query = 'org:"GitHub"';

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- shodan

You can pass the configuration to the command with the --config argument:

steampipe_export_shodan --config '<your_config>' shodan_search