1

I've done the leg work and I've struggled to identify how to search with the Shodan CLI, or the web search, just for a specific port and output all the IP addresses that expose this port.

For example in the cli:

shodan search [port]

I can't figure that out.

Also in the search bar on the site:

[shodan] port:[port] 

This does not work as expected, possibly because pulling false resolvers and I'm looking for a weird port.

  • perhaps you could provide an example of what you think is the wrong output (i.e. your claim that it "does not work as expected")? – korrigan Mar 22 '18 at 5:24
  • @korrigan shodan.io/search?query=port%3A55555 Take a look at that search. All of the responses are lacking a 55555 port. So I'm doing something wrong. – bashCypher Mar 22 '18 at 14:50
  • 1
    I meant, as part of an edit to your question. Note that your link doesn't work for guest users (not logged in), so consider a form that everyone can see. – korrigan Mar 22 '18 at 17:10
  • @korrigan that's great advice. I tried to do so and was greeted with an "must be logged in to use search filters" error, so looks like it will have to be only for those with accounts. Thank you though. Good advice. – bashCypher Mar 23 '18 at 1:02
2

Founder of Shodan here: we crawl a few thousand ports but as you noticed 55555 isn't on that list. The search syntax for what you're trying to do is:

port:55555

Which means in the CLI you would enter:

shodan search port:55555

Or to get a count of how many are open:

shodan count port:55555

For more information about the search syntax please visit:

https://help.shodan.io/the-basics/search-query-fundamentals

If you search for simply "55555" then you are searching for banners where the main data property contains the string "55555". To search in the contents of other properties (ex: port) you need to use a search filter. A list of them is available on the developer website. Check out the /shodan/host/search method:

https://developer.shodan.io/api

  • Thank you! I appreciate the clarification. I also appreciate all your hard working bringing visibility to this issue. – bashCypher Mar 26 '18 at 15:38
1

Note: I am assuming here that you have set up the CLI with a working API key, and that you are logged into the website with a valid username/password. The CLI tool should throw an error telling you that you need to run shodan init <api key>.

Shodan Web:

When searching in Shodan I find that more often than not, it is safer to put quotes around the search term. In your case, I found that searching on the shodan.io website for port:"55555" yielded 862 results. The same search without quotes also worked, yielding the same number of results.

Shodan CLI

I'm not very experienced with the CLI, but I found that doing any of the following yielded the same number of results (862):

shodan count port:55555
shodan count port:"55555"
shodan count 'port:55555'
shodan count 'port:"55555"'

But your terms (shodan count 55555) yielded a different, much larger result, presumably because it was searching for "55555" everywhere, rather than just the port.

  • thank you for the help! Yep, I found the same results, most of which don't have the port 55555. I figured out that Shodan doesn't index every port, just some common ones. Thank you again! – bashCypher Mar 23 '18 at 1:18
0

Ok, so I think I have an answer. After scraping around help documentation it appears that Shodan is focused on certain services. It does not appear to do a full port scan of every IP regularly, only specific common ones like telnet, ftp, http, and etc.

It does capture more than just those ports through other mechanisms, but it is not a full internet every IP address with every port database. I found this information on a Defcon power point, but it is also alluded to in the wiki which is more trustworthy:

https://en.wikipedia.org/wiki/Shodan_(website)

"Shodan collects data mostly on web servers (HTTP/HTTPS - port 80, 8080, 443, 8443), as well as FTP (port 21), SSH (port 22), Telnet (port 23), SNMP (port 161), IMAP (port 993), SIP (port 5060),[2] and Real Time Streaming Protocol (RTSP, port 554). The latter can be used to access webcams and their video stream.[3]"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.