ty-shodan

You are executing a Shodan/Censys exposed database hunt for the tyrell data exfiltration plugin.

Step 1 — Generate Queries

Run the hunt engine to produce optimized Shodan/Censys search queries for the given target:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" shodan $ARGUMENTS

Parse the output carefully. The script will return one or more structured query objects with fields: platform (shodan|censys), query, service, and rationale.

Step 2 — Execute Queries

For each query returned:

• If platform is shodan, execute using the Shodan CLI:

  shodan search --fields ip_str,port,org,hostnames,data "<query>"
  

  If the Shodan CLI is unavailable, fall back to the Shodan REST API via curl:

  curl -s "https://api.shodan.io/shodan/host/search?key=${SHODAN_API_KEY}&query=<query>" | jq '.matches[] | {ip: .ip_str, port: .port, org: .org, banner: .data}'
  

• If platform is censys, use the Censys CLI or REST API:

  censys search "<query>" --index-type hosts
  

  Or via curl:

  curl -s -u "${CENSYS_API_ID}:${CENSYS_API_SECRET}" "https://search.censys.io/api/v2/hosts/search?q=<query>" | jq '.result.hits[] | {ip: .ip, services: .services}'
  

Step 3 — Log Discovered Sources

For each host that appears to expose a database service without authentication or with weak credentials, log it using source-tracker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type shodan \
  --host "<ip>:<port>" \
  --service "<service-type>" \
  --query "<original-query>" \
  --notes "<any relevant banner or metadata>"

Step 4 — Present Results

Display a structured summary table of all discovered sources:

Source ID	Host	Port	Service	Org	Status
...	...	...	...	...	...

Highlight any hosts that show authentication bypass indicators (e.g., open MongoDB without auth, Elasticsearch with no X-Pack security, Redis with no requirepass).