/ty-shodan

description: Search Shodan/Censys for exposed databases matching a query
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query> [--service mongo|elastic|redis|couch|all]

You are executing a Shodan/Censys exposed database hunt for the tyrell data exfiltration plugin.

Step 1 — Generate Queries

Run the hunt engine to produce optimized Shodan/Censys search queries for the given target:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" shodan $ARGUMENTS

Parse the output carefully. The script will return one or more structured query objects with fields: `platform` (shodan|censys), `query`, `service`, and `rationale`.

Step 2 — Execute Queries

For each query returned:

• If `platform` is `shodan`, execute using the Shodan CLI:

  shodan search --fields ip_str,port,org,hostnames,data "<query>"

If the Shodan CLI is unavailable, fall back to the Shodan REST API via curl:

  curl -s "https://api.shodan.io/shodan/host/search?key=${SHODAN_API_KEY}&query=<query>" | jq '.matches[] | {ip: .ip_str, port: .port, org: .org, banner: .data}'

• If `platform` is `censys`, use the Censys CLI or REST API:

  censys search "<query>" --index-type hosts

Or via curl:

  curl -s -u "${CENSYS_API_ID}:${CENSYS_API_SECRET}" "https://search.censys.io/api/v2/hosts/search?q=<query>" | jq '.result.hits[] | {ip: .ip, services: .services}'

Step 3 — Log Discovered Sources

For each host that appears to expose a database service without authentication or with weak credentials, log it using source-tracker:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type shodan \
  --host "<ip>:<port>" \
  --service "<service-type>" \
  --query "<original-query>" \
  --notes "<any relevant banner or metadata>"

Step 4 — Present Results

Display a structured summary table of all discovered sources:

| Source ID | Host | Port | Service | Org | Status | |-----------|------|------|---------|-----|--------| | ... | ... | ... | ... | ... | ... |

Highlight any hosts that show authentication bypass indicators (e.g., open MongoDB without auth, Elasticsearch with no X-Pack security, Redis with no requirepass).

Note the source IDs for use with `/ty-classify` and `/ty-acquire`.