Kali Linux

Shomon : Shodan Monitoring Integration For TheHive

ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever!

Functionalities

  • Can be used as Webhook OR Stream listener
    • Webhook listener opens a restful API endpoint for Shodan to send alerts. This means you need to make this endpoint available to public net
    • Stream listener connects to Shodan and fetches/parses the alert stream
  • Utilizes shadowscatcher/shodan (fantastic work) for Shodan interaction.
  • Console logs are in JSON format and can be ingested by any other further log management tools
  • CI/CD via Github Actions ensures that a proper Release with changelogs, artifacts, images on ghcr and dockerhub will be provided
  • Provides a working docker-compose file file for TheHive, dependencies
  • Super fast and Super mini in size
  • Complete code refactoring in v2.0 resulted in more modular, maintainable code
  • Via conf file or environment variables alert specifics including tags, type, alert-template can be dynamically adjusted. See config file.
  • Full banner can be included in Alert with direct link to Shodan Finding.

IP is added to observables

Usage

  • Parameters should be provided via conf.yaml or environment variables. Please see config file and docker-compose file
  • After conf or environment variables are set simply issue command: ./shomon

Notes

  • Alert reference is first 6 chars of md5(“ip:port”)
  • Only 1 mod can be active at a time. Webhook and Stream listener can not be activated together.

Setup & Compile Instructions

Get latest compiled binary from releases

  1. Check Releases section.

Compile from source code

  1. Make sure that you have a working Golang workspace.
  2. go build .
    • go build -ldflags="-s -w" . could be used to customize compilation and produce smaller binary.

Using Public Container Registries

  1. Thanks to new CI/CD integration, latest versions of built images are pushed to ghcr, DockerHub and can be utilized via:
    • docker pull ghcr.io/kaansk/shomon
    • docker pull kaansk/shomon

Using Dockerfile

  1. Edit config file or provide environment variables to commands bellow
  2. docker build -t shomon .
  3. docker run -it shomon

Using docker-compose file

  1. Edit environment variables and configurations in docker-compose file
  2. docker-compose run -d
R K

Recent Posts

The Growing Role of Digital Libraries in Remote Education

Learning Without Walls Remote education has long been a lifeline for students in rural areas…

3 days ago

How Do I Do Reverse Image Search

Have you ever come across a picture on the internet and wondered where it came…

3 days ago

WhatsMyName App – Find Anyone Across 640+ Platforms

Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…

2 weeks ago

Analyzing Directory Size Linux Tools Explained

Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…

2 weeks ago

Understanding Disk Usage with du Command

Efficient disk space management is vital in Linux, especially for system administrators who manage servers…

2 weeks ago

How to Check Directory Size in Linux

Knowing how to check directory sizes in Linux is essential for managing disk space and…

2 weeks ago