Shodan CLI — Install, Use, Optimise (2026)

Command-line client for Shodan, the search engine for internet-connected devices and exposed services.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

pipx

pipx install shodan

pip

pip install --user shodan

Init API key

shodan init YOUR_API_KEY

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Search by query

shodan search "apache country:IN port:80"

Host details

shodan host 8.8.8.8

Count results without listing

shodan count "apache country:IN"

Stream results to JSON

shodan search --fields ip_str,port,org "Mongo country:IN" -o results.json

Alert on new exposures

shodan alert create "MyOrg" 1.2.3.4/24

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Free tier: 100 query credits/month. Membership ($49 one-time) unlocks bulk download and more credits — worth it.
• --fields dramatically reduces credit consumption — only request what you need.
• shodan download caches results offline — query against the dump with shodan parse for free.
• shodan stream is a real-time firehose for monitoring — needs Enterprise tier.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• shodan init stores API key in plaintext at ~/.shodan/api_key — treat the workstation as sensitive.
• Date-based queries (after:2026-04-01) only on paid tiers.
• shodan host consumes 1 credit per IP — bulk lookups are expensive without download dumps.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• Censys — academic origin, broader X.509 cert data.
• ZoomEye — China-based, sometimes shows assets others miss.
• FOFA — particularly strong on East Asian networks.

India context and engagement notes

Indian-stack queries that pay off: port:6379 country:IN (exposed Redis), port:9200 country:IN (Elasticsearch), "X-Powered-By: PHP" country:IN port:8080 (admin panels). Report findings via CERT-In responsible disclosure.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.