Query Internet Exposure with Shodan and cnspec

Discover internet-facing services, open ports, and potential exposure on your hosts with cnspec and Shodan. Use the Shodan provider inside your own policies to alert on unexpected open ports or banner strings against assets you control.

Prerequisites

To query Shodan with cnspec, you must have:

• cnspec installed on your workstation
• A Shodan account with an API key

Authenticate

Set your Shodan API key as an environment variable:

export SHODAN_API_TOKEN="your-api-key"

To retrieve your API key, go to your Shodan Account Overview.

Scan a host with Shodan

cnspec scan shodan --targets HOST

For HOST, substitute the domain name or IP address. For example:

cnspec scan shodan --targets example.com

Explore and test checks interactively

Open a cnspec shell to query Shodan data for a host:

cnspec shell shodan --targets example.com

List open ports on a host

cnspec> shodan.host.ports
shodan.host.ports: [80, 443, 8080]

Retrieve the organization associated with a host

cnspec> shodan.host.org
shodan.host.org: "Example Corp"

To exit the cnspec shell, press Ctrl + D or type exit.

Continuously scan with Mondoo Platform

Go beyond one-off scans. Use Mondoo Platform to continuously monitor hosts with Shodan. To learn more, read Secure a Host with Shodan.

Learn more

• Shodan Resource Pack Reference: every Shodan resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries