🔍 My Shodan + Black Hat Python Journey: Internet-Scale Reconnaissance & Offensive Security Automation

$ cat table_of_contents.txt

📖 My Journey So Far
🎯 What I Wanted to Accomplish
🛠️ What I Built and How I Did It
📚 How I Map Shodan to Each Black Hat Python Chapter
💻 My Tools I Created Today
🔐 My Query Examples for Practice
🚨 My Security Practices
📊 How I Track My Credits
🎓 My Learning Path
✅ Where I’m At Now
🚀 My Next Steps
📁 My Project Structure
🎯 My Final Thoughts

📖 My Journey So Far

Today, I set out to bridge the gap between the local network hacking techniques in Black Hat Python and the vast internet-wide data available through Shodan. What I built is a complete, working environment that lets me discover targets globally and apply the book’s offensive security techniques in real-world scenarios.

🎯 What I Wanted to Accomplish

My goal: Transform theoretical Python security techniques into internet-scale reconnaissance and attack automation tools.

I wanted to stop practicing only on my local network and start using Shodan’s massive device database as my intelligence feed. Here’s why:

Before Shodan	After Shodan
I could only test on my own network	I can discover millions of targets globally
I had to manually find targets	Automated queries find targets for me
My reconnaissance was limited	Full internet visibility
I was just learning theories	I can practice on real-world data
Small sample sizes	Diverse, real-world data for practice

🛠️ What I Built and How I Did It

My Environment Setup

I created a dedicated Conda-based Python 3.13 environment (bhp) with everything isolated:

Key Components:

Python Environment: miniforge3 with Python 3.13
Core Libraries: scapy, requests, paramiko, pycryptodome, beautifulsoup4
Shodan Integration: Official shodan Python library
Path Management: Custom wrapper (~/bhp-python) to force the correct site-packages

My Workflow

Here’s how Shodan feeds into my Black Hat Python toolkit:

text

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────────┐
│  Shodan Query   │───▶│  Target Discovery│───▶│  BHP Attack Module  │
│  (API Search)   │    │  (IP/Port List)  │    │  (Exploitation)     │
└─────────────────┘    └──────────────────┘    └─────────────────────┘
         │                       │                         │
         ▼                       ▼                         ▼
   "port:22"  ────────▶   SSH Servers List ──────▶  Paramiko SSH Client
   "port:53"  ────────▶   DNS Servers List ──────▶  Scapy DNS Attack
   "product:Apache" ──▶  Web Servers List ──────▶  Requests Web Hacking

📚 How I Map Shodan to Each Black Hat Python Chapter

BHP Chapter	Topic	My Shodan Integration
Chapter 2	TCP/UDP Clients	I replace local port scanning with Shodan’s global port data
Chapter 3	Raw Sockets	I use Shodan to find targets for packet crafting
Chapter 4	Scapy	I find DNS servers with recursion enabled for amplification attacks
Chapter 5	Web Hacking	I discover web servers with specific versions/vulnerabilities
Chapter 6	Wireshark Dissection	I analyze Shodan banner data with dpkt
Chapter 7	Command & Control	I identify potential C2 infrastructure
Chapter 8	Trojans	I find targets with vulnerable services
Chapter 9	Exfiltration	I discover hosts with open data ports
Chapter 10	Privilege Escalation	I identify misconfigured services
Chapter 11	Windows Fun	I find Windows-based targets

💻 My Tools I Created Today

1. `~/bhp-python` – My Environment Wrapper

This forces Python to use the correct site-packages, bypassing all the anaconda3 conflicts I was fighting.

bash

~/bhp-python script.py

2. `bhp-shodan` – My Custom Shodan CLI

I built this to work without pkg_resources (which was causing issues in Python 3.13).

bash

bhp-shodan info                 # Check my credits
bhp-shodan host 1.1.1.1        # Host lookup
bhp-shodan search "port:53" 5  # Search for targets

3. `shodan_working.py` – My Full Recon Script

This combines host lookup, DNS search, and web server discovery in one tool.

4. `shodan_tool.py` – My Quick IP Scanner

A simple command-line tool to get info for any IP I want to investigate.

5. `shodan_batch.py` – My Batch Search Tool

Predefined searches for common services (SSH, DNS, Web, etc.) so I can quickly find targets.

🔐 My Query Examples for Practice

For Chapter 2: TCP/UDP Clients

python

# Find SSH servers for connection testing
results = api.search('port:22')

For Chapter 4: Scapy – DNS Amplification

python

# Find DNS servers with recursion enabled
results = api.search('port:53 dns.recursion:enabled')

For Chapter 5: Web Hacking

python

# Find vulnerable Apache versions
results = api.search('product:Apache "2.4.49"')

For Chapter 7-8: Command & Control

python

# Find potential C2 infrastructure
results = api.search('port:443 org:Amazon')

🚨 My Security Practices

Aspect	My Approach
API Key Security	I never share my keys; they live in `~/.config/shodan/config.py` with 600 permissions
Legal Compliance	I only scan/attack systems I own or have explicit permission to test
Rate Limits	Free tier gives me 100 queries/month; I track usage with `api.info()`
Ethical Use	I use this for learning, defense, and authorized penetration testing only

📊 How I Track My Credits

python

api = shodan.Shodan(API_KEY)
info = api.info()
print(f"Query credits: {info.get('query_credits', 0)}")

What Each Operation Costs Me

Operation	Credits Used
`api.search()`	1 per query (up to 100 results)
`api.host()`	1 per IP (sometimes free)
`api.count()`	0 (free – I use this to check before searching)
`api.stats()`	1 per query

🎓 My Learning Path

Beginner: I run pre-built scripts to understand Shodan data
Intermediate: I modify queries to find specific targets I’m interested in
Advanced: I’m building custom BHP tools that use Shodan data dynamically
Expert: I’m working toward creating automated reconnaissance-to-exploitation pipelines

✅ Where I’m At Now

Component	Status	Notes
Python Environment	✅ Working	miniforge3, Python 3.13
All BHP Packages	✅ Installed	scapy, requests, paramiko, etc.
Shodan Library	✅ Working	v1.31.0
Shodan CLI	✅ Working	Mock pkg_resources fixed it
Custom Wrapper	✅ Working	`~/bhp-python`
API Key	⚠️ Needs Update	0 credits – I need a fresh key

🚀 My Next Steps

Get a fresh Shodan API key from https://account.shodan.io/
Update my config: nano ~/.config/shodan/config.py
Test: ~/bhp-python -m shodan search port:80 --limit 1
Start Chapter 2: Build TCP client with Shodan-discovered targets
Work through each chapter: Apply Shodan intelligence to every BHP technique

📁 My Project Structure

text

~/bhp-projects/
├── shodan_final.py          # My complete reconnaissance script
├── shodan_working.py        # Working version with API
├── shodan_tool.py           # Quick IP scanner
├── shodan_batch.py          # Batch search tool
├── shodan_simple.py         # Simple search interface
├── shodan_complete.py       # All-in-one tool
├── recon_tool.py            # Reconnaissance tool
├── simple_scanner.py        # Basic port scanner
└── test_shodan_import.py    # Environment verification

~/bin/
└── bhp-shodan               # My custom Shodan CLI wrapper

~/.config/shodan/
└── config.py                # My API key storage (chmod 600)

🎯 My Final Thoughts

“Shodan turns Black Hat Python from a local testing framework into a global offensive security platform. With Shodan’s data and Python’s flexibility, I can build tools that discover, analyze, and test millions of devices across the internet – all from my command line.”

This integration lets me:

Think globally about security threats
Practice on real-world data (legally and ethically)
Automate reconnaissance at scale
Build tools that bridge the gap between intelligence and action

My environment is ready. I just need to get my new API key and start exploring the internet’s attack surface with Black Hat Python! 🐍🔍

📖 My Journey So Far

🎯 What I Wanted to Accomplish

🛠️ What I Built and How I Did It

My Environment Setup

My Workflow

📚 How I Map Shodan to Each Black Hat Python Chapter

💻 My Tools I Created Today

1. ~/bhp-python – My Environment Wrapper

2. bhp-shodan – My Custom Shodan CLI

3. shodan_working.py – My Full Recon Script

4. shodan_tool.py – My Quick IP Scanner

5. shodan_batch.py – My Batch Search Tool

🔐 My Query Examples for Practice

For Chapter 2: TCP/UDP Clients

For Chapter 4: Scapy – DNS Amplification

For Chapter 5: Web Hacking

For Chapter 7-8: Command & Control

🚨 My Security Practices

📊 How I Track My Credits

What Each Operation Costs Me

🎓 My Learning Path

✅ Where I’m At Now

🚀 My Next Steps

📁 My Project Structure

🎯 My Final Thoughts

1. `~/bhp-python` – My Environment Wrapper

2. `bhp-shodan` – My Custom Shodan CLI

3. `shodan_working.py` – My Full Recon Script

4. `shodan_tool.py` – My Quick IP Scanner

5. `shodan_batch.py` – My Batch Search Tool