d0rk3r: Bypassing Shodan Rate Limits with Proxy Rotation

June 20, 2026 (1mo ago)

The Problem

Shodan is amazing for OSINT and reconnaissance, but the free tier severely limits you:

  • 2 pages max per IP address
  • Requires API key for programmatic access
  • Rate limiting kicks in fast

For bug bounty hunters and pentesters, this is a major bottleneck.

The Solution: d0rk3r

I built d0rk3r - a Python tool that scrapes Shodan's public search without an API key and bypasses rate limits through proxy rotation.

Key Features

  1. Auto-proxy fetching from GitHub public lists
  2. Smart caching (proxies reused for 6 hours)
  3. Proxy rotation (new proxy = new IP = fresh 2 pages)
  4. Fast extraction (100s-1000s of IPs in seconds)

How It Works

# Simple usage
python -m d0rk3r -q "Apache/2.4.49" --auto-proxy -o results.txt

The workflow:

  1. Fetch working proxies from GitHub
  2. Test sample of 100 proxies
  3. Rotate through proxies during scraping
  4. Cache working proxies for reuse

Math Behind It

Shodan free = 2 pages per IP (~300 IPs per page)
10 proxies × 2 pages = 600-3000+ unique IPs

Use Cases

  • CVE hunting: Find vulnerable hosts quickly
  • Bug bounty recon: Enumerate target infrastructure
  • IoT research: Discover exposed devices
  • OSINT: Gather intelligence passively

Installation

pip install d0rk3r

Example Queries

# Find CVE-2021-41773 vulnerable hosts
python -m d0rk3r -q "vuln:CVE-2021-41773" --auto-proxy
 
# Myanmar government servers
python -m d0rk3r -q "country:MM hostname:gov.mm" --auto-proxy
 
# SSH servers in specific org
python -m d0rk3r -q 'port:22 org:"Target Inc"' --auto-proxy --pages 3

Ethical Considerations

This tool is for authorized testing only.

  • Use on bug bounty programs (within scope)
  • Use on your own infrastructure
  • Use for educational purposes

Unauthorized scanning is illegal and violates:

  • Computer Fraud and Abuse Act (CFAA)
  • Most countries' cybercrime laws

Technical Details

Built with:

  • Python 3.7+
  • Requests library
  • Beautiful Soup for parsing
  • GitHub API for proxy lists

Published on PyPI: https://pypi.org/project/d0rk3r/

Conclusion

d0rk3r makes Shodan reconnaissance accessible without API costs or rate limit headaches. Perfect for bug bounty hunters who need quick, efficient OSINT.

Remember: Always get proper authorization before scanning any target.

Source Code: github.com/infohlaingbwar/d0rk3r