Cybersecurity Asset Management Tool
Budget: $5,000 – $10,000 AUD
Shodan ASM Dashboard
A React-based tool to visualize, analyze, and manage internet-facing assets using Shodan's API.
Objectives
Identify and map an organization’s external attack surface using Shodan data.
Provide actionable insights to reduce exposure (open ports, services, vulnerabilities).
Offer a user-friendly interface for security teams to monitor assets.
Core Features
1. Asset Discovery & Inventory
Shodan Host Search:
Search for assets by IP, domain, or ASN.
Display metadata (open ports, services, banners, geolocation).
Tagging System:
Label assets (e.g., "Production," "Critical," "Retired").
Filter assets by tags, risk level, or service type.
2. Vulnerability Detection
CVE Lookup Integration:
Cross-reference Shodan data with CVE databases (e.g., NVD).
Highlight CVSS scores and exploitability.
Risk Scoring:
Auto-calculate risk scores based on open ports, services, and vulnerabilities.
3. Reporting & Alerts
Custom Reports:
Generate PDF/CSV reports for stakeholders.
Include trends (e.g., new open ports over time).
Alerting System:
Notify users via email/Slack when high-risk assets are detected.
4. Dashboard & Visualization
Interactive Map:
Plot asset locations using Shodan’s geolocation data.
Charts & Graphs:
Visualize top open ports, service distributions, and risk trends.
Search & Filters:
Advanced search by IP range, port, or vulnerability.
5. API Integration
Shodan API Endpoints:
/shodan/host/{ip}: Fetch detailed host data.
/shodan/scan: Trigger on-demand Shodan scans.
/shodan/alert: Manage network monitoring alerts.
Technical Requirements
Frontend (React)
State Management: Redux or React Context API.
UI Libraries:
Material-UI or Ant Design for components.
Recharts/Chart.js for visualizations.
Leaflet/React-Leaflet for maps.
Authentication: JWT-based login with role-based access (admin/user).
Backend (Proxy Server)
Node.js/Express:
Proxy requests to Shodan API to avoid exposing API keys in the frontend.
Rate limiting to comply with Shodan’s API limits (1 request/second).
Security:
Store Shodan API keys in AWS Secrets Manager or environment variables.
Validate user input to prevent SSRF or injection attacks.
Database (Optional)
PostgreSQL:
Store user-generated data (tags, reports, alerts).
Cache frequently accessed Shodan data (with TTL).
Security & Compliance
API Key Management:
Never expose Shodan API keys in the frontend or client-side code.
Use a backend proxy for all Shodan API calls.
Data Privacy:
Anonymize sensitive data (e.g., IPs) in reports shared externally.
Encrypt database fields containing asset metadata.
Rate Limiting:
Enforce Shodan’s API limits to avoid IP bans.
User Permissions:
Role-based access control (RBAC): Admins vs. read-only users.
Audit logs for user actions (e.g., scans triggered, reports exported).
Shodan API Integration
Key Endpoints
Endpoint Purpose
GET /shodan/host/{ip} Fetch host details (ports, banners, CVEs).
GET /shodan/host/count Count devices matching a query (e.g., apache).
POST /shodan/scan Initiate a new scan for an IP/network.
GET /shodan/alert/info List active monitoring alerts.
Example Workflow
User searches for acme.com in the React app.
Frontend sends a request to the backend proxy.
Backend fetches data from Shodan’s /shodan/host endpoint using the stored API key.
Data is sanitized and returned to the frontend for display.
Ethical & Legal Considerations
Authorized Use Only: Ensure the tool is only used for assets owned by the organization.
Shodan Compliance: Adhere to Shodan’s API Terms of Service.
Data Retention: Automatically delete cached Shodan data after 30 days.
Deliverables
React frontend with dashboard, asset inventory, and reporting.
Node.js proxy backend with secure API key handling.
Documentation:
User guide for security teams.
API integration manual.
Incident response plan for false positives/negatives.
Add multi Tenancy to the portal
A React-based tool to visualize, analyze, and manage internet-facing assets using Shodan's API.
Objectives
Identify and map an organization’s external attack surface using Shodan data.
Provide actionable insights to reduce exposure (open ports, services, vulnerabilities).
Offer a user-friendly interface for security teams to monitor assets.
Core Features
1. Asset Discovery & Inventory
Shodan Host Search:
Search for assets by IP, domain, or ASN.
Display metadata (open ports, services, banners, geolocation).
Tagging System:
Label assets (e.g., "Production," "Critical," "Retired").
Filter assets by tags, risk level, or service type.
2. Vulnerability Detection
CVE Lookup Integration:
Cross-reference Shodan data with CVE databases (e.g., NVD).
Highlight CVSS scores and exploitability.
Risk Scoring:
Auto-calculate risk scores based on open ports, services, and vulnerabilities.
3. Reporting & Alerts
Custom Reports:
Generate PDF/CSV reports for stakeholders.
Include trends (e.g., new open ports over time).
Alerting System:
Notify users via email/Slack when high-risk assets are detected.
4. Dashboard & Visualization
Interactive Map:
Plot asset locations using Shodan’s geolocation data.
Charts & Graphs:
Visualize top open ports, service distributions, and risk trends.
Search & Filters:
Advanced search by IP range, port, or vulnerability.
5. API Integration
Shodan API Endpoints:
/shodan/host/{ip}: Fetch detailed host data.
/shodan/scan: Trigger on-demand Shodan scans.
/shodan/alert: Manage network monitoring alerts.
Technical Requirements
Frontend (React)
State Management: Redux or React Context API.
UI Libraries:
Material-UI or Ant Design for components.
Recharts/Chart.js for visualizations.
Leaflet/React-Leaflet for maps.
Authentication: JWT-based login with role-based access (admin/user).
Backend (Proxy Server)
Node.js/Express:
Proxy requests to Shodan API to avoid exposing API keys in the frontend.
Rate limiting to comply with Shodan’s API limits (1 request/second).
Security:
Store Shodan API keys in AWS Secrets Manager or environment variables.
Validate user input to prevent SSRF or injection attacks.
Database (Optional)
PostgreSQL:
Store user-generated data (tags, reports, alerts).
Cache frequently accessed Shodan data (with TTL).
Security & Compliance
API Key Management:
Never expose Shodan API keys in the frontend or client-side code.
Use a backend proxy for all Shodan API calls.
Data Privacy:
Anonymize sensitive data (e.g., IPs) in reports shared externally.
Encrypt database fields containing asset metadata.
Rate Limiting:
Enforce Shodan’s API limits to avoid IP bans.
User Permissions:
Role-based access control (RBAC): Admins vs. read-only users.
Audit logs for user actions (e.g., scans triggered, reports exported).
Shodan API Integration
Key Endpoints
Endpoint Purpose
GET /shodan/host/{ip} Fetch host details (ports, banners, CVEs).
GET /shodan/host/count Count devices matching a query (e.g., apache).
POST /shodan/scan Initiate a new scan for an IP/network.
GET /shodan/alert/info List active monitoring alerts.
Example Workflow
User searches for acme.com in the React app.
Frontend sends a request to the backend proxy.
Backend fetches data from Shodan’s /shodan/host endpoint using the stored API key.
Data is sanitized and returned to the frontend for display.
Ethical & Legal Considerations
Authorized Use Only: Ensure the tool is only used for assets owned by the organization.
Shodan Compliance: Adhere to Shodan’s API Terms of Service.
Data Retention: Automatically delete cached Shodan data after 30 days.
Deliverables
React frontend with dashboard, asset inventory, and reporting.
Node.js proxy backend with secure API key handling.
Documentation:
User guide for security teams.
API integration manual.
Incident response plan for false positives/negatives.
Add multi Tenancy to the portal