[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFVGDBAT3G62CQE43NNM37":3,"skill-same:01M6AFVGDBAT3G62CQE43NNM37":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":57,"repositoryHtmlUrl":58,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6AFVGDBAT3G62CQE43NNM37","shodan-reconnaissance",null,"This skill should be used when the user asks to \"search for exposed devices on the internet,\" \"perform Shodan reconnaissance,\" \"find vulnerable services using Shodan,\" \"scan IP ranges with Shodan,\" or \"discover IoT devices and open ports.\" It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33332,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fshodan-reconnaissance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"reconnaissance","Shodan","shodan reconnaissance","engine","search engine","for","internet","penetration","ip","discover","scan","guidance","user","ports","testing","open","devices","penetration testing","services","iot","search","cli","2026-11-10 10:12:30",false,"---\nname: shodan-reconnaissance\ndescription: This skill should be used when the user asks to \"search for exposed devices on the internet,\" \"perform Shodan reconnaissance,\" \"find vulnerable services using Shodan,\" \"scan IP ranges with Shodan,\" or \"discover IoT devices and open ports.\" It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Shodan Reconnaissance and Pentesting\n\n## Purpose\n\nProvide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.\n\n## Inputs \u002F Prerequisites\n\n- **Shodan Account**: Free or paid account at shodan.io\n- **API Key**: Obtained from Shodan account dashboard\n- **Target Information**: IP addresses, domains, or network ranges to investigate\n- **Shodan CLI**: Python-based command-line tool installed\n- **Authorization**: Written permission for reconnaissance on target networks\n\n## Outputs \u002F Deliverables\n\n- **Asset Inventory**: List of discovered hosts, ports, and services\n- **Vulnerability Report**: Identified CVEs and exposed vulnerable services\n- **Banner Data**: Service banners revealing software versions\n- **Network Mapping**: Geographic and organizational distribution of assets\n- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces\n- **Exported Data**: JSON\u002FCSV files for further analysis\n\n## Core Workflow\n\n### 1. Setup and Configuration\n\n#### Install Shodan CLI\n```bash\n# Using pip\npip install shodan\n\n# Or easy_install\neasy_install shodan\n\n# On BlackArch\u002FArch Linux\nsudo pacman -S python-shodan\n```\n\n#### Initialize API Key\n```bash\n# Set your API key\nshodan init YOUR_API_KEY\n\n# Verify setup\nshodan info\n# Output: Query credits available: 100\n#         Scan credits available: 100\n```\n\n#### Check Account Status\n```bash\n# View credits and plan info\nshodan info\n\n# Check your external IP\nshodan myip\n\n# Check CLI version\nshodan version\n```\n\n### 2. Basic Host Reconnaissance\n\n#### Query Single Host\n```bash\n# Get all information about an IP\nshodan host 1.1.1.1\n\n# Example output:\n# 1.1.1.1\n# Hostnames: one.one.one.one\n# Country: Australia\n# Organization: Mountain View Communications\n# Number of open ports: 3\n# Ports:\n#   53\u002Fudp\n#   80\u002Ftcp\n#   443\u002Ftcp\n```\n\n#### Check if Host is Honeypot\n```bash\n# Get honeypot probability score\nshodan honeyscore 192.168.1.100\n\n# Output: Not a honeypot\n#         Score: 0.3\n```\n\n### 3. Search Queries\n\n#### Basic Search (Free)\n```bash\n# Simple keyword search (no credits consumed)\nshodan search apache\n\n# Specify output fields\nshodan search --fields ip_str,port,os smb\n```\n\n#### Filtered Search (1 Credit)\n```bash\n# Product-specific search\nshodan search product:mongodb\n\n# Search with multiple filters\nshodan search product:nginx country:US city:\"New York\"\n```\n\n#### Count Results\n```bash\n# Get result count without consuming credits\nshodan count openssh\n# Output: 23128\n\nshodan count openssh 7\n# Output: 219\n```\n\n#### Download Results\n```bash\n# Download 1000 results (default)\nshodan download results.json.gz \"apache country:US\"\n\n# Download specific number of results\nshodan download --limit 5000 results.json.gz \"nginx\"\n\n# Download all available results\nshodan download --limit -1 all_results.json.gz \"query\"\n```\n\n#### Parse Downloaded Data\n```bash\n# Extract specific fields from downloaded data\nshodan parse --fields ip_str,port,hostnames results.json.gz\n\n# Filter by specific criteria\nshodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz\n\n# Export to CSV format\nshodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv\n```\n\n### 4. Search Filters Reference\n\n#### Network Filters\n```\nip:1.2.3.4                  # Specific IP address\nnet:192.168.0.0\u002F24          # Network range (CIDR)\nhostname:example.com        # Hostname contains\nport:22                     # Specific port\nasn:AS15169                 # Autonomous System Number\n```\n\n#### Geographic Filters\n```\ncountry:US                  # Two-letter country code\ncountry:\"United States\"     # Full country name\ncity:\"San Francisco\"        # City name\nstate:CA                    # State\u002Fregion\npostal:94102                # Postal\u002FZIP code\ngeo:37.7,-122.4             # Lat\u002Flong coordinates\n```\n\n#### Organization Filters\n```\norg:\"Google\"                # Organization name\nisp:\"Comcast\"               # ISP name\n```\n\n#### Service\u002FProduct Filters\n```\nproduct:nginx               # Software product\nversion:1.14.0              # Software version\nos:\"Windows Server 2019\"    # Operating system\nhttp.title:\"Dashboard\"      # HTTP page title\nhttp.html:\"login\"           # HTML content\nhttp.status:200             # HTTP status code\nssl.cert.subject.cn:*.example.com  # SSL certificate\nssl:true                    # Has SSL enabled\n```\n\n#### Vulnerability Filters\n```\nvuln:CVE-2019-0708          # Specific CVE\nhas_vuln:true               # Has any vulnerability\n```\n\n#### Screenshot Filters\n```\nhas_screenshot:true         # Has screenshot available\nscreenshot.label:webcam     # Screenshot type\n```\n\n### 5. On-Demand Scanning\n\n#### Submit Scan\n```bash\n# Scan single IP (1 credit per IP)\nshodan scan submit 192.168.1.100\n\n# Scan with verbose output (shows scan ID)\nshodan scan submit --verbose 192.168.1.100\n\n# Scan and save results\nshodan scan submit --filename scan_results.json.gz 192.168.1.100\n```\n\n#### Monitor Scan Status\n```bash\n# List recent scans\nshodan scan list\n\n# Check specific scan status\nshodan scan status SCAN_ID\n\n# Download scan results later\nshodan download --limit -1 results.json.gz scan:SCAN_ID\n```\n\n#### Available Scan Protocols\n```bash\n# List available protocols\u002Fmodules\nshodan scan protocols\n```\n\n### 6. Statistics and Analysis\n\n#### Get Search Statistics\n```bash\n# Default statistics (top 10 countries, orgs)\nshodan stats nginx\n\n# Custom facets\nshodan stats --facets domain,port,asn --limit 5 nginx\n\n# Save to CSV\nshodan stats --facets country,org -O stats.csv apache\n```\n\n### 7. Network Monitoring\n\n#### Setup Alerts (Web Interface)\n```\n1. Navigate to Monitor Dashboard\n2. Add IP, range, or domain to monitor\n3. Configure notification service (email, Slack, webhook)\n4. Select trigger events (new service, vulnerability, etc.)\n5. View dashboard for exposed services\n```\n\n### 8. REST API Usage\n\n#### Direct API Calls\n```bash\n# Get API info\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fapi-info?key=YOUR_KEY\" | jq\n\n# Host lookup\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F1.1.1.1?key=YOUR_KEY\" | jq\n\n# Search query\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002Fsearch?key=YOUR_KEY&query=apache\" | jq\n```\n\n#### Python Library\n```python\nimport shodan\n\napi = shodan.Shodan('YOUR_API_KEY')\n\n# Search\nresults = api.search('apache')\nprint(f'Results found: {results[\"total\"]}')\nfor result in results['matches']:\n    print(f'IP: {result[\"ip_str\"]}')\n\n# Host lookup\nhost = api.host('1.1.1.1')\nprint(f'IP: {host[\"ip_str\"]}')\nprint(f'Organization: {host.get(\"org\", \"n\u002Fa\")}')\nfor item in host['data']:\n    print(f'Port: {item[\"port\"]}')\n```\n\n## Quick Reference\n\n### Essential CLI Commands\n\n| Command | Description | Credits |\n|---------|-------------|---------|\n| `shodan init KEY` | Initialize API key | 0 |\n| `shodan info` | Show account info | 0 |\n| `shodan myip` | Show your IP | 0 |\n| `shodan host IP` | Host details | 0 |\n| `shodan count QUERY` | Result count | 0 |\n| `shodan search QUERY` | Basic search | 0* |\n| `shodan download FILE QUERY` | Save results | 1\u002F100 results |\n| `shodan parse FILE` | Extract data | 0 |\n| `shodan stats QUERY` | Statistics | 1 |\n| `shodan scan submit IP` | On-demand scan | 1\u002FIP |\n| `shodan honeyscore IP` | Honeypot check | 0 |\n\n*Filters consume 1 credit per query\n\n### Common Search Queries\n\n| Purpose | Query |\n|---------|-------|\n| Find webcams | `webcam has_screenshot:true` |\n| MongoDB databases | `product:mongodb` |\n| Redis servers | `product:redis` |\n| Elasticsearch | `product:elastic port:9200` |\n| Default passwords | `\"default password\"` |\n| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |\n| Industrial systems | `port:502 modbus` |\n| Cisco devices | `product:cisco` |\n| Open VNC | `port:5900 authentication disabled` |\n| Exposed FTP | `port:21 anonymous` |\n| WordPress sites | `http.component:wordpress` |\n| Printers | `\"HP-ChaiSOE\" port:80` |\n| Cameras (RTSP) | `port:554 has_screenshot:true` |\n| Jenkins servers | `X-Jenkins port:8080` |\n| Docker APIs | `port:2375 product:docker` |\n\n### Useful Filter Combinations\n\n| Scenario | Query |\n|---------|-------|\n| Target org recon | `org:\"Company Name\"` |\n| Domain enumeration | `hostname:example.com` |\n| Network range scan | `net:192.168.0.0\u002F24` |\n| SSL cert search | `ssl.cert.subject.cn:*.target.com` |\n| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |\n| Exposed admin panels | `http.title:\"admin\" port:443` |\n| Database exposure | `port:3306,5432,27017,6379` |\n\n### Credit System\n\n| Action | Credit Type | Cost |\n|--------|-------------|------|\n| Basic search | Query | 0 (no filters) |\n| Filtered search | Query | 1 |\n| Download 100 results | Query | 1 |\n| Generate report | Query | 1 |\n| Scan 1 IP | Scan | 1 |\n| Network monitoring | Monitored IPs | Depends on plan |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Rate limited to 1 request per second\n- Scan results not immediate (asynchronous)\n- Cannot re-scan same IP within 24 hours (non-Enterprise)\n- Free accounts have limited credits\n- Some data requires paid subscription\n\n### Data Freshness\n- Shodan crawls continuously but data may be days\u002Fweeks old\n- On-demand scans provide current data but cost credits\n- Historical data available with paid plans\n\n### Legal Requirements\n- Only perform reconnaissance on authorized targets\n- Passive reconnaissance generally legal but verify jurisdiction\n- Active scanning (scan submit) requires authorization\n- Document all reconnaissance activities\n\n## Examples\n\n### Example 1: Organization Reconnaissance\n```bash\n# Find all hosts belonging to target organization\nshodan search 'org:\"Target Company\"'\n\n# Get statistics on their infrastructure\nshodan stats --facets port,product,country 'org:\"Target Company\"'\n\n# Download detailed data\nshodan download target_data.json.gz 'org:\"Target Company\"'\n\n# Parse for specific info\nshodan parse --fields ip_str,port,product target_data.json.gz\n```\n\n### Example 2: Vulnerable Service Discovery\n```bash\n# Find hosts vulnerable to BlueKeep (RDP CVE)\nshodan search 'vuln:CVE-2019-0708 country:US'\n\n# Find exposed Elasticsearch with no auth\nshodan search 'product:elastic port:9200 -authentication'\n\n# Find Log4j vulnerable systems\nshodan search 'vuln:CVE-2021-44228'\n```\n\n### Example 3: IoT Device Discovery\n```bash\n# Find exposed webcams\nshodan search 'webcam has_screenshot:true country:US'\n\n# Find industrial control systems\nshodan search 'port:502 product:modbus'\n\n# Find exposed printers\nshodan search '\"HP-ChaiSOE\" port:80'\n\n# Find smart home devices\nshodan search 'product:nest'\n```\n\n### Example 4: SSL\u002FTLS Certificate Analysis\n```bash\n# Find hosts with specific SSL cert\nshodan search 'ssl.cert.subject.cn:*.example.com'\n\n# Find expired certificates\nshodan search 'ssl.cert.expired:true org:\"Company\"'\n\n# Find self-signed certificates\nshodan search 'ssl.cert.issuer.cn:self-signed'\n```\n\n### Example 5: Python Automation Script\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport shodan\nimport json\n\nAPI_KEY = 'YOUR_API_KEY'\napi = shodan.Shodan(API_KEY)\n\ndef recon_organization(org_name):\n    \"\"\"Perform reconnaissance on an organization\"\"\"\n    try:\n        # Search for organization\n        query = f'org:\"{org_name}\"'\n        results = api.search(query)\n        \n        print(f\"[*] Found {results['total']} hosts for {org_name}\")\n        \n        # Collect unique IPs and ports\n        hosts = {}\n        for result in results['matches']:\n            ip = result['ip_str']\n            port = result['port']\n            product = result.get('product', 'unknown')\n            \n            if ip not in hosts:\n                hosts[ip] = []\n            hosts[ip].append({'port': port, 'product': product})\n        \n        # Output findings\n        for ip, services in hosts.items():\n            print(f\"\\n[+] {ip}\")\n            for svc in services:\n                print(f\"    - {svc['port']}\u002Ftcp ({svc['product']})\")\n        \n        return hosts\n        \n    except shodan.APIError as e:\n        print(f\"Error: {e}\")\n        return None\n\nif __name__ == '__main__':\n    recon_organization(\"Target Company\")\n```\n\n### Example 6: Network Range Assessment\n```bash\n# Scan a \u002F24 network range\nshodan search 'net:192.168.1.0\u002F24'\n\n# Get port distribution\nshodan stats --facets port 'net:192.168.1.0\u002F24'\n\n# Find specific vulnerabilities in range\nshodan search 'net:192.168.1.0\u002F24 vuln:CVE-2021-44228'\n\n# Export all data for range\nshodan download network_scan.json.gz 'net:192.168.1.0\u002F24'\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |\n| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |\n| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |\n| Rate Limit Exceeded | >1 request\u002Fsecond | Add `time.sleep(1)` between API requests |\n| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:\"Company Name\"'`; broaden criteria |\n| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |\n","# Shodan Reconnaissance and Pentesting\n\n## Purpose\n\nProvide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.\n\n## Inputs \u002F Prerequisites\n\n- **Shodan Account**: Free or paid account at shodan.io\n- **API Key**: Obtained from Shodan account dashboard\n- **Target Information**: IP addresses, domains, or network ranges to investigate\n- **Shodan CLI**: Python-based command-line tool installed\n- **Authorization**: Written permission for reconnaissance on target networks\n\n## Outputs \u002F Deliverables\n\n- **Asset Inventory**: List of discovered hosts, ports, and services\n- **Vulnerability Report**: Identified CVEs and exposed vulnerable services\n- **Banner Data**: Service banners revealing software versions\n- **Network Mapping**: Geographic and organizational distribution of assets\n- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces\n- **Exported Data**: JSON\u002FCSV files for further analysis\n\n## Core Workflow\n\n### 1. Setup and Configuration\n\n#### Install Shodan CLI\n```bash\n# Using pip\npip install shodan\n\n# Or easy_install\neasy_install shodan\n\n# On BlackArch\u002FArch Linux\nsudo pacman -S python-shodan\n```\n\n#### Initialize API Key\n```bash\n# Set your API key\nshodan init YOUR_API_KEY\n\n# Verify setup\nshodan info\n# Output: Query credits available: 100\n#         Scan credits available: 100\n```\n\n#### Check Account Status\n```bash\n# View credits and plan info\nshodan info\n\n# Check your external IP\nshodan myip\n\n# Check CLI version\nshodan version\n```\n\n### 2. Basic Host Reconnaissance\n\n#### Query Single Host\n```bash\n# Get all information about an IP\nshodan host 1.1.1.1\n\n# Example output:\n# 1.1.1.1\n# Hostnames: one.one.one.one\n# Country: Australia\n# Organization: Mountain View Communications\n# Number of open ports: 3\n# Ports:\n#   53\u002Fudp\n#   80\u002Ftcp\n#   443\u002Ftcp\n```\n\n#### Check if Host is Honeypot\n```bash\n# Get honeypot probability score\nshodan honeyscore 192.168.1.100\n\n# Output: Not a honeypot\n#         Score: 0.3\n```\n\n### 3. Search Queries\n\n#### Basic Search (Free)\n```bash\n# Simple keyword search (no credits consumed)\nshodan search apache\n\n# Specify output fields\nshodan search --fields ip_str,port,os smb\n```\n\n#### Filtered Search (1 Credit)\n```bash\n# Product-specific search\nshodan search product:mongodb\n\n# Search with multiple filters\nshodan search product:nginx country:US city:\"New York\"\n```\n\n#### Count Results\n```bash\n# Get result count without consuming credits\nshodan count openssh\n# Output: 23128\n\nshodan count openssh 7\n# Output: 219\n```\n\n#### Download Results\n```bash\n# Download 1000 results (default)\nshodan download results.json.gz \"apache country:US\"\n\n# Download specific number of results\nshodan download --limit 5000 results.json.gz \"nginx\"\n\n# Download all available results\nshodan download --limit -1 all_results.json.gz \"query\"\n```\n\n#### Parse Downloaded Data\n```bash\n# Extract specific fields from downloaded data\nshodan parse --fields ip_str,port,hostnames results.json.gz\n\n# Filter by specific criteria\nshodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz\n\n# Export to CSV format\nshodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv\n```\n\n### 4. Search Filters Reference\n\n#### Network Filters\n```\nip:1.2.3.4                  # Specific IP address\nnet:192.168.0.0\u002F24          # Network range (CIDR)\nhostname:example.com        # Hostname contains\nport:22                     # Specific port\nasn:AS15169                 # Autonomous System Number\n```\n\n#### Geographic Filters\n```\ncountry:US                  # Two-letter country code\ncountry:\"United States\"     # Full country name\ncity:\"San Francisco\"        # City name\nstate:CA                    # State\u002Fregion\npostal:94102                # Postal\u002FZIP code\ngeo:37.7,-122.4             # Lat\u002Flong coordinates\n```\n\n#### Organization Filters\n```\norg:\"Google\"                # Organization name\nisp:\"Comcast\"               # ISP name\n```\n\n#### Service\u002FProduct Filters\n```\nproduct:nginx               # Software product\nversion:1.14.0              # Software version\nos:\"Windows Server 2019\"    # Operating system\nhttp.title:\"Dashboard\"      # HTTP page title\nhttp.html:\"login\"           # HTML content\nhttp.status:200             # HTTP status code\nssl.cert.subject.cn:*.example.com  # SSL certificate\nssl:true                    # Has SSL enabled\n```\n\n#### Vulnerability Filters\n```\nvuln:CVE-2019-0708          # Specific CVE\nhas_vuln:true               # Has any vulnerability\n```\n\n#### Screenshot Filters\n```\nhas_screenshot:true         # Has screenshot available\nscreenshot.label:webcam     # Screenshot type\n```\n\n### 5. On-Demand Scanning\n\n#### Submit Scan\n```bash\n# Scan single IP (1 credit per IP)\nshodan scan submit 192.168.1.100\n\n# Scan with verbose output (shows scan ID)\nshodan scan submit --verbose 192.168.1.100\n\n# Scan and save results\nshodan scan submit --filename scan_results.json.gz 192.168.1.100\n```\n\n#### Monitor Scan Status\n```bash\n# List recent scans\nshodan scan list\n\n# Check specific scan status\nshodan scan status SCAN_ID\n\n# Download scan results later\nshodan download --limit -1 results.json.gz scan:SCAN_ID\n```\n\n#### Available Scan Protocols\n```bash\n# List available protocols\u002Fmodules\nshodan scan protocols\n```\n\n### 6. Statistics and Analysis\n\n#### Get Search Statistics\n```bash\n# Default statistics (top 10 countries, orgs)\nshodan stats nginx\n\n# Custom facets\nshodan stats --facets domain,port,asn --limit 5 nginx\n\n# Save to CSV\nshodan stats --facets country,org -O stats.csv apache\n```\n\n### 7. Network Monitoring\n\n#### Setup Alerts (Web Interface)\n```\n1. Navigate to Monitor Dashboard\n2. Add IP, range, or domain to monitor\n3. Configure notification service (email, Slack, webhook)\n4. Select trigger events (new service, vulnerability, etc.)\n5. View dashboard for exposed services\n```\n\n### 8. REST API Usage\n\n#### Direct API Calls\n```bash\n# Get API info\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fapi-info?key=YOUR_KEY\" | jq\n\n# Host lookup\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F1.1.1.1?key=YOUR_KEY\" | jq\n\n# Search query\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002Fsearch?key=YOUR_KEY&query=apache\" | jq\n```\n\n#### Python Library\n```python\nimport shodan\n\napi = shodan.Shodan('YOUR_API_KEY')\n\n# Search\nresults = api.search('apache')\nprint(f'Results found: {results[\"total\"]}')\nfor result in results['matches']:\n    print(f'IP: {result[\"ip_str\"]}')\n\n# Host lookup\nhost = api.host('1.1.1.1')\nprint(f'IP: {host[\"ip_str\"]}')\nprint(f'Organization: {host.get(\"org\", \"n\u002Fa\")}')\nfor item in host['data']:\n    print(f'Port: {item[\"port\"]}')\n```\n\n## Quick Reference\n\n### Essential CLI Commands\n\n| Command | Description | Credits |\n|---------|-------------|---------|\n| `shodan init KEY` | Initialize API key | 0 |\n| `shodan info` | Show account info | 0 |\n| `shodan myip` | Show your IP | 0 |\n| `shodan host IP` | Host details | 0 |\n| `shodan count QUERY` | Result count | 0 |\n| `shodan search QUERY` | Basic search | 0* |\n| `shodan download FILE QUERY` | Save results | 1\u002F100 results |\n| `shodan parse FILE` | Extract data | 0 |\n| `shodan stats QUERY` | Statistics | 1 |\n| `shodan scan submit IP` | On-demand scan | 1\u002FIP |\n| `shodan honeyscore IP` | Honeypot check | 0 |\n\n*Filters consume 1 credit per query\n\n### Common Search Queries\n\n| Purpose | Query |\n|---------|-------|\n| Find webcams | `webcam has_screenshot:true` |\n| MongoDB databases | `product:mongodb` |\n| Redis servers | `product:redis` |\n| Elasticsearch | `product:elastic port:9200` |\n| Default passwords | `\"default password\"` |\n| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |\n| Industrial systems | `port:502 modbus` |\n| Cisco devices | `product:cisco` |\n| Open VNC | `port:5900 authentication disabled` |\n| Exposed FTP | `port:21 anonymous` |\n| WordPress sites | `http.component:wordpress` |\n| Printers | `\"HP-ChaiSOE\" port:80` |\n| Cameras (RTSP) | `port:554 has_screenshot:true` |\n| Jenkins servers | `X-Jenkins port:8080` |\n| Docker APIs | `port:2375 product:docker` |\n\n### Useful Filter Combinations\n\n| Scenario | Query |\n|---------|-------|\n| Target org recon | `org:\"Company Name\"` |\n| Domain enumeration | `hostname:example.com` |\n| Network range scan | `net:192.168.0.0\u002F24` |\n| SSL cert search | `ssl.cert.subject.cn:*.target.com` |\n| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |\n| Exposed admin panels | `http.title:\"admin\" port:443` |\n| Database exposure | `port:3306,5432,27017,6379` |\n\n### Credit System\n\n| Action | Credit Type | Cost |\n|--------|-------------|------|\n| Basic search | Query | 0 (no filters) |\n| Filtered search | Query | 1 |\n| Download 100 results | Query | 1 |\n| Generate report | Query | 1 |\n| Scan 1 IP | Scan | 1 |\n| Network monitoring | Monitored IPs | Depends on plan |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Rate limited to 1 request per second\n- Scan results not immediate (asynchronous)\n- Cannot re-scan same IP within 24 hours (non-Enterprise)\n- Free accounts have limited credits\n- Some data requires paid subscription\n\n### Data Freshness\n- Shodan crawls continuously but data may be days\u002Fweeks old\n- On-demand scans provide current data but cost credits\n- Historical data available with paid plans\n\n### Legal Requirements\n- Only perform reconnaissance on authorized targets\n- Passive reconnaissance generally legal but verify jurisdiction\n- Active scanning (scan submit) requires authorization\n- Document all reconnaissance activities\n\n## Examples\n\n### Example 1: Organization Reconnaissance\n```bash\n# Find all hosts belonging to target organization\nshodan search 'org:\"Target Company\"'\n\n# Get statistics on their infrastructure\nshodan stats --facets port,product,country 'org:\"Target Company\"'\n\n# Download detailed data\nshodan download target_data.json.gz 'org:\"Target Company\"'\n\n# Parse for specific info\nshodan parse --fields ip_str,port,product target_data.json.gz\n```\n\n### Example 2: Vulnerable Service Discovery\n```bash\n# Find hosts vulnerable to BlueKeep (RDP CVE)\nshodan search 'vuln:CVE-2019-0708 country:US'\n\n# Find exposed Elasticsearch with no auth\nshodan search 'product:elastic port:9200 -authentication'\n\n# Find Log4j vulnerable systems\nshodan search 'vuln:CVE-2021-44228'\n```\n\n### Example 3: IoT Device Discovery\n```bash\n# Find exposed webcams\nshodan search 'webcam has_screenshot:true country:US'\n\n# Find industrial control systems\nshodan search 'port:502 product:modbus'\n\n# Find exposed printers\nshodan search '\"HP-ChaiSOE\" port:80'\n\n# Find smart home devices\nshodan search 'product:nest'\n```\n\n### Example 4: SSL\u002FTLS Certificate Analysis\n```bash\n# Find hosts with specific SSL cert\nshodan search 'ssl.cert.subject.cn:*.example.com'\n\n# Find expired certificates\nshodan search 'ssl.cert.expired:true org:\"Company\"'\n\n# Find self-signed certificates\nshodan search 'ssl.cert.issuer.cn:self-signed'\n```\n\n### Example 5: Python Automation Script\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport shodan\nimport json\n\nAPI_KEY = 'YOUR_API_KEY'\napi = shodan.Shodan(API_KEY)\n\ndef recon_organization(org_name):\n    \"\"\"Perform reconnaissance on an organization\"\"\"\n    try:\n        # Search for organization\n        query = f'org:\"{org_name}\"'\n        results = api.search(query)\n        \n        print(f\"[*] Found {results['total']} hosts for {org_name}\")\n        \n        # Collect unique IPs and ports\n        hosts = {}\n        for result in results['matches']:\n            ip = result['ip_str']\n            port = result['port']\n            product = result.get('product', 'unknown')\n            \n            if ip not in hosts:\n                hosts[ip] = []\n            hosts[ip].append({'port': port, 'product': product})\n        \n        # Output findings\n        for ip, services in hosts.items():\n            print(f\"\\n[+] {ip}\")\n            for svc in services:\n                print(f\"    - {svc['port']}\u002Ftcp ({svc['product']})\")\n        \n        return hosts\n        \n    except shodan.APIError as e:\n        print(f\"Error: {e}\")\n        return None\n\nif __name__ == '__main__':\n    recon_organization(\"Target Company\")\n```\n\n### Example 6: Network Range Assessment\n```bash\n# Scan a \u002F24 network range\nshodan search 'net:192.168.1.0\u002F24'\n\n# Get port distribution\nshodan stats --facets port 'net:192.168.1.0\u002F24'\n\n# Find specific vulnerabilities in range\nshodan search 'net:192.168.1.0\u002F24 vuln:CVE-2021-44228'\n\n# Export all data for range\nshodan download network_scan.json.gz 'net:192.168.1.0\u002F24'\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |\n| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |\n| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |\n| Rate Limit Exceeded | >1 request\u002Fsecond | Add `time.sleep(1)` between API requests |\n| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:\"Company Name\"'`; broaden criteria |\n| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |\n",{"name":5,"metadata":51,"description":7},{"author":52,"version":53},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fshodan-reconnaissance",3911,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-11 21:38:31",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add davila7\u002Fclaude-code-templates --skill shodan-reconnaissance",{"tool":70,"command":71},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill shodan-reconnaissance",{"tool":73,"command":74},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill shodan-reconnaissance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fshodan-reconnaissance\u002FSKILL.md",true,[],[79,106,133,166,201,224],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":86,"publishedAt":46},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[85],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[87,88,89,90,91,29,92,93,94,95,96,97,98,99,100,101,102,103,104,105],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","when","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":113,"publishedAt":46},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[112],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,116,117,118,119,120,121,122,123,124,95,125,126,127,128,129,130,131,132],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":148,"publishedAt":46},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[139,142,143],{"categoryNo":140,"categoryName":141,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":144,"categoryName":145,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[149,150,151,152,153,154,155,29,156,157,158,159,160,161,162,94,163,164,95,165],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":170,"licenseFileUrl":171,"sourceHtmlUrl":172,"categories":173,"keywords":177,"publishedAt":46},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[174],{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,29,200],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":170,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":212,"publishedAt":46},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[208,211],{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":175,"categoryName":176,"taxonomyType":21,"taxonomyTypeDesc":22},[213,38,214,215,216,179,217,188,189,218,219,220,221,29,222,97,223],"webapp testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":170,"licenseFileUrl":228,"sourceHtmlUrl":229,"categories":230,"keywords":238,"publishedAt":46},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[231,234,235],{"categoryNo":232,"categoryName":233,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":236,"categoryName":237,"taxonomyType":146,"taxonomyTypeDesc":147},"01JBSEEDCAT000000000000036","内容创作者",[239,240,241,242,243,244,245,246,181,247,191,125,248,249,250,251,252,161,253,95,254,255,256,257,258,103,259],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]