Lean and easily extendible PHP API for Shodan.io, supporting both the free API and the paid one. Requests are auto-generated by structure that defines the API protocol.

Shodan-PHP-REST-API is licensed under the GNU GPL v3 and is a project sponsored by ISGroup SRL and authored by Alex Salvetti and Francesco ascii Ongaro. This software is currently used by ScadaExposure, a permanent observatory on the exposure of ICS and SCADA devices on the Internet, to generate it's datasets.

• Search Shodan.
• Streaming API support for real-time consumption of Shodan data.
• Exploit search API fully implemented.

• Shodan.php is the API class: costants, shodan methods and the generation of the HTTP requests are defined here.
• The script uses PHP magic methods (http://php.net/manual/en/language.oop5.magic.php).
• shodan-api.php is the CLI interface, allowing to run differents commands; it also provides an how-to function.
• Our API implementation uses 3 different base URLs: Shodan API, Streaming API and Exploits API.
• Tests folder provides some examples on how to write your own search query, use the CLI -r flag for running them all or call one with the -t flag.
• If you're in search of better and more thorough documentation, please refer to Shodan's REST API documentation (https://developer.shodan.io/api).
• For Shodan EXPLOITS API refer to the documentation (https://developer.shodan.io/api/exploits/rest).
• For Shodan STREAM API refer to the documentation (https://developer.shodan.io/api/stream).

You can implement the class API directly in your code or experiment with the CLI. In both cases you'll need to change your API KEY in shodan-api.php or anywhere you istantiate the API object:

https://github.com/ScadaExposure/Shodan-PHP-REST-API/blob/master/src/shodan-api.php#L7

$key = 'Insert your API key here';

Following are the options:

Using PHP magic methods we call the method by its name and use it for generate the URL for the request. For doing that we use preg_replace inserting a / when an uppercase character is found and appending that character in lowercase.

But we found that two methods in Shodan API were overlapping with other two methods, that are: "ShodanScan" and "ShodanPorts". So we renamed "ShodanScan" given with "id" parameter in "ShodanScan_Id", and "ShodanPorts" for the stream API in "ShodanPorts_Stream".

But the URL must not have those renaming, so we eliminate the _ and all it comes next of it for getting the job done.

You can find it at: https://github.com/ScadaExposure/Shodan-PHP-REST-API/blob/master/src/Shodan.php#L471

Return all services that have been found on the given host IP.

var_dump($client->ShodanHost(array(
	'ip' => '69.171.230.68', // https://www.facebook.com/
)));

Returns the total number of results that matched the query and any facet information that was requested.

var_dump($client->ShodanHostCount(array(
  'query' => 'Niagara Web Server',
)));

Search Shodan using the same query syntax as the website and use facets to get summary information for different properties. - This method may use API query credits depending on usage.

var_dump($client->ShodanHostSearch(array(
	'query' => 'Niagara Web Server',
)));

This method lets you determine which filters are being used by the query string and what parameters were provided to the filters.

var_dump($client->ShodanHostSearchTokens(array(
	'query' => 'Niagara Web Server country:"IT"',
)));

This method returns a list of port numbers that the crawlers are looking for.

var_dump($client->ShodanPorts());

This method returns an object containing all the protocols that can be used when launching an Internet scan.

var_dump($client->ShodanProtocols());

Use this method to request Shodan to crawl a network. - POST METHOD REQUIRE PAID API KEY.

var_dump($client->ShodanScan(array(
	'ips' => '69.171.230.0/24',
)));

Use this method to request Shodan to crawl the Internet for a specific port. - POST METHOD REQUIRE PAID API KEY AND SHODAN PERMISSION.

var_dump($client->ShodanScanInternet(array(
	'port' => '80',
	'protocol' => 'dns-tcp',
)));

Check the progress of a previously submitted scan request.

var_dump($client->ShodanScan_Id(array(
	'id' => 'R2XRT5HH6X67PFAB',
)));

This method returns an object containing all the services that the Shodan crawlers look at. It can also be used as a quick and practical way to resolve a port number to the name of a service.

var_dump($client->ShodanServices());

Use this method to obtain a list of search queries that users have saved in Shodan.

var_dump($client->ShodanQuery(array(
	'page' => '1', 
)));

Use this method to search the directory of search queries that users have saved in Shodan.

var_dump($client->ShodanQuery(array(
	'query' => 'fax',
)));

Use this method to obtain a list of popular tags for the saved search queries in Shodan.

var_dump($client->ShodanQueryTags(array(
	'size' => '30',
)));

Calculates a honeypot probability score ranging from 0 (not a honeypot) to 1.0 (is a honeypot).

var_dump($client->LabsHoneyscore(array(
	'ip' => '54.231.184.227', // http://mushmush.org/
)));

Search across a variety of data sources for exploits and use facets to get summary information.

var_dump($client->Search(array(
	'query' => 'cve',
)));

This method behaves identical to the "/search" method with the difference that it doesn't return any results.

var_dump($client->Count(array(
	'query' => 'cve',
)));

This method allows you to get your Shodan's account information results.

var_dump($client->AccountProfile());

{
    "member": true,
    "credits": 0,
    "display_name": null,
    "created": "2020-06-15T10:44:43.148000"
}

Look up the IP address for the provided list of hostnames, takes a comma-separated list of hostnames.

var_dump($client->DnsResolve(array(
	'hostnames' => 'google.com,bing.com', 
)));

{
    "google.com": "172.217.6.46",
    "facebook.com": "157.240.22.35"
}

Look up the hostnames that have been defined for the given list of comma-separated IP addresses.

var_dump($client->DnsReverse(array(
	'ips' => '8.8.8.8,1.1.1.1', 
)));

{
    "8.8.8.8": [
        "dns.google"
    ],
    "1.1.1.1": [
        "one.one.one.one"
    ]
}