loading
Loading content
loading
OSINT
Bulk-export Shodan banner matches as json.gz.
overview
shodan-download runs a Shodan search and writes the full match set to a compressed json.gz file plus a results folder. Inputs are query and api_key; each run spends query credits.
Reach for it when a query matches thousands of hosts and you need the whole set offline. Parse and reshape the archive without another API call, and keep the file as a dated exposure snapshot.
For interactive search, host lookup, and counts, use shodan-python instead. Pair the export with a JSON parse stage when you need rows for inventory or triage.
use cases
Download every host matching a Shodan query as json.gz and analyze the whole set offline, with no repeat searches against the API.
Export banner data across a target's IP ranges to map open ports, running software, and TLS certificates over the whole estate.
Save the raw archive once, then run filtering and reformatting stages against the file as often as needed without spending more query credits.
Capture a dated json.gz each run and diff snapshots to catch newly opened ports or services between scans.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| query | STRING | · | Shodan search query built from Shodan filters (net:, port:, product:, org:, country:). |
| api_key | STRING | · | Shodan API key with download privileges; each run spends query credits. |
Showing key inputs. shodan-download exposes 2 inputs in total.
example
# download every host matching a query into exposed.json.gzshodan download exposed "net:198.51.100.0/24 port:443,8443"Search query: net:198.51.100.0/24 port:443,8443Total number of results: 128Query credits left: 96Output file: exposed.json.gz[####################################] 100%# one decoded banner from exposed.json.gz:{"ip_str":"198.51.100.24","port":443,"transport":"tcp","product":"nginx","org":"Example Hosting","hostnames":["web.example.com"]}{"ip_str":"198.51.100.87","port":8443,"transport":"tcp","product":"Apache httpd","version":"2.4.57","org":"Example Hosting"}guidance
Bulk-export a Shodan query to json.gz when the match set is large enough to process offline. Prefer shodan-python for live search, host lookups, and counts.
Interactive Shodan CLI for search, host lookup, counts, and stats. Prefer it over a bulk dump when you need live results.
DNS and domain history rather than device banners. A different OSINT data source.
Email and username availability checks. Unrelated to device banners, another OSINT building block.
faq
related
Passive DNS records from DNSDumpster.
Generate lookalike domains and flag registered typosquats.
Look up the real IP of a host from its favicon via Shodan.
Email OSINT from public sources, with optional breach checks.
Check whether emails and usernames are available, taken, or invalid.
Passive DNSDumpster host lookup by domain.
A query feeds shodan-download, which exports the matching banners as json.gz before a parse stage turns them into a host inventory.
Facts on this page come from the live Trickest tool library.