The Shodan monitoring tools allows you to monitor shodan listed servers basis on the filter you select.
This tool can be used to monitor internet exposed surface, specifically speaking, your servers. Shodan scans the entire internet periodically and maps out details such as Ports open, type of service running, certificate details, organization to which the server belong, etc, all this to an IP Address. This is good for blue teamers to monitor your internet exposed servers and equalivalently good for red teamers to find loop holes onto exposed servers.
- As a Blue teamer, you might have to keep an eye if your company puts a new server out on the web or to Map out your existing exposed surface. You might also want to keep check if any new port is opened, or content on the existing ports have changed.
- As a Red teamer, you might want to keep an eye on exposed surface to find any loop holes, and simulate as attackers who are finding single instance of misconfiguration to enter in your network.
- Shodan API Key
- Create free account on shodan
- Get API Key
- Free Shodan account is enough to monitor a small number of servers (upto 100)
- A Filter that shortlists servers that you want to monitor.
- It should cover any servers that are already exposed, as well as if something new pops up.
- I prefer to use org:"YOUR ORG" filter, or ASN:"ASXXXXX" filter.
-
A Discord Webhook to send notifications to.
-
(OPTIONAL) If you like periodic Monitoring, you might want to run this script on Cloud.
- I used AWS Cloud as it was easiest to setup and free for one year!
- Python 3.11(+?) and Internet Connection
- Download the Python Script and DB
- Get a Shodan API Key after creating a free account
- Put the appropiate Shodan Query Here to get appropiate results in return
- Put your discord webhook in
- Change line as per the frequency you want to send messages
- As per your Shodan Query (in line XYZ), you can customize IP to DNS Mapping to help you find out anything that is not expected on the internet.
- You need to put your own entries in IP to DNS entries in the dictionary mentioned in line XYZ.
You can reach the original programmer at @Cyberature on twitter, but I have terrible opsec so I don't have twitter.