Count hosts
Action ID:tools.shodan.count_hosts
Count Shodan host search matches. Calls GET /shodan/host/count directly.
Reference: https://developer.shodan.io/api#shodan-host-count
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Shodan search query. The provided string is used to search the database of banners in Shodan, with the additional option to provide filters inside the search query using a “filter:value” format. For example, the following search query would find Apache Web servers located in Germany: “apache country:DE”.
string | null
Shodan REST API base URL.Default:
null.string | null
A comma-separated list of properties to get summary information on. Property names can also be in the format of “property:count”, where “count” is the number of facets that will be returned for a property (i.e. “country:100” to get the top 100 countries for a search query).Default:
null.Lookup host
Action ID:tools.shodan.lookup_host
Look up Shodan host information. Calls GET /shodan/host/{ip} directly.
Reference: https://developer.shodan.io/api#shodan-host-details
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Host IP address.
string | null
Shodan REST API base URL.Default:
null.boolean | null
True if all historical banners should be returned (default: False)Default:
null.boolean | null
True to only return the list of ports and the general host information, no banners. (default: False)Default:
null.Resolve DNS
Action ID:tools.shodan.resolve_dns
Resolve hostnames to IP addresses. Calls GET /dns/resolve directly.
Reference: https://developer.shodan.io/api#dns-resolve
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Comma-separated list of hostnames; example “google.com,bing.com”
string | null
Shodan REST API base URL.Default:
null.Reverse DNS
Action ID:tools.shodan.reverse_dns
Look up hostnames for IP addresses. Calls GET /dns/reverse directly.
Reference: https://developer.shodan.io/api#dns-reverse
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Comma-separated list of IP addresses; example “74.125.227.230,204.79.197.200”
string | null
Shodan REST API base URL.Default:
null.Search exploits
Action ID:tools.shodan.search_exploits
Search Shodan Exploits. Calls GET /api/search directly.
Reference: https://developer.shodan.io/api/exploits/rest#shodan-exploits-search
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Search query used to search the database of known exploits. Possible search filters are: author, bid, code, cve, date, description, msb, osvdb, platform, port, title and type.
string | null
Shodan Exploits REST API base URL.Default:
null.string | null
A comma-separated list of properties to get summary information on. The following facets are currently supported: author, platform, port, source and type.Default:
null.integer | null
The page number to page through results 100 at a time.Default:
null.Search hosts
Action ID:tools.shodan.search_hosts
Search Shodan host banners. Calls GET /shodan/host/search directly.
Reference: https://developer.shodan.io/api#shodan-host-search
Secrets
Required secrets:shodan: required valuesSHODAN_API_KEY.
Input fields
string
required
Shodan search query. The provided string is used to search the database of banners in Shodan, with the additional option to provide filters inside the search query using a “filter:value” format. For example, the following search query would find Apache Web servers located in Germany: “apache country:DE”.
string | null
Shodan REST API base URL.Default:
null.string | null
A comma-separated list of properties to get summary information on. Property names can also be in the format of “property:count”, where “count” is the number of facets that will be returned for a property (i.e. “country:100” to get the top 100 countries for a search query).Default:
null.string | null
Comma-separated list of fields to return in the search results. Example: tags,http.title,http.favicon.hashDefault:
null.boolean | null
True or False; whether or not to truncate some of the larger fields (default: True)Default:
null.integer | null
The page number to page through results 100 at a time (default: 1)Default:
null.