#!/usr/bin/env ruby
#
# Shodan API Search Assistant
# By: Hood3dRob1n
#
########### ENTER API KEY HERE ###########
APIKEY='YOURAPIKEYNEEDS2GORIGHTINHEREYO!' #
###########################################
##### STD GEMS #######
require 'fileutils' #
require 'optparse' #
require 'resolv' #
#### NON-STD GEMS ####
require 'rubygems' #
require 'colorize' #
require 'curb' #
require 'json' #
require 'nokogiri' #
######################
HOME=File.expand_path(File.dirname(__FILE__))
RESULTS = HOME + '/results/'
# Banner
def banner
puts
puts "Shodan API Search Assistant".light_green
puts "By".light_green + ": Hood3dRob1n".white
end
# Clear Terminal
def cls
if RUBY_PLATFORM =~ /win32|win64|\.NET|windows|cygwin|mingw32/i
system('cls')
else
system('clear')
end
end
# Custom ShodanAPI Class :)
# The pre-built option is broken and doesn't work in several places....
# So we re-wrote it!
class ShodanAPI
# Initialize ShodanAPI via passed API Key
def initialize(apikey)
@url="http://www.shodanhq.com/api/"
if shodan_connect(apikey)
@key=apikey
end
end
# Check API Key against API Info Query
# Return True on success, False on Error or Failure
def shodan_connect(apikey)
url = @url + "info?key=#{apikey}"
begin
c = Curl::Easy.perform(url)
if c.body_str =~ /"unlocked_left": \d+, "telnet": .+, "plan": ".+", "https": .+, "unlocked": .+/i
results = JSON.parse(c.body_str)
@plan = results['plan']
@unlocked = results['unlocked']
@unlocks = results['unlocked_left']
@https = results['https']
@telnet = results['telnet']
return true
elsif c.body_str =~ /"error": "API access denied"/i
puts "Access Denied using API Key '#{apikey}'".light_red + "!".white
puts "Check Key & Try Again".light_red + "....".white
return false
else
puts "Unknown Problem with Connection to Shodan API".light_green + "!".white
return false
end
rescue => e
puts "Problem with Connection to Shodan API".light_red + "!".white
puts "\t=> #{e}"
return false
end
end
# Just checks our key is working (re-using shodan_connect so updates @unlocks)
# Returns True or False
def connected?
if shodan_connect(@key)
return true
else
return false
end
end
# Return the number of unlocks remaining
def unlocks
if shodan_connect(@key)
return @unlocks.to_i
else
return nil
end
end
# Check if HTTPS is Enabled
def https?
if shodan_connect(@key)
if @https
return true
else
return false
end
else
return false
end
end
# Check if Telnet is Enabled
def telnet?
if shodan_connect(@key)
if @telnet
return true
else
return false
end
else
return false
end
end
# Actually display Basic Info for current API Key
def info
url = @url + 'info?key=' + @key
begin
c = Curl::Easy.perform(url)
results = JSON.parse(c.body_str)
puts
puts "Shodan API Key Confirmed".light_green + "!".white
puts "API Key".light_green + ": #{@key}".white
puts "Plan Type".light_green + ": #{results['plan']}".white
puts "Unlocked".light_green + ": #{results['unlocked']}".white
puts "Unlocks Remaining".light_green + ": #{results['unlocked_left']}".white
puts "HTTPS Enabled".light_green + ": #{results['https']}".white
puts "Telnet Enabled".light_green + ": #{results['telnet']}".white
return true
rescue => e
puts "Problem with Connection to Shodan API".light_red + "!".white
puts "\t=> #{e}".white
return false
end
end
# Lookup all available information for a specific IP address
# Returns results hash or nil
def host(ip)
url = @url + 'host?ip=' + ip + '&key=' + @key
begin
c = Curl::Easy.perform(url)
results = JSON.parse(c.body_str)
return results
rescue => e
puts "Problem running Host Search".light_red + "!".white
puts "\t=> #{e}".white
return nil
end
end
# Returns the number of devices that a search query found
# Unrestricted usage of all advanced filters
# Return results count or nil on failure
def count(string)
url = @url + 'count?q=' + string + '&key=' + @key
begin
c = Curl::Easy.perform(url)
results = JSON.parse(c.body_str)
return results['total']
rescue => e
puts "Problem grabbing results count".light_red + "!".white
puts "\t=> #{e}".white
return nil
end
end
# Search Shodan for devices using a search query
# Returns results hash or nil
def search(string, filters={})
prem_filters = [ 'city', 'country', 'geo', 'net', 'before', 'after', 'org', 'isp', 'title', 'html' ]
cheap_filters = [ 'hostname', 'os', 'port' ]
url = @url + 'search?q=' + string
if not filters.empty?
filters.each do |k, v|
if cheap_filters.include?(k)
url += ' ' + k + ":\"#{v}\""
end
if prem_filters.include?(k)
if @unlocks.to_i > 1
url += ' ' + k + ":\"#{v}\""
@unlocks = @unlocks.to_i - 1 # Remove an unlock for use of filter
else
puts "Not Enough Unlocks Left to run Premium Filter Search".light_red + "!".white
puts "Try removing '#{k}' filter and trying again".light_red + "....".white
return nil
end
end
end
end
url += '&key=' + @key
begin
c = Curl::Easy.perform(url)
results = JSON.parse(c.body_str)
return results
rescue => e
puts "Problem running Shodan Search".light_red + "!".white
puts "\t=> #{e}".white
return nil
end
end
# Quick Search Shodan for devices using a search query
# Results are limited to only the IP addresses
# Returns results array or nil
def quick_search(string, filters={})
prem_filters = [ 'city', 'country', 'geo', 'net', 'before', 'after', 'org', 'isp', 'title', 'html' ]
cheap_filters = [ 'hostname', 'os', 'port' ]
url = @url + 'search?q=' + string
if not filters.empty?
filters.each do |k, v|
if cheap_filters.include?(k)
url += ' ' + k + ":\"#{v}\""
end
if prem_filters.include?(k)
if @unlocks.to_i > 1
url += ' ' + k + ":\"#{v}\""
@unlocks = @unlocks.to_i - 1
else
puts "Not Enough Unlocks Left to run Premium Filter Search".light_red + "!".white
puts "Try removing '#{k}' filter and trying again".light_red + "....".white
return nil
end
end
end
end
url += '&key=' + @key
begin
ips=[]
c = Curl::Easy.perform(url)
results = JSON.parse(c.body_str)
results['matches'].each do |host|
ips << host['ip']
end
return ips
rescue => e
puts "Problem running Shodan Quick Search".light_red + "!".white
puts "\t=> #{e}".white
return nil
end
end
# Perform Shodan Exploit Search as done on Web
# Provide Search String and source
# Source can be: metasploit, exploitdb, or cve
# Returns results hash array on success: { downloadID => { link => description } }
# Returns nil on failure
def sploit_search(string, source)
sources = [ "metasploit", "exploitdb", "cve" ]
if sources.include?(source.downcase)
sploits = 'https://exploits.shodan.io/?q=' + string + ' source:"' + source.downcase + '"'
begin
results={}
c = Curl::Easy.perform(sploits)
page = Nokogiri::HTML(c.body_str) # Parsable doc object now
# Enumerate target section, parse out link & description
page.css('div[class="search-result well"]').each do |linematch|
if linematch.to_s =~ /<div class="search-result well">\s+<a href="(.+)"\s/
link=$1
end
if linematch.to_s =~ /class="title">(.+)\s+<\/a>/
desc=$1.gsub('<em>', '').gsub('</em>', '')
end
case source.downcase
when 'cve'
dl_id = 'N/A for CVE Search'
when 'exploitdb'
dl_id = link.split('/')[-1] unless link.nil?
when 'metasploit'
dl_id = link.sub('http://www.metasploit.com/', '').sub(/\/$/, '') unless link.nil?
end
results.store(dl_id, { link => desc}) unless (link.nil? or link == '') or (desc.nil? or desc == '') or (dl_id.nil? or dl_id == 'N/A for CVE Search')
end
return results
rescue Curl::Err::ConnectionFailedError => e
puts "Shitty connection yo".light_red + ".....".white
return nil
rescue => e
puts "Unknown connection problem".light_red + ".....".white
puts "\t=> #{e}".white
return nil
end
else
puts "Invalid Search Source Requested".light_red + "!".white
return nil
end
end
# Download Exploit Code from Exploit-DB or MSF Github Page
# By passing in the Download ID (which can be seen in sploit_search() results)
# Return { 'Download' => dl_link, 'Viewing' => v_link, 'Exploit' => c.body_str }
# or nil on failure
def sploit_download(id, source)
sources = [ "metasploit", "exploitdb" ]
if sources.include?(source.downcase)
case source.downcase
when 'exploitdb'
dl_link = "http://www.exploit-db.com/download/#{id}/"
v_link = "http://www.exploit-db.com/exploits/#{id}/"
when 'metasploit'
dl_link = "https://raw.github.com/rapid7/metasploit-framework/master/#{id.sub('/exploit/', '/exploits/')}.rb"
v_link = "http://www.rapid7.com/db/#{id}/"
end
begin
c = Curl::Easy.perform(dl_link)
page = Nokogiri::HTML(c.body_str) # Parsable doc object now
results = { 'Download' => dl_link, 'Viewing' => v_link, 'Exploit' => c.body_str }
return results
rescue Curl::Err::ConnectionFailedError => e
puts "Shitty connection yo".light_red + ".....".white
return false
rescue => e
puts "Unknown connection problem".light_red + ".....".white
puts "#{e}".light_red
return false
end
else
puts "Invalid Download Source Requested".light_red + "!".white
return false
end
end
end
### MAIN ###
options = {}
optparse = OptionParser.new do |opts|
opts.banner = "Usage:".light_green + "#{$0} ".white + "[".light_green + "OPTIONS".white + "]".light_green
opts.separator ""
opts.separator "EX:".light_green + " #{$0} -s cisco-ios".white
opts.separator "EX:".light_green + " #{$0} -h 217.140.75.46".white
opts.separator "EX:".light_green + " #{$0} --quick-search IIS/5.1".white
opts.separator "EX:".light_green + " #{$0} -S exploitdb -x udev".white
opts.separator "EX:".light_green + " #{$0} -d 8678 -S exploitdb".white
opts.separator "EX:".light_green + " #{$0} --source metasploit --exploit-search udev".white
opts.separator "EX:".light_green + " #{$0} -S metasploit -d modules/exploit/linux/local/udev_netlink".white
opts.separator ""
opts.separator "Options: ".light_green
opts.on('-q', '--quick-search STRING', "\n\tShodan Quick Search".white) do |search_str|
options[:method] = 3 # 1=> Normal, 2=> IP, 3=> Quick, 4=>Exploit Search, 5=>Exploit Download
options[:search] = search_str.chomp
end
opts.on('-s', '--shodan-search STRING', "\n\tShodan Search".white) do |search_str|
options[:method] = 1 # 1=> Normal, 2=> IP, 3=> Quick, 4=>Exploit Search, 5=>Exploit Download
options[:search] = search_str.chomp
end
opts.on('-h', '--host-search HOST', "\n\tShodan Host Search against IP".white) do |search_str|
options[:method] = 2 # 1=> Normal, 2=> IP, 3=> Quick, 4=>Exploit Search, 5=>Exploit Download
if search_str.chomp =~ /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/
options[:search] = search_str.chomp
else
begin
ip = Resolv.getaddress(search_str.chomp) # Resolve Host Domain to IP
options[:search] = ip
rescue Resolv::ResolvError => e
cls
banner
puts
puts "Unable to Resolve Host to IP".light_red + "!".white
puts
puts opts
puts
exit 69;
end
end
end
opts.on('-S', '--source SOURCE', "\n\tSet Exploit Source: exploitdb or metasploit".white) do |source|
sources=["metasploit", "exploitdb"]
if sources.include?(source.downcase.chomp)
options[:source] = source.downcase.chomp
else
cls
banner
puts
puts "Invalid Search Source Requested".light_red + "!".white
puts "\t=> #{source}".light_red
puts
puts opts
puts
exit 69;
end
end
opts.on('-x', '--exploit-search STRING', "\n\tShodan Exploit Search for String (requires -S)".white) do |search_str|
options[:method] = 4 # 1=> Normal, 2=> IP, 3=> Quick, 4=>Exploit Search, 5=>Exploit Download
options[:search] = search_str.chomp
end
opts.on('-d', '--download-id ID', "\n\tDownload Exploit by Exploit ID (requires -S)".white) do |search_str|
options[:method] = 5 # 1=> Normal, 2=> IP, 3=> Quick, 4=>Exploit-DB Search, 5=>Exploit-DB Download
options[:search] = search_str.chomp
end
opts.on('-H', '--help', "\n\tHelp Menu".white) do
cls
banner
puts
puts opts
puts
exit 69;
end
end
begin
foo = ARGV[0] || ARGV[0] = "-H"
optparse.parse!
mandatory = [:method,:search]
missing = mandatory.select{ |param| options[param].nil? }
if not missing.empty?
cls
banner
puts
puts "Missing options: ".red + " #{missing.join(', ')}".white
puts optparse
exit 666;
end
rescue OptionParser::InvalidOption, OptionParser::MissingArgument, OptionParser::AmbiguousOption
cls
banner
puts
puts $!.to_s.red
puts
puts optparse
puts
exit 666;
end
banner
shodan = ShodanAPI.new(APIKEY)
if shodan.connected?
# Display Basic API Key Info
shodan.info
puts
# Create Results Dir if it doesnt exist
Dir.mkdir(RESULTS) unless File.exists?(RESULTS) and File.directory?(RESULTS)
# Now run as requested....
case options[:method].to_i
when 1
results = shodan.search(options[:search].to_s)
if not results.nil?
puts "Shodan Search".light_green + ": #{options[:search].to_s}".white
f=File.open(RESULTS + "shodan_search_results.txt", 'w+')
f.puts "Shodan Search: #{options[:search].to_s}"
puts "Total Results Found".light_green + ": #{results['total']}".white
f.puts "Total Results Found: #{results['total']}"
results['countries'].each do |country|
puts " #{country['name']}".light_green + ": #{country['count']}".white
f.puts " #{country['name']}: #{country['count']}"
end
puts
f.puts
results['matches'].each do |host|
puts "Host IP".light_green + ": #{host['ip']}".white
f.puts "Host IP: #{host['ip']}"
puts "#{host['data']}".white
f.puts host['data']
end
f.puts
f.close
else
puts "No Results Found for ".light_red + "#{string}".white + " via Shodan Search".light_red + "!".white
end
puts
when 2
# Check Host Results
results = shodan.host(options[:search].to_s)
if not results.nil?
f=File.open(RESULTS + "shodan_host_search_results.txt", 'w+')
puts "Host IP".light_green + ": #{results['ip']}".white unless results['ip'].nil?
f.puts "Host IP: #{results['ip']}" unless results['ip'].nil?
puts "ISP".light_green + ": #{results['data'][0]['isp']}".white unless results['data'][0]['isp'].nil?
f.puts "ISP: #{results['data'][0]['isp']}" unless results['data'][0]['isp'].nil?
puts "Hostname(s)".light_green + ": #{results['hostnames'].join(',')}".white unless results['hostnames'].empty?
f.puts "Hostname(s): #{results['hostnames'].join(',')}" unless results['hostnames'].empty?
puts "Host OS".light_green + ": #{results['os']}".white unless results['os'].nil?
f.puts "Host OS: #{results['os']}" unless results['os'].nil?
puts "Country".light_green + ": #{results['country_name']}".white unless results['country_name'].nil?
f.puts "Country: #{results['country_name']}" unless results['country_name'].nil?
puts "City".light_green + ": #{results['city']}".white unless results['city'].nil?
f.puts "City: #{results['city']}" unless results['city'].nil?
puts "Longitude".light_green + ": #{results['longitude']}".white unless results['longitude'].nil? or results['longitude'].nil?
f.puts "Longitude: #{results['longitude']}" unless results['longitude'].nil? or results['longitude'].nil?
puts "Latitude".light_green + ": #{results['latitude']}".white unless results['longitude'].nil? or results['longitude'].nil?
f.puts "Latitude: #{results['latitude']}" unless results['longitude'].nil? or results['longitude'].nil?
f.puts
puts
# We need to split and re-pair up the ports & banners as ports comes after banners in results iteration
ban=nil
port_banners={}
results['data'][0].each do |k, v|
if k == 'port'
port=v
if not ban.nil?
port_banners.store(port, ban) # store them in hash so we pair them up properly
ban=nil
end
elsif k == 'banner'
ban=v
end
end
# Now we can display them in proper pairs
port_banners.each do |port, ban|
puts "Port".light_green + ": #{port}".white
f.puts "Port: #{port}"
puts "Banner".light_green + ": \n#{ban}".white
f.puts "Banner: \n#{ban}"
end
f.puts
f.close
else
puts "No results found for host".light_red + "!".white
end
puts
when 3
# Perform Quick Shodan Search
string = options[:search].to_s
ips = shodan.quick_search(string)
if not ips.nil?
puts "Shodan Search".light_green + ": #{string}".white
puts "Total Results".light_green + ": #{ips.size}".white
puts "IP Addresses Returned".light_green + ": ".white
f=File.open(RESULTS + 'quick_search-ips.lst', 'w+')
ips.each {|x| puts " #{x}".white; f.puts x }
f.close
else
puts "No Results Found for ".light_red + "#{string}".white + " via Shodan Quick Search".light_red + "!".white
end
puts
when 4
# Search for Exploits
string = options[:search].to_s
source = options[:source].to_s
results = shodan.sploit_search(string, source)
if not results.nil?
f=File.open(RESULTS + "shodan_#{source}_search_results.txt", 'w+')
puts "Shodan Exploit Search".light_green + ": #{string}".white
f.puts "Shodan Exploit Search: #{string}"
results.each do |id, stuff|
puts "ID".light_green + ": #{id}".white unless id.nil?
f.puts "ID: #{id}" unless id.nil?
stuff.each do |link, desc|
puts "View".light_green + ": #{link.sub('http://www.metasploit.com/', 'http://www.rapid7.com/db/')}".white unless link.nil?
f.puts "View: #{link.sub('http://www.metasploit.com/', 'http://www.rapid7.com/db/')}" unless link.nil?
if not link.nil? and source.downcase == 'metasploit'
puts "Github Link".light_green + ": https://raw.github.com/rapid7/metasploit-framework/master/#{link.sub('http://www.metasploit.com/', '').sub('/exploit/', '/exploits/').sub(/\/$/, '')}.rb".white
f.puts "Github Link: https://raw.github.com/rapid7/metasploit-framework/master/#{link.sub('http://www.metasploit.com/', '').sub('/exploit/', '/exploits/').sub(/\/$/, '')}.rb"
end
puts "Exploit Description".light_green + ": \n#{desc}".white unless desc.nil?
f.puts "Exploit Description: \n#{desc}" unless desc.nil?
f.puts
puts
end
end
f.close
else
puts "No Results Found for ".light_red + "#{string}".white + " via Shodan Exploit Search".light_red + "!".white
end
puts
when 5
# Now download one of the exploits you found....
id=options[:search].to_s
source = options[:source].to_s
results = shodan.sploit_download(id, source)
if not results.nil?
downloads = RESULTS + 'downloads/'
Dir.mkdir(downloads) unless File.exists?(downloads) and File.directory?(downloads)
f=File.open(downloads + "#{source}-#{id}.code", 'w+')
results.each do |k, v|
if k == 'Exploit'
puts "Saved to".light_green + ": #{downloads}#{source}-#{id}.code".white
puts "#{k}".light_green + ": \n#{v}".white
f.puts v
else
puts "#{k}".light_green + ": #{v}".white
end
end
f.close
else
puts "No Download Results Found for ID".light_red + "#: #{id}".white
end
end
else
exit 666;
end
#EOF
