Shodan

Modified on: Thu, 11 Mar, 2021 at 8:47 AM

Overview

Shodan is a search engine for IoT devices. It crawls the Internet for publicly accessible devices, concentrating on SCADA (supervisory control and data acquisition) systems. For each device, Shodan stores the software it runs, including version, operating system, hostnames, location, and more. The processed data feeds are also made accessible through a public search engine website. Shodan Transforms help investigators to access this information about IoT devices and systems.


To read more about Shodan on our website, click here.


For a full, detailed list of all available Shodan Transforms, please refer to the list below:


Search Netblock [Shodan]

Transform Meta Info

Display Name

Search Netblock [Shodan]

Transform Name

maltego.shodan.cidrToIpAddresses

Short Description

Returns the IP Addresses within the input range matching the input filters.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.CIDR

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address


Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

tags

string

 

False

True

False

Tags (comma separated)


Description

This Transform performs a Shodan search query and returns all the IP Addresses within the specified subnet with the specified input filters.


Search Netblock [Shodan]

Transform Meta Info

Display Name

Search Netblock [Shodan]

Transform Name

maltego.shodan.netblocktoipv4address

Short Description

Returns the IP Addresses within the input range matching the input filters.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Netblock

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform tries to convert input netblock to a subnet and performs a Shodan search query to return all the IP Addresses within the subnet with the specified input filters.


Search Shodan (Escape input) [Shodan]

Transform Meta Info

Display Name

Search Shodan (Escape input) [Shodan]

Transform Name

maltego.shodan.phrasetoipv4address

Short Description

Returns the IP Addresses matching the Shodan search query with search term wrapped with double quotes.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Phrase

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

cidr

string

 

False

True

False

Netblock CIDR

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform prepend and append double quotes to the input phrase and performs a Shodan search to return all the IP Addresses with the specified input filters.


Search Shodan (Raw) [Shodan]

Transform Meta Info

Display Name

Search Shodan (Raw) [Shodan]

Transform Name

maltego.shodan.phrasetoipv4address.(raw)

Short Description

Returns the IP Addresses matching the raw Shodan search query.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Phrase

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

cidr

string

 

False

True

False

Netblock CIDR

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform takes the complete input phrase as a raw Shodan search query and returns the IP Addresses resulting to the search. The Transform Inputs are appended to the search query as Shodan standard filters if set by the user.


To AS Number [Shodan]

Transform Meta Info

Display Name

To AS Number [Shodan]

Transform Name

maltego.shodan.ipv4addresstoasnumber

Short Description

Returns the AS number which the input IP Address belongs to.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.AS

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the AS Number recorded by Shodan for the input IPv4 Address.


To AS Number [Shodan]

Transform Meta Info

Display Name

To AS Number [Shodan]

Transform Name

maltego.shodan.ipv6AddressToAsNumber

Short Description

Returns the AS number which the input IP Address belongs to.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.AS

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the AS Number recorded by Shodan for the input IPv6 Address.


To All Details [Shodan]

Transform Meta Info

Display Name

To All Details [Shodan]

Transform Name

maltego.shodan.ipv4addresstoasnumber,company,dnsname,domain,gps,isp,location,service,certhash,etag,htmlhash,certserial,sshfingerprint

Short Description

Returns all the latest details of the input IP Address with timestamp when it was collected.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.AS, maltego.Company, maltego.Domain, maltego.GPS, maltego.ISP, maltego.Location, maltego.DNSName, maltego.X509Certificate, maltego.Hash, maltego.Phrase, maltego.CVE, maltego.Banner, maltego.Service

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns common Entities that can be individually derived from other Transforms that run directly on the maltego.IPv4Address Entity.


This Transform sets the timestamp as Entity property to when Shodan last recorded the information. The Detail View of the input Entity is also populated with some interesting facts with screenshots if available.


To All Details [Shodan]

Transform Meta Info

Display Name

To All Details [Shodan]

Transform Name

maltego.shodan.ipv6AddressToAllDetails

Short Description

Returns all the latest details of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.AS, maltego.Company, maltego.Domain, maltego.GPS, maltego.ISP, maltego.Location, maltego.DNSName, maltego.X509Certificate, maltego.Hash, maltego.Phrase, maltego.CVE, maltego.Banner, maltego.Service

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns common Entities that can be individually derived from other Transforms that run directly on the maltego.IPv6Address Entity.

This Transform sets the timestamp as Entity property to when Shodan last recorded the information. The Detail View of the input Entity is also populated with some interesting facts with screenshots if available.


To All Details [Shodan]

Transform Meta Info

Display Name

To All Details [Shodan]

Transform Name

maltego.shodan.serviceToAllDetails

Short Description

Return all the details found on the input service.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.ServiceDetails

Output Entity(s)

maltego.AS, maltego.Organization, maltego.Domain, maltego.shodan.Tag, maltego.GPS, maltego.ISP, maltego.Location, maltego.DNSName, maltego.X509Certificate, maltego.Hash, maltego.Port, maltego.CVE, maltego.Banner, maltego.DateTime

 

Transform Inputs

Not applicable


Description

This Transform extracts common Entities from the raw Shodan service data hidden in a property of the input maltego.Service Entity.


To Banner Hash [Shodan]

Transform Meta Info

Display Name

To Banner Hash [Shodan]

Transform Name

maltego.shodan.ipv4AddressToBannerHash

Short Description

Returns the hash of the banners collected by Shodan.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.shodan.BannerHash

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the hashes calculated by Shodan of all the latest banners collected from the input IPv4 Address.


To Banner Hash [Shodan]

Transform Meta Info

Display Name

To Banner Hash [Shodan]

Transform Name

maltego.shodan.ipv6AddressToBannerHash

Short Description

Returns the hash of the banners collected by Shodan.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.shodan.BannerHash

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the hashes calculated by Shodan of all the latest banners collected from the input IPv6 Address.


To Banner [Shodan]

Transform Meta Info

Display Name

To Banner [Shodan]

Transform Name

maltego.parse.servicetobanner

Short Description

Returns the raw Banner details collected by Shodan Crawlers.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.ServiceDetails

Output Entity(s)

maltego.Banner

 

Transform Inputs

Not applicable.


Description

This Transform extracts the raw banner text collected by Shodan crawlers from the input Service Entity.


To Banners [Shodan]

Transform Meta Info

Display Name

To Banners [Shodan]

Transform Name

maltego.shodan.ipv4AddressToBanners

Short Description

Returns the Banners captured by Shodan Crawlers.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.Banner

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest raw banners collected by Shodan Crawlers on the input IPv4 Address Entity.


Banners [Shodan]

Transform Meta Info

Display Name

To Banners [Shodan]

Transform Name

maltego.shodan.ipv6AddressToBanners

Short Description

Returns the Banners captured by Shodan Crawlers.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.Banner

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest raw banners collected by Shodan Crawlers on the input IPv6 Address Entity.


To Basic Details [Shodan]

Transform Meta Info

Display Name

To Basic Details [Shodan]

Transform Name

maltego.shodan.ipv4AddressToBasicDetails

Short Description

Returns basic details associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.AS, maltego.Company, maltego.Domain, maltego.GPS, maltego.ISP, maltego.Location, maltego.DNSName, maltego.CVE

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns commonly used Entities found on the input maltego.IPv4Address Entity. The Entities returned does not include the more detailed Entities such as maltego.Banners and maltego.Service.

This Transform sets the timestamp as Entity property to when Shodan last recorded the information.


To Basic Details [Shodan]

Transform Meta Info

Display Name

To Basic Details [Shodan]

Transform Name

maltego.shodan.ipv6AddressToBasicDetails

Short Description

Returns basic details associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.AS, maltego.Company, maltego.Domain, maltego.GPS, maltego.ISP, maltego.Location, maltego.DNSName, maltego.CVE

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns commonly used Entities found on the input maltego.IPv6Address Entity. The Entities returned does not include the more detailed Entities such as maltego.Banners and maltego.Service.


This Transform sets the timestamp as Entity property to when Shodan last recorded the information.


To Cert Hash [Shodan]

Transform Meta Info

Display Name

To Cert Hash [Shodan]

Transform Name

maltego.shodan.ipv4addresstocerthash

Short Description

Return the hash of certificate configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.SSLCertificateHash

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key


Description

This Transform returns the hashes calculated by Shodan for the certificates configured on the input IPv4 Address.


To Cert Hash [Shodan]

Transform Meta Info

Display Name

To Cert Hash [Shodan]

Transform Name

maltego.shodan.ipv6AddressToCertHash

Short Description

Return the hash of certificate configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.SSLCertificateHash

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the hashes calculated by Shodan for the certificates configured on the input IPv6 Address.


To Cert Serial [Shodan]

Transform Meta Info

Display Name

To Cert Serial [Shodan]

Transform Name

maltego.shodan.ipv4addresstocertserial

Short Description

Returns the serial number of certificate configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.SSLCertificateSerial

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the serial number of the certificates configured on the input IPv4 Address.


To Cert Serial [Shodan]

Transform Meta Info

Display Name

To Cert Serial [Shodan]

Transform Name

maltego.shodan.ipv6AddressToCertSerial

Short Description

Returns the serial number of certificate configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.SSLCertificateSerial

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the serial number of the certificates configured on the input IPv6 Address.


To Certificate [Shodan]

Transform Meta Info

Display Name

To Certificate [Shodan]

Transform Name

maltego.shodan.ipv4AddressToX509Certificate

Short Description

Returns the certificate details configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.X509Certificate

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the certificates configured on the input IPv4 Address.


To Certificate [Shodan]

Transform Meta Info

Display Name

To Certificate [Shodan]

Transform Name

maltego.shodan.ipv6AddressToX509Certificate

Short Description

Returns the certificate details configured on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.X509Certificate

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the certificates configured on the input IPv6 Address.


To DNS Names [Shodan]

Transform Meta Info

Display Name

To DNS Names [Shodan]

Transform Name

maltego.shodan.ipv4addresstodnsname

Short Description

Returns all the DNS names associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the latest DNS names captured by Shodan that are associated with the input IPv4 Address.


To DNS Names [Shodan]

Transform Meta Info

Display Name

To DNS Names [Shodan]

Transform Name

maltego.shodan.ipv6AddressToDnsNames

Short Description

Returns all the DNS names associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the latest DNS names captured by Shodan that are associated with the input IPv4 Address.


To DNS Records [Shodan]

Transform Meta Info

Display Name

To DNS Records [Shodan]

Transform Name

maltego.shodan.dnsNameToDnsRecords

Short Description

Returns the live and historical DNS records associated with the input DNS name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.ARecord, maltego.AAAARecord, maltego.MXRecord, maltego.NSRecord, maltego.DNSName, maltego.Phrase

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the latest and historical DNS records of the input DNS Name.


To DNS Records [Shodan]

Transform Meta Info

Display Name

To DNS Records [Shodan]

Transform Name

maltego.shodan.domainToDnsRecords

Short Description

Returns the current and historical DNS records of the input Domain name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.ARecord, maltego.AAAARecord, maltego.MXRecord, maltego.NSRecord, maltego.DNSName, maltego.Phrase

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the latest and historical DNS records of the input Domain name.


To Domains [Shodan]

Transform Meta Info

Display Name

To Domains [Shodan]

Transform Name

maltego.shodan.ipv4addresstodomain

Short Description

Returns the Domain names associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.Domain

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the Domain names that are associated with the input IPv4 Address from Shodan.


To Domains [Shodan]

Transform Meta Info

Display Name

To Domains [Shodan]

Transform Name

maltego.shodan.ipv6AddressToDomains

Short Description

Returns the Domain names associated with the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.Domain

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the Domain names that are associated with the input IPv6 Address from Shodan.


To ETags [Shodan]

Transform Meta Info

Display Name

To ETags [Shodan]

Transform Name

maltego.shodan.ipv4addresstoetag

Short Description

Returns the HTML ETags returned by the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.ETag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the ETag found on the HTML web pages captured by Shodan which were served on the input IPv4 Address.


To ETags [Shodan]

Transform Meta Info

Display Name

To ETags [Shodan]

Transform Name

maltego.shodan.ipv6AddressToETags

Short Description

Returns the HTML ETags returned by the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.ETag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the ETag found on the HTML web pages captured by Shodan which were served on the input IPv6 Address.


To GPS [Shodan]

Transform Meta Info

Display Name

To GPS [Shodan]

Transform Name

maltego.shodan.ipv4addresstogps

Short Description

Returns the GPS location recorded by Shodan of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.GPS

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the GPS coordinates of the input IPv4 Address when it was last crawled by Shodan.


To GPS [Shodan]

Transform Meta Info

Display Name

To GPS [Shodan]

Transform Name

maltego.shodan.ipv6AddressToGps

Short Description

Returns the GPS location recorded by Shodan of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.GPS

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the GPS coordinates of the input IPv6 Address when it was last crawled by Shodan.


To HTML Hash [Shodan]

Transform Meta Info

Display Name

To HTML Hash [Shodan]

Transform Name

maltego.shodan.ipv4addresstohtmlhash

Short Description

Returns the hash of HTML pages served by the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.shodan.HtmlHash


Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the hash calculated by Shodan of the HTML pages served by the input IPv4 Address.


To HTML Hash [Shodan]

Transform Meta Info

Display Name

To HTML Hash [Shodan]

Transform Name

maltego.shodan.ipv6AddressToHtmlHash

Short Description

Returns the hash of HTML pages served by the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.shodan.HtmlHash

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the hash calculated by Shodan of the HTML pages served by the input IPv6 Address.


To IP Addresses Sharing Hash [Shodan]

Transform Meta Info

Display Name

To IP Addresses Sharing Hash [Shodan]

Transform Name

maltego.shodan.hashtoipv4address

Short Description

Returns the IP Addresses on which the same input Hash was found.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Hash

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform performs a Shodan search query and returns all the IP Address which associates with the input Hash.

The Shodan hash search filters are set based on the Hash Type property of the input Hash Entity.

The following listing maps the Hash Type with corresponding Shodan filters. Any Hash Type not listed below is treated as a simple search term.

  1. Banner Hash: hash
  2. SHA256: ssl.cert.fingerprint
  3. SHA1: ssl.cert.fingerprint
  4. HTML Hash: http.html_hash
  5. Certificate Serial: ssl.cert.serial
  6. ETag:<simple search term>


To IP Addresses Sharing SSH Fingerprint [Shodan]

Transform Meta Info

Display Name

To IP Addresses Sharing SSH Fingerprint [Shodan]

Transform Name

maltego.shodan.serviceToIpAddressesSharingSshFingerprint

Short Description

Returns the IP Addresses on which same input SSH Fingerprint was found.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.ServiceDetails

Output Entity(s)

maltego.IPv4Address,maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

False

True

Shodan API Key

 

Description

This Transform searches Shodan for all the latest IP Addresses whose Service Hash value matches the one from the input Entity.


The Transform reads the hash value from a hidden property. The Service Hash Entity property visible to the user should not be manually modified.


To IP Addresses [Shodan]

Transform Meta Info

Display Name

To IP Addresses [Shodan]

Transform Name

maltego.shodan.asnumbertoipv4address

Short Description

Returns the IP Addresses belonging to the AS number and matching the search query.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.AS

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

cidr

string

 

False

True

False

Netblock CIDR

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform performs a Shodan search query with filter asn set with the input AS Number. The AS Number is appended to the filter string asn:AS.


For example, if the input maltego.ASNumber Entity has the main value of 188, the search query with filter will be asn:AS188.

It is also highly recommended to use other search filters and search terms from Transform inputs to limit the results since an AS Number could have thousands of IP Addresses that may not be interesting on its own.


To IP Addresses [Shodan]

Transform Meta Info

Display Name

To IP Addresses [Shodan]

Transform Name

maltego.shodan.dnsNameToIpAddresses

Short Description

Returns the IP Addresses resolving to the input DNS Name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the IP Address from Shodan to which input DNS Name resolves to.


To IP Addresses [Shodan]

Transform Meta Info

Display Name

To IP Addresses [Shodan]

Transform Name

maltego.shodan.domainToIpAddresses

Short Description

Returns the IP Addresses resolving to the input Domain name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the IP Address from Shodan to which input Domain name resolves to.


To IP Addresses [Shodan]

Transform Meta Info

Display Name

To IP Addresses [Shodan]

Transform Name

maltego.shodan.porttoipv4address

Short Description

Return the IP Addresses where the port has been observed.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Port

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform performs a Shodan search query with filter port set to the input port number and returns the IP Addresses on which the specified port number was observed to be open.


Shodan, however, crawls only a limited port numbers.


It is also highly recommended to use other search filters and search terms from Transform inputs to limit the results since there could be millions of IP Addresses on which the input port number was observed to be open.


To IP Addresses on hostname [Shodan]

Transform Meta Info

Display Name

To IP Addresses on hostname [Shodan]

Transform Name

maltego.shodan.dnsNameToIpAddressesOnHostname

Short Description

Returns the IP Addresses which are linked to any hosts containing the input DNSName as part of the hostname.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the IP Addresses whose hostname ends with the input hostname.


To IP Addresses on hostname [Shodan]

Transform Meta Info

Display Name

To IP Addresses on hostname [Shodan]

Transform Name

maltego.shodan.domaintoipv4address.with-hostname

Short Description

Returns the IP Addresses which are linked to any hosts containing the input domain as part of the hostname.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the IP Addresses whose hostname containing the input Domain name.


To IP Addresses sharing Tag [Shodan]

Transform Meta Info

Display Name

To IP Addresses sharing Tag [Shodan]

Transform Name

maltego.shodan.shodanTagToIpAddresses

Short Description

Returns all the IP Addresses that have the same tag assigned to them by Shodan as the input tag.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.Tag

Output Entity(s)

maltego.IPv4Address,maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

port

string

 

False

True

False

Port

 

Description

This Transform returns all the IP Address that have the same tag assigned to them by Shodan as the input tag.


To IP Addresses with this Banner [Shodan]

Transform Meta Info

Display Name

To IP Addresses with this Banner [Shodan]

Transform Name

maltego.shodan.bannerToIpAddresses

Short Description

Returns all the IP Addresses with the same banner as input service banner hash.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Banner

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform performs a Shodan search and returns all the IP Addresses with the same banner as input service banner based on their hash value which calculated by Shodan.


To IP Addresses with this Service Hash [Shodan]

Transform Meta Info

Display Name

To IP Addresses with this Service Hash [Shodan]

Transform Name

maltego.shodan.serviceToIpAddressesWithThisServiceHash

Short Description

Return all the IP Addresses that have the similar service as the input service hash.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.ServiceDetails

Output Entity(s)

maltego.IPv4Address,maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform extracts the raw Banner data stored in a hidden property of the input maltego.Service Entity.


To IP Addresses with this Service [Shodan]

Transform Meta Info

Display Name

To IP Addresses with this Service [Shodan]

Transform Name

maltego.shodan.serviceToIpAddressesWithThisService

Short Description

Return all the IP Addresses that have the similar port as the input service.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Service

Output Entity(s)

maltego.IPv4Address,maltego.IPv6Address


Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

hostname

string

 

False

True

False

Hostname

org

string

 

False

True

False

Organization

isp

string

 

False

True

False

ISP

raw

string

 

False

True

False

Raw Search

ssl

string

 

False

True

False

SSL

isVulnerable

boolean

false

False

True

False

Is vulnerable

vuln

string

 

False

True

False

Vuln (CVE)

hasScreenshot

boolean

false

False

True

False

Has screenshot

country

string

 

False

True

False

Country ISO Code

tags

string

 

False

True

False

Tags (comma separated)

 

Description

This Transform performs as Shodan search query and returns all the IP Addresses that have the similar service as the input service based on the input service hash value.


The Transform reads the hash value from a hidden property. The Service Hash Entity property visible to the user should not be manually modified.


To ISP [Shodan]

Transform Meta Info

Display Name

To ISP [Shodan]

Transform Name

maltego.shodan.ipv4addresstoisp

Short Description

Returns the ISP detected by Shodan that serves the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.ISP

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest ISP recorded by Shodan for the input IPv4 Address.


To ISP [Shodan]

Transform Meta Info

Display Name

To ISP [Shodan]

Transform Name

maltego.shodan.ipv6AddressToIsp

Short Description

Returns the ISP detected by Shodan that serves the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.ISP

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest ISP recorded by Shodan for the input IPv6 Address.


To Location [Shodan]

Transform Meta Info

Display Name

To Location [Shodan]

Transform Name

maltego.shodan.ipv4addresstolocation

Short Description

Return the location recorded by Shodan of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.Location

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest recorded location by Shodan of the input IPv4 Address.


To Location [Shodan]

Transform Meta Info

Display Name

To Location [Shodan]

Transform Name

maltego.shodan.ipv6AddressToLocation

Short Description

Return the location recorded by Shodan of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.Location

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest recorded location by Shodan of the input IPv6 Address.


To Organization [Shodan]

Transform Meta Info

Display Name

To Organization [Shodan]

Transform Name

maltego.shodan.ipv4addresstocompany

Short Description

Returns the organization associated to the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.Organization

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest recorded organization by Shodan that was associated to the input IPv4 Address.


To Organization [Shodan]

Transform Meta Info

Display Name

To Organization [Shodan]

Transform Name

maltego.shodan.ipv6AddressToOrganization

Short Description

Returns the organization associated to the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.Organization

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the latest recorded organization by Shodan that was associated to the input IPv6 Address.


To Port [Shodan]

Transform Meta Info

Display Name

To Port [Shodan]

Transform Name

maltego.parse.servicetoport

Short Description

Returns the port number for all the service found on the input service.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Service

Output Entity(s)

maltego.Port

 

Transform Inputs

Not applicable.


Description

This Transform extracts the port number from a hidden property of the input service Entity.

The port numbers visible to the user in the Entity properties should not be manually modified.


To Reverse DNS Lookup [Shodan]

Transform Meta Info

Display Name

To Reverse DNS Lookup [Shodan]

Transform Name

maltego.shodan.ipv4AddressToReverseDns

Short Description

Returns the reverse DNS lookup hostname of the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the last recorded reverse DNS lookup of the input IPv4 Address.


To Services [Shodan]

Transform Meta Info

Display Name

To Services [Shodan]

Transform Name

maltego.shodan.ipv4addresstoservice

Short Description

Returns the services found on the IPv4 Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.Service

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the last recorded services found on the input IPv4 Address.


To Services [Shodan]

Transform Meta Info

Display Name

To Services [Shodan]

Transform Name

maltego.shodan.ipv6AddressToServices

Short Description

Returns the services found on the IPv6 Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.Service

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the last recorded services found on the input IPv6 Address.


To Subdomains (+ Historical) [Shodan]

Transform Meta Info

Display Name

To Subdomains (+ Historical) [Shodan]

Transform Name

maltego.shodan.dnsNameToHistoricalDnsNames

Short Description

Returns the live and historical Subdomains associated with the input DNS name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the live and historical Subdomains that were active under the input DNS name hierarchy.


To Subdomains (+ Historical) [Shodan]

Transform Meta Info

Display Name

To Subdomains (+ Historical) [Shodan]

Transform Name

maltego.shodan.domainToHistoricalDnsNames

Short Description

Returns the live and historical Subdomains associated with the input Domain name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the live and historical Subdomains that were active under the input Domain name hierarchy.


To Subdomains [Shodan]

Transform Meta Info

Display Name

To Subdomains [Shodan]

Transform Name

maltego.shodan.dnsNameToDnsNames

Short Description

Returns all the sub domains of the input DNS Name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the last recorded Subdomains that were active under the input DNS Name hierarchy.


To Subdomains [Shodan]

Transform Meta Info

Display Name

To Subdomains [Shodan]

Transform Name

maltego.shodan.domaintodnsname

Short Description

Returns the Subdomains associated with the input Domain name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.DNSName

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the last recorded Subdomains that were active under the input Domain name hierarchy.


To Tags [Shodan]

Transform Meta Info

Display Name

To Tags [Shodan]

Transform Name

maltego.shodan.dnsNameToTags

Short Description

Returns the tags assigned by Shodan to the main Domain of the input DNS Name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.DNSName

Output Entity(s)

maltego.shodan.Tag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the tags assigned by Shodan to the main Domain of the input DNS Name.


For example, if the input DNS Name is ghs.google.com, the Transform will return the tags that are assigned to google.com by Shodan.


For any subdomains that are under google.com or any subdomains of ghs.google.com, the Transform will return the Tags assigned to the main domain google.com.


To Tags [Shodan]

Transform Meta Info

Display Name

To Tags [Shodan]

Transform Name

maltego.shodan.domainToTags

Short Description

Returns the tags assigned by Shodan to the main Domain name of the input Domain name.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Domain

Output Entity(s)

maltego.shodan.Tag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns the tags assigned by Shodan to the main Domain name of the input Domain name.


For example, if the input domain name is ghs.google.com, the Transform will return the tags that are assigned to google.com by Shodan.


For any subdomains that are under google.com or any subdomains of ghs.google.com, the Transform will return the Tags assigned to the main domain google.com.


To Tags [Shodan]

Transform Meta Info

Display Name

To Tags [Shodan]

Transform Name

maltego.shodan.ipv4AddressToTags

Short Description

Returns the tags assigned by Shodan to the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.shodan.Tag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the tags that are assigned by Shodan to the input IPv4 Address.


To Tags [Shodan]

Transform Meta Info

Display Name

To Tags [Shodan]

Transform Name

maltego.shodan.ipv6AddressToTags

Short Description

Returns the tags assigned by Shodan to the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.shodan.Tag

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the tags that are assigned by Shodan to the input IPv6 Address.


To Vulnerabilities [Shodan]

Transform Meta Info

Display Name

To Vulnerabilities [Shodan]

Transform Name

maltego.shodan.ipv4AddressToVulnerabilities

Short Description

Returns the CVEs found on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv4Address

Output Entity(s)

maltego.CVE

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the CVEs with which the input IPv4 Address is potentially affected with.


To Vulnerabilities [Shodan]

Transform Meta Info

Display Name

To Vulnerabilities [Shodan]

Transform Name

maltego.shodan.ipv6AddressToVulnerabilities

Short Description

Returns the CVEs found on the input IP Address.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.IPv6Address

Output Entity(s)

maltego.CVE

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the CVEs with which the input IPv6 Address is potentially affected with.


To Vulnerabilities [Shodan]

Transform Meta Info

Display Name

To Vulnerabilities [Shodan]

Transform Name

maltego.shodan.serviceToCves

Short Description

Returns all the CVEs found on the input service.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.shodan.ServiceDetails

Output Entity(s)

maltego.IPv4Address,maltego.IPv6Address

 

Transform Inputs

Not applicable.


Description

This Transform extracts the CVEs from a hidden property of the input service Entity indicating that the IP Address on which this service was found is affected with the returned CVEs.


To Vulnerable IP Addresses [Shodan]

Transform Meta Info

Display Name

To Vulnerable IP Addresses [Shodan]

Transform Name

maltego.shodan.cidrToVulnerableIpAddresses

Short Description

Returns all the Vulnerable IP Addresses within the netblock.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.CIDR

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the IP Addresses which were marked by Shodan to be affected with at lease one CVE from the input subnet.


It is recommended to use shorter subnets at a time since a large subnet may have overwhelming number of vulnerable IP Addresses.


To Vulnerable IP Addresses [Shodan]

Transform Meta Info

Display Name

To Vulnerable IP Addresses [Shodan]

Transform Name

maltego.shodan.cveToIpAddresses

Short Description

Return the IP Addresses on which the input CVE is found.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.CVE

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

cidr

string

 

False

True

False

Netblock CIDR

hostname

string

 

False

True

True

Hostname

org

string

 

False

True

True

Organization

isp

string

 

False

True

True

ISP

raw

string

 

False

True

True

Raw Search

ssl

string

 

False

True

True

SSL

 

Description

This Transform returns all the IP Addresses from Shodan that are potentially affected by the input CVE.


It is recommended to use filters and shorter subnets at a time since Shodan may have recorded overwhelming number of IP Addresses vulnerable with the input CVE.


To Vulnerable IP Addresses [Shodan]

Transform Meta Info

Display Name

To Vulnerable IP Addresses [Shodan]

Transform Name

maltego.shodan.netblockToVulnerableIpAddresses

Short Description

Returns all the Vulnerable IP Addresses within the netblock.

Data Source

Shodan

Owner

<Maltego Technologies GmbH>

Author

<dev@maltego.com>

Input Entity

maltego.Netblock

Output Entity(s)

maltego.IPv4Address, maltego.IPv6Address

 

Transform Inputs

Setting Name

Setting type

Default Value

Optional

Popup

Auth

Setting Display Name

apiKey

string

 

False

True

True

Shodan API Key

 

Description

This Transform returns all the IP Addresses within the input subnet that is potentially affected by at lease one CVE.


It is recommended to use shorter subnets at a time since a large subnet may have overwhelming number of vulnerable IP Addresses.

Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.