Skip to content

[draft]tools/shodan#12

Draft
JackBekket wants to merge 5 commits intomasterfrom
tools/shodan
Draft

[draft]tools/shodan#12
JackBekket wants to merge 5 commits intomasterfrom
tools/shodan

Conversation

@JackBekket
Copy link
Collaborator

dig and internet_db tools (domain - ip lookup)

shodan search tool

I need tests for those tools

@JackBekket JackBekket requested a review from mintyleaf November 12, 2025 14:54
@mintyleaf mintyleaf marked this pull request as draft November 12, 2025 15:22
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can't that be done using just a webReader tool?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably, didn't tested it

http.DefaultClient,
true, // use API v1
)
//ctx = context.Background()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fuck, my bad, yes, it should be Shodan_key from config

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, yet idk how i feel about excessive autogenerated comments

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it could be removed unless necessary

"query": map[string]any{
"type": "object",
"properties": map[string]any{
"domain": map[string]any{"type": "string"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

// The actual search term
"query": map[string]any{
"type": "object",
"properties": map[string]any{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there is a lot more properties, see https://github.com/shadowscatcher/shodan/blob/master/search/query.go

they are NOT JSON compatible (most of them can be converted without tags, but that's unreliable to do)

"type": "object",
"properties": map[string]any{
"domain": map[string]any{"type": "string"},
"product": map[string]any{"type": "string"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lack of description field (which can be just copy-pasted from https://github.com/shadowscatcher/shodan/blob/master/search/query.go) results as lack of context for llm to generate tool call

client, _ := shodanclient.GetClient(
os.Getenv("SHODAN_API_KEY"), // <-- your key
http.DefaultClient,
true, // use API v1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -66,11 +71,24 @@ func main() {

fmt.Println(rhost, lhost)

//return
shodan_key, exists := os.LookupEnv("SHDN_KEY")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that is clearly not the local for example variable and should be used in shodan tool initialization


// 2. Build a client – the library expects an API key in an env var.
client, _ := shodanclient.GetClient(
os.Getenv("SHODAN_API_KEY"), // <-- your key
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

api key from the ShodanTool should be put there

// -------------------------------------------------------------------
// 3️⃣ Tool type (empty; only used for method receiver).
// -------------------------------------------------------------------
type ShodanTool struct{}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the place for the APIKey storage, which can be initialized in init() function

if cfg.ShodanDisable {
return nil, nil
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cfg already have Shodan_key field (do not use underscores in go), and it should be passed to ShodanTool{} here, with error return if it's empty (see semantic search for example)

// -------------------------------------------------------------------
func (s ShodanTool) Call(ctx context.Context, input string) (string, error) {
// 1. Unmarshal incoming JSON into our args struct
shodanArgs := ShodanToolArgs{}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sadly shodan query structure is no meant to be json serialized at all


// const Prompt = ` Please scan %s for open ports and generate Metasploit search queries for any found services. Firstly try to use nmap with only -F argument. After that try to continiously exploit target, using %s as LHOST and target address as RHOST and module(s) found from metasploit search. Use cmd/unix/reverse as payload.'`
const Prompt = ` Please lookup for IP of %s. You can use different tools such as dig, internetdb and shodan to find out IP addresses of target. Then try to use nmap with only -F argument for each of found addresses if any. After that create metasploit queries for each of found open ports if any using msf_search tool.`
const Prompt = ` Please lookup for IP of %s. You can use different tools such as dig, internetdb and shodan to find out IP addresses of target.Always try to use dig using command caller first. Then try to process whatever result is returned from dig and if there are any IP's then try to use nmap with those IP. DO not forget that nmap accept only correct IP addresses foramt so do not forget to sanitize dig output first. Then try to use nmap with only -F argument for each of found addresses if any.`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a lot of typos here!

const Prompt = ` Please lookup for IP of %s. You can use different tools such as dig, internetdb and shodan to find out IP addresses of target.Always try to use dig using command caller first. Then try to process whatever result is returned from dig and if there are any IP's then try to use nmap with those IP. DO not forget that nmap accept only correct IP addresses foramt so do not forget to sanitize dig output first. Then try to use nmap with only -F argument for each of found addresses if any.`

type NmapToolArgs struct {
type NmapToolArgs struct { // ??? -- it should not be here
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, seems like the remains of copypasting

Copy link
Contributor

@mintyleaf mintyleaf left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

examples is not agents
this is still examples, and that library meant to be used inside completely another project to do actual agent

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants