Task - search_shodan (by domain)

[jcran]

Task - search_shodan (by domain)

[g4mma4]

The API doesn't support this directly

curl 'https://api.shodan.io/shodan/host/yahoo.com?key=EU0zYQ0ZXU_REDACT_xzJ27' 
{"error": "Invalid IP"}

And if we wanted to be thorough and accept globs e.g. *.exxample.com we'd need access to their /dns/domain/{domain} endpoint; however, it requires credits. These are valuable resources and it would be naive to assume the users has or even wants to use their credits:

 curl 'https://api.shodan.io/dns/domain/example.com?key=EU0zYQ0ZXU_REDACT_xzJ27'
{                                                                               
  "error": "Insufficient query credits, please upgrade your API plan or wait for the monthly limit to reset"
}   

There is a endpoint for resolving names /dns/resolve:

% curl -s 'https://api.shodan.io/dns/resolve?hostnames=example.com,foo.com&key=EU0' | jq -r '.[]'
93.184.216.34
23.23.86.44

Where should DNS resolving happen? Using shodan do make results more consistent; however, is there a use case where this is run behind a filewall and local dns resolution is preferred?

[jcran]

I suspect regular ‘ol search can work here. Goal is to be able to provide a domain (intrigue.io) for instance - and get back all the hosts that match in some field.

[jcran]

From a contact it's really easy just to shodan domain <tld> and then grep ^[a-z] for each hostname, awk -F: '{print $2 "." $1}' and then shodan stats --facets vuln hostname:$i with final as grep -l cve * but strangely that didn't come up with much surprisingly. I feel by ASN the facets does more. In summary: shodan is mostly an IPv4 tool
`