OSINT
Download a full Shodan result set for offline parsing
Bulk-export Shodan banner matches as json.gz.
Python
overview
What shodan-download does
shodan-download runs a Shodan search and writes the full match set to a compressed json.gz file plus a results folder. Inputs are query and api_key; each run spends query credits.
Reach for it when a query matches thousands of hosts and you need the whole set offline. Parse and reshape the archive without another API call, and keep the file as a dated exposure snapshot.
For interactive search, host lookup, and counts, use shodan-python instead. Pair the export with a JSON parse stage when you need rows for inventory or triage.
use cases
Where shodan-download fits
Snapshot a search result set
Download every host matching a Shodan query as json.gz and analyze the whole set offline, with no repeat searches against the API.
Inventory exposed services
Export banner data across a target's IP ranges to map open ports, running software, and TLS certificates over the whole estate.
Feed an offline parsing pipeline
Save the raw archive once, then run filtering and reformatting stages against the file as often as needed without spending more query credits.
Track exposure over time
Capture a dated json.gz each run and diff snapshots to catch newly opened ports or services between scans.
reference
shodan-download inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| query | STRING | · | Shodan search query built from Shodan filters (net:, port:, product:, org:, country:). |
| api_key | STRING | · | Shodan API key with download privileges; each run spends query credits. |
Showing key inputs. shodan-download exposes 2 inputs in total.
example
Run shodan-download
# download every host matching a query into exposed.json.gz
shodan download exposed "net:198.51.100.0/24 port:443,8443"Search query: net:198.51.100.0/24 port:443,8443
Total number of results: 128
Query credits left: 96
Output file: exposed.json.gz
[####################################] 100%
# one decoded banner from exposed.json.gz:
{"ip_str":"198.51.100.24","port":443,"transport":"tcp","product":"nginx","org":"Example Hosting","hostnames":["web.example.com"]}
{"ip_str":"198.51.100.87","port":8443,"transport":"tcp","product":"Apache httpd","version":"2.4.57","org":"Example Hosting"}guidance
Choosing shodan-download
Bulk-export a Shodan query to json.gz when the match set is large enough to process offline. Prefer shodan-python for live search, host lookups, and counts.
shodan-python
Interactive Shodan CLI for search, host lookup, counts, and stats. Prefer it over a bulk dump when you need live results.
securitytrails-sql
DNS and domain history rather than device banners. A different OSINT data source.
socialscan
Email and username availability checks. Unrelated to device banners, another OSINT building block.
faq
shodan-download questions
related
More OSINT tools
dnsdumpster-dns-lookup
Passive DNS records from DNSDumpster.
dnstwist
Generate lookalike domains and flag registered typosquats.
favup
Look up the real IP of a host from its favicon via Shodan.
Infoga
Email OSINT from public sources, with optional breach checks.
maigret
Username search that collects accounts and profile data into one dossier.
socialscan
Check whether emails and usernames are available, taken, or invalid.
Run shodan-download yourself
A query feeds shodan-download, which exports the matching banners as json.gz before a parse stage turns them into a host inventory.
Facts on this page come from the live Trickest tool library.