Ultimate Shodan Cheat Sheet

Samir KC
September 08, 2026


Ultimate Shodan Cheat Sheet

The search engine for the Internet of Things. Find exposed devices, services, and vulnerabilities worldwide.

1. CLI Setup

Install and configure the Shodan command-line interface.

Install Shodan CLI

pip install shodan

Initialize with API Key

shodan init YOUR_API_KEY

Check Account Info

shodan info

Show Help

shodan -h

Show Version

shodan version

CLI Commands

  • shodan search : Search query
  • shodan host : Host lookup
  • shodan count : Result count
  • shodan download : Save results
  • shodan stream : Real-time stream

Account Commands

  • shodan info : Account info
  • shodan key : Show API key
  • shodan stats : Query stats
  • shodan alerts : Manage alerts

3. Facets & Stats

Count Results

shodan count "apache"

Top Countries

shodan stats --facets country "apache"

Top Ports

shodan stats --facets port "apache"

Top Organizations

shodan stats --facets org "apache"

Top Products

shodan stats --facets product "apache"

Multiple Facets

shodan stats --facets country,port,org "apache"

Available Facets

  • country : Country distribution
  • port : Port distribution
  • org : Organization distribution
  • product : Product distribution
  • version : Version distribution

Stats Commands

  • shodan stats : Get stats
  • --facets : Add facets
  • --limit : Limit results
  • shodan count : Count only

4. API Usage

Search API

curl "https://api.shodan.io/shodan/host/search?key=YOUR_KEY&query=apache"

Host Lookup

curl "https://api.shodan.io/shodan/host/8.8.8.8?key=YOUR_KEY"

Account Info

curl "https://api.shodan.io/api-info?key=YOUR_KEY"

DNS Lookup

curl "https://api.shodan.io/dns/resolve?hostnames=google.com,facebook.com&key=YOUR_KEY"

Reverse DNS

curl "https://api.shodan.io/dns/reverse?ips=8.8.8.8,1.1.1.1&key=YOUR_KEY"

Exploit Search

curl "https://exploits.shodan.io/api/search?query=apache&key=YOUR_KEY"
EndpointDescriptionMethod
/shodan/host/searchSearch hostsGET
/shodan/host/{ip}Host lookupGET
/shodan/host/countCount resultsGET
/shodan/portsList portsGET
/dns/resolveDNS resolveGET
/dns/reverseReverse DNSGET
/api-infoAccount infoGET

5. Python Library

Install Shodan Python

pip install shodan

Basic Search

#!/usr/bin/env python3 import shodan api = shodan.Shodan('YOUR_API_KEY') # Search for Apache servers results = api.search('apache') print(f"Total results: {results['total']}") for result in results['matches']: print(f"IP: {result['ip_str']}") print(f"Port: {result['port']}") print(f"Org: {result.get('org', 'N/A')}") print("---")

Host Lookup

#!/usr/bin/env python3 import shodan api = shodan.Shodan('YOUR_API_KEY') # Lookup specific host host = api.host('8.8.8.8') print(f"IP: {host['ip_str']}") print(f"Organization: {host.get('org', 'N/A')}") print(f"OS: {host.get('os', 'N/A')}") for service in host['data']: print(f"Port: {service['port']}") print(f"Banner: {service.get('data', 'N/A')}") print("---")

Vulnerability Search

#!/usr/bin/env python3 import shodan api = shodan.Shodan('YOUR_API_KEY') # Search for vulnerable hosts results = api.search('vuln:CVE-2021-44228') print(f"Vulnerable hosts: {results['total']}") for result in results['matches']: print(f"IP: {result['ip_str']}") print(f"Port: {result['port']}") print(f"Product: {result.get('product', 'N/A')}") print("---")

Network Monitoring

#!/usr/bin/env python3 import shodan api = shodan.Shodan('YOUR_API_KEY') # Monitor network range results = api.search('net:192.168.0.0/16') print(f"Devices in range: {results['total']}") for result in results['matches']: print(f"IP: {result['ip_str']}") print(f"Port: {result['port']}") print(f"Product: {result.get('product', 'N/A')}") print("---")
Pro Tip: Error Handling
Always handle API errors gracefully:
try:
  results = api.search('apache')
except shodan.APIError as e:
  print(f"Error: {e}")

6. Automation Scripts

Mass Host Lookup

#!/bin/bash # mass-lookup.sh - Look up multiple IPs while read -r ip; do echo "[+] Looking up $ip..." shodan host "$ip" echo "---" done < ips.txt

Search and Download

#!/bin/bash # search-download.sh - Search and save results QUERY=$1 OUTPUT="shodan-results.json" echo "[+] Searching for: $QUERY" shodan search --fields ip,port,org,product "$QUERY" > "$OUTPUT" echo "[+] Results saved to $OUTPUT" wc -l "$OUTPUT"

Vulnerability Scanner

#!/usr/bin/env python3 # vuln-scan.py - Find vulnerable devices import shodan import sys api = shodan.Shodan('YOUR_API_KEY') vulns = ['CVE-2021-44228', 'CVE-2021-26855', 'CVE-2020-0688'] for vuln in vulns: try: results = api.search(f'vuln:{vuln}') print(f"[+] {vuln}: {results['total']} results") for result in results['matches']: print(f" - {result['ip_str']}:{result['port']} ({result.get('product', 'N/A')})") except shodan.APIError as e: print(f"Error: {e}")

Continuous Monitoring

#!/bin/bash # monitor.sh - Monitor network for new devices NETWORK="192.168.0.0/16" PREVIOUS="previous.txt" CURRENT="current.txt" while true; do shodan search "net:$NETWORK" --fields ip,port,product > "$CURRENT" if [ -f "$PREVIOUS" ]; then diff "$PREVIOUS" "$CURRENT" | grep "^>" | sed 's/^> //' fi mv "$CURRENT" "$PREVIOUS" sleep 3600 done

Alert Setup

# Create alert for specific query shodan alert create "Apache Servers" "product:apache country:US" # List alerts shodan alert list # Check alert results shodan alert info <alert-id>
Pro Tip: API Rate Limits

Free tier: 100 search credits/month
Paid tier: Unlimited searches
Use shodan info to check remaining credits
Cache results to avoid hitting rate limits

⇧