Querying Shodan to obtain target information
Shodan is one of the search engines for internet-connected devices. It is a useful source of information that even includes port and banner information of remote targets, among other bits of interesting data. One of the advantages of passively port scanning with Shodan is that we don't need to communicate directly with the target to obtain the list of open ports, protocols, and service banners.
In this recipe, you will learn how to use Shodan to enumerate services and their versions from remote hosts with Nmap.
Getting ready
The shodan-api NSE script needs an API key before it can be used. Shodan offers free developer API plans that you can obtain by signing up at https://developer.shodan.io/.
Once registered, copy your Shodan API key before continuing.
How to do it...
- To obtain host information of a remote target from Shodan, use the following command:
$nmap -sn -Pn -n --script shodan-api --script-args shodan...
