# Shomon | Shodan Monitoring Integration For TheHive

**URL:** <https://onehack.st/t/shomon-shodan-monitoring-integration-for-thehive/227585>\
**Category:** Tools & Scripts\
**Tags:** tools, programming, freebies\
**Created:** [October 27, 2022, 9:32pm UTC](https://onehack.st/t/shomon-shodan-monitoring-integration-for-thehive/227585 "2022-10-27T21:32:58Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [October 27, 2022, 9:32pm UTC](https://onehack.st/t/shomon-shodan-monitoring-integration-for-thehive/227585/1 "2022-10-27T21:32:58Z")

</div>

[![](https://github.com/KaanSK/shomon/raw/master/images/logo.png)](https://github.com/KaanSK/shomon/blob/master/images/logo.png)

[![](https://camo.githubusercontent.com/42f52fab9eb8c5f742d90e43359bd76ce6620c54f2295aabce639b70c786ff78/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f4b61616e534b2f73686f6d6f6e)](https://camo.githubusercontent.com/42f52fab9eb8c5f742d90e43359bd76ce6620c54f2295aabce639b70c786ff78/68747470733a2f2f676f7265706f7274636172642e636f6d2f62616467652f6769746875622e636f6d2f4b61616e534b2f73686f6d6f6e) [![](https://camo.githubusercontent.com/3ff59d6c5e15cbfc3b252c001d8dd7ea15a04a8ffb97c78ad41d9bda3136aa8b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f646f776e6c6f6164732f6b61616e736b2f73686f6d6f6e2f746f74616c3f636f6c6f723d253233334142453235266c6162656c3d52656c65617365253230446f776e6c6f616473)](https://camo.githubusercontent.com/3ff59d6c5e15cbfc3b252c001d8dd7ea15a04a8ffb97c78ad41d9bda3136aa8b/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f646f776e6c6f6164732f6b61616e736b2f73686f6d6f6e2f746f74616c3f636f6c6f723d253233334142453235266c6162656c3d52656c65617365253230446f776e6c6f616473) [![](https://camo.githubusercontent.com/92f397cad4aa4bd16df66de3064456dbf19f4ba09f0de81c4522bf36d33ec189/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f70756c6c732f6b61616e736b2f73686f6d6f6e3f636f6c6f723d253233334142453235266c6162656c3d446f636b657248756225323050756c6c73)](https://camo.githubusercontent.com/92f397cad4aa4bd16df66de3064456dbf19f4ba09f0de81c4522bf36d33ec189/68747470733a2f2f696d672e736869656c64732e696f2f646f636b65722f70756c6c732f6b61616e736b2f73686f6d6f6e3f636f6c6f723d253233334142453235266c6162656c3d446f636b657248756225323050756c6c73)

ShoMon is a Shodan alert feeder for TheHive written in GoLang. With version 2.0, it is more powerful than ever!

# Functionalities

- Can be used as Webhook OR Stream listener
  - Webhook listener opens a restful API endpoint for Shodan to send alerts. This means you need to make this endpoint available to public net
  - Stream listener connects to Shodan and fetches/parses the alert stream

- Utilizes [shadowscatcher/shodan](https://github.com/shadowscatcher/shodan) (fantastic work) for Shodan interaction.
- Console logs are in JSON format and can be ingested by any other further log management tools
- CI/CD via Github Actions ensures that a proper Release with changelogs, artifacts, images on ghcr and dockerhub will be provided
- Provides a working [docker-compose file](https://github.com/KaanSK/shomon/blob/master/docker-compose.yml) file for TheHive, dependencies
- Super fast and Super mini in size
- Complete code refactoring in v2.0 resulted in more modular, maintainable code
- Via conf file or environment variables alert specifics including tags, type, alert-template can be dynamically adjusted. See [config file](https://github.com/KaanSK/shomon/blob/master/conf.yaml).
- Full banner can be included in Alert with direct link to Shodan Finding.[![Alert example](https://github.com/KaanSK/shomon/raw/master/images/alert.png)](https://github.com/KaanSK/shomon/blob/master/images/alert.png)
- IP is added to observables[![Observable example](https://github.com/KaanSK/shomon/raw/master/images/observable.png)](https://github.com/KaanSK/shomon/blob/master/images/observable.png)

# Usage

- Parameters should be provided via `conf.yaml` or environment variables. Please see [config file](https://github.com/KaanSK/shomon/blob/master/conf.yaml) and [docker-compose file](https://github.com/KaanSK/shomon/blob/master/docker-compose.yml)
- After conf or environment variables are set simply issue command:`./shomon`

## Notes

- Alert reference is first 6 chars of md5(“ip:port”)
- Only 1 mod can be active at a time. Webhook and Stream listener can not be activated together.

# Setup & Compile Instructions

## Get latest compiled binary from releases

1. Check [Releases](https://github.com/KaanSK/shomon/releases/latest) section.

## Compile from source code

1. Make sure that you have a working Golang workspace.
2. `go build .`

- `go build -ldflags="-s -w" .` could be used to customize compilation and produce smaller binary.

## Using Public Container Registries

1. Thanks to new CI/CD integration, latest versions of built images are pushed to ghcr, DockerHub and can be utilized via:

- `docker pull ghcr.io/kaansk/shomon`
- `docker pull kaansk/shomon`

## Using [Dockerfile](https://github.com/KaanSK/shomon/blob/master/Dockerfile)

1. Edit [config file](https://github.com/KaanSK/shomon/blob/master/conf.yaml) or provide environment variables to commands bellow
2. `docker build -t shomon .`
3. `docker run -it shomon`

## Using [docker-compose file](https://github.com/KaanSK/shomon/blob/master/docker-compose.yml)

1. Edit environment variables and configurations in [docker-compose file](https://github.com/KaanSK/shomon/blob/master/docker-compose.yml)
2. `docker-compose run -d`

# Credits

- Logo Made via [LogoMakr.com](http://LogoMakr.com)
- [shadowscatcher/shodan](https://github.com/shadowscatcher/shodan)
- [Dockerfile Reference](https://www.cloudreach.com/en/resources/blog/cts-build-golang-dockerfiles/)
- Release management with [GoReleaser](https://goreleaser.com/)

## GitHub:

[https://github.com/KaanSK/shomon](https://github.com/KaanSK/shomon)