momenbasel/shodscriptAutomate exploit/PoC execution against Shodan search results - concurrent dispatch, filtering, structured output, and export.
Automate exploit and PoC execution against Shodan search results. Query Shodan, filter targets, and run your scripts against every match - concurrently, with structured output and export.
You have a PoC script that takes an IP and port. You want to run it against every host matching a Shodan query. ShodScript bridges the gap: search, filter, dispatch, collect results.
pip install git+https://github.com/momenbasel/shodscript.git
Or clone and install locally:
git clone https://github.com/momenbasel/shodscript.git
cd shodscript
pip install -e .
Set your Shodan API key:
export SHODAN_API_KEY="your-api-key-here"
Or pass it with --api-key / -k on every command.
# Table output
shodscript search "apache 2.4.49"
# Filter by port and country
shodscript search "nginx" --port 443 --country US --limit 50
# JSON output
shodscript search "apache" --json
# Run check_http.py against each host matching "apache 2.4.49"
shodscript run "apache 2.4.49" ./exploit.py
# 20 concurrent workers, 60s timeout per target
shodscript run "apache 2.4.49" ./exploit.py -w 20 -t 60
# Filter to port 80 in Germany, save results
shodscript run "apache" ./exploit.py --port 80 --country DE -o results.json
# CSV export
shodscript run "nginx" ./check.py -o results.csv --format csv
# Only show successful hits
shodscript run "apache" ./exploit.py --quiet
Three modes via --pass-via:
# Pass via environment variables
shodscript run "nginx" ./script.py --pass-via env
# Pass via stdin
shodscript run "nginx" ./script.py --pass-via stdin
# Forward extra arguments to the script
shodscript run "nginx" ./script.py -e "--verbose" -e "--ssl"
# One IP per line - pipe to other tools
shodscript ips "apache 2.4.49" | xargs -I{} curl -s http://{}
# Include port
shodscript ips "apache 2.4.49" --with-port
# Pipe to nuclei, httpx, etc.
shodscript ips "apache 2.4.49" -n 500 | httpx -silent
shodscript host 1.2.3.4
shodscript host 1.2.3.4 --json
shodscript info
Your script just needs to accept an IP and port. Minimal example:
#!/usr/bin/env python3
import sys
ip = sys.argv[1]
port = int(sys.argv[2])
# Your exploit/check logic here
print(f"[+] {ip}:{port} - vulnerable")
# Exit 0 = success (marked green), non-zero = failure (marked red)
See the examples/ directory for more patterns including env-based and banner grabbing scripts.
Results can be saved as JSON, JSONL, or CSV:
shodscript run "query" ./script.py -o results.json # JSON (default)
shodscript run "query" ./script.py -o results.jsonl --format jsonl # One JSON object per line
shodscript run "query" ./script.py -o results.csv --format csv # CSV
Each record contains: ip, port, host, org, country, returncode, success, stdout, stderr, elapsed, error.
MIT
For authorized security testing and research only.
| Mode | How your script receives the target |
|---|
arg (default) | python3 script.py <ip> <port> |
env | TARGET_IP, TARGET_PORT, TARGET_HOST environment variables |
stdin | ip:port\n written to stdin |