Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Create GIFs from a Shodan json.gz file using the API
#!/usr/bin/env python
# Dependencies:
# - arrow
# - shodan
# - ImageMagick
# Installation:
# sudo easy_install arrow shodan
# sudo apt-get install imagemagick
# Usage:
# 1. Download a json.gz file using the website or the Shodan command-line tool (
# shodan download screenshots.json.gz has_screenshot:true
# 2. Run the tool on the file:
# python screenshots.json.gz
# 3. The GIFs will be stored in the local "data" directory
import arrow
import os
import shodan
import shodan.helpers as helpers
import sys
# Settings
API_KEY = ''
MIN_SCREENS = 5 # Number of screenshots that Shodan needs to have in order to make a GIF
if len(sys.argv) != 2:
print('Usage: {} <shodan-data.json.gz>'.format(sys.argv[0]))
# GIFs are stored in the local "data" directory
# We need to connect to the API to lookup the historical host information
api = shodan.Shodan(API_KEY)
for result in helpers.iterate_files(sys.argv[1]):
# Get the historic info
host =['ip_str'], history=True)
# Count how many screenshots this host has
screenshots = []
for banner in host['data']:
if 'opts' in banner and 'screenshot' in banner['opts']:
timestamp = arrow.get(banner['timestamp']).time()
sort_key = timestamp.hour
if len(screenshots) >= MAX_SCREENS:
# Extract the screenshots and turn them into a GIF if we've got the necessary
# amount of images.
if len(screenshots) >= MIN_SCREENS:
for (i, screenshot) in enumerate(sorted(screenshots, key=lambda x: x[0], reverse=True)):
open('/tmp/gif-image-{}.jpg'.format(i), 'w').write(screenshot[1].decode('base64'))
os.system('convert -layers OptimizePlus -delay 5x10 /tmp/gif-image-*.jpg -loop 0 +dither -colors 256 -depth 8 data/{}.gif'.format(result['ip_str']))
# Clean up the temporary files
os.system('rm -f /tmp/gif-image-*.jpg')
# Show a progress indicator
print result['ip_str']
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.