[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FTMVMBEWR9W55X76PC967C":3,"skill-same:01M6FTMVMBEWR9W55X76PC967C":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":45,"ownerDescription":46,"updatedAt":47,"install":48,"resources":61},"01M6FTMVMBEWR9W55X76PC967C","shodan-reconnaissance",null,"This skill should be used when the user asks to \"search for exposed devices on the internet,\" \"perform Shodan reconnaissance,\" \"find vulnerable services using Shodan,\" \"scan IP ranges...","reikiplanet\u002Fdaoskills","reikiplanet","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96377599?v=4","01M6CVWCMD740YHQDK7E9QYBW4","Reiki Planet","01M6CVWCS4KXVA2CWFVJ43EAXK",0,"MIT","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fdata\u002Fshodan-reconnaissance\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30],"reconnaissance","Shodan","shodan reconnaissance","search","services","devices","find","user","community","scan","ip","internet","2026-11-10 10:12:30",false,"---\nname: shodan-reconnaissance\ndescription: \"This skill should be used when the user asks to \\\"search for exposed devices on the internet,\\\" \\\"perform Shodan reconnaissance,\\\" \\\"find vulnerable services using Shodan,\\\" \\\"scan IP ranges...\"\nmetadata:\n  author: zebbern\n  version: \"1.1\"\nrisk: unknown\nsource: community\n---\n\n# Shodan Reconnaissance and Pentesting\n\n## Purpose\n\nProvide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.\n\n## Inputs \u002F Prerequisites\n\n- **Shodan Account**: Free or paid account at shodan.io\n- **API Key**: Obtained from Shodan account dashboard\n- **Target Information**: IP addresses, domains, or network ranges to investigate\n- **Shodan CLI**: Python-based command-line tool installed\n- **Authorization**: Written permission for reconnaissance on target networks\n\n## Outputs \u002F Deliverables\n\n- **Asset Inventory**: List of discovered hosts, ports, and services\n- **Vulnerability Report**: Identified CVEs and exposed vulnerable services\n- **Banner Data**: Service banners revealing software versions\n- **Network Mapping**: Geographic and organizational distribution of assets\n- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces\n- **Exported Data**: JSON\u002FCSV files for further analysis\n\n## Core Workflow\n\n### 1. Setup and Configuration\n\n#### Install Shodan CLI\n```bash\n# Using pip\npip install shodan\n\n# Or easy_install\neasy_install shodan\n\n# On BlackArch\u002FArch Linux\nsudo pacman -S python-shodan\n```\n\n#### Initialize API Key\n```bash\n# Set your API key\nshodan init YOUR_API_KEY\n\n# Verify setup\nshodan info\n# Output: Query credits available: 100\n#         Scan credits available: 100\n```\n\n#### Check Account Status\n```bash\n# View credits and plan info\nshodan info\n\n# Check your external IP\nshodan myip\n\n# Check CLI version\nshodan version\n```\n\n### 2. Basic Host Reconnaissance\n\n#### Query Single Host\n```bash\n# Get all information about an IP\nshodan host 1.1.1.1\n\n# Example output:\n# 1.1.1.1\n# Hostnames: one.one.one.one\n# Country: Australia\n# Organization: Mountain View Communications\n# Number of open ports: 3\n# Ports:\n#   53\u002Fudp\n#   80\u002Ftcp\n#   443\u002Ftcp\n```\n\n#### Check if Host is Honeypot\n```bash\n# Get honeypot probability score\nshodan honeyscore 192.168.1.100\n\n# Output: Not a honeypot\n#         Score: 0.3\n```\n\n### 3. Search Queries\n\n#### Basic Search (Free)\n```bash\n# Simple keyword search (no credits consumed)\nshodan search apache\n\n# Specify output fields\nshodan search --fields ip_str,port,os smb\n```\n\n#### Filtered Search (1 Credit)\n```bash\n# Product-specific search\nshodan search product:mongodb\n\n# Search with multiple filters\nshodan search product:nginx country:US city:\"New York\"\n```\n\n#### Count Results\n```bash\n# Get result count without consuming credits\nshodan count openssh\n# Output: 23128\n\nshodan count openssh 7\n# Output: 219\n```\n\n#### Download Results\n```bash\n# Download 1000 results (default)\nshodan download results.json.gz \"apache country:US\"\n\n# Download specific number of results\nshodan download --limit 5000 results.json.gz \"nginx\"\n\n# Download all available results\nshodan download --limit -1 all_results.json.gz \"query\"\n```\n\n#### Parse Downloaded Data\n```bash\n# Extract specific fields from downloaded data\nshodan parse --fields ip_str,port,hostnames results.json.gz\n\n# Filter by specific criteria\nshodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz\n\n# Export to CSV format\nshodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv\n```\n\n### 4. Search Filters Reference\n\n#### Network Filters\n```\nip:1.2.3.4                  # Specific IP address\nnet:192.168.0.0\u002F24          # Network range (CIDR)\nhostname:example.com        # Hostname contains\nport:22                     # Specific port\nasn:AS15169                 # Autonomous System Number\n```\n\n#### Geographic Filters\n```\ncountry:US                  # Two-letter country code\ncountry:\"United States\"     # Full country name\ncity:\"San Francisco\"        # City name\nstate:CA                    # State\u002Fregion\npostal:94102                # Postal\u002FZIP code\ngeo:37.7,-122.4             # Lat\u002Flong coordinates\n```\n\n#### Organization Filters\n```\norg:\"Google\"                # Organization name\nisp:\"Comcast\"               # ISP name\n```\n\n#### Service\u002FProduct Filters\n```\nproduct:nginx               # Software product\nversion:1.14.0              # Software version\nos:\"Windows Server 2019\"    # Operating system\nhttp.title:\"Dashboard\"      # HTTP page title\nhttp.html:\"login\"           # HTML content\nhttp.status:200             # HTTP status code\nssl.cert.subject.cn:*.example.com  # SSL certificate\nssl:true                    # Has SSL enabled\n```\n\n#### Vulnerability Filters\n```\nvuln:CVE-2019-0708          # Specific CVE\nhas_vuln:true               # Has any vulnerability\n```\n\n#### Screenshot Filters\n```\nhas_screenshot:true         # Has screenshot available\nscreenshot.label:webcam     # Screenshot type\n```\n\n### 5. On-Demand Scanning\n\n#### Submit Scan\n```bash\n# Scan single IP (1 credit per IP)\nshodan scan submit 192.168.1.100\n\n# Scan with verbose output (shows scan ID)\nshodan scan submit --verbose 192.168.1.100\n\n# Scan and save results\nshodan scan submit --filename scan_results.json.gz 192.168.1.100\n```\n\n#### Monitor Scan Status\n```bash\n# List recent scans\nshodan scan list\n\n# Check specific scan status\nshodan scan status SCAN_ID\n\n# Download scan results later\nshodan download --limit -1 results.json.gz scan:SCAN_ID\n```\n\n#### Available Scan Protocols\n```bash\n# List available protocols\u002Fmodules\nshodan scan protocols\n```\n\n### 6. Statistics and Analysis\n\n#### Get Search Statistics\n```bash\n# Default statistics (top 10 countries, orgs)\nshodan stats nginx\n\n# Custom facets\nshodan stats --facets domain,port,asn --limit 5 nginx\n\n# Save to CSV\nshodan stats --facets country,org -O stats.csv apache\n```\n\n### 7. Network Monitoring\n\n#### Setup Alerts (Web Interface)\n```\n1. Navigate to Monitor Dashboard\n2. Add IP, range, or domain to monitor\n3. Configure notification service (email, Slack, webhook)\n4. Select trigger events (new service, vulnerability, etc.)\n5. View dashboard for exposed services\n```\n\n### 8. REST API Usage\n\n#### Direct API Calls\n```bash\n# Get API info\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fapi-info?key=YOUR_KEY\" | jq\n\n# Host lookup\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F1.1.1.1?key=YOUR_KEY\" | jq\n\n# Search query\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002Fsearch?key=YOUR_KEY&query=apache\" | jq\n```\n\n#### Python Library\n```python\nimport shodan\n\napi = shodan.Shodan('YOUR_API_KEY')\n\n# Search\nresults = api.search('apache')\nprint(f'Results found: {results[\"total\"]}')\nfor result in results['matches']:\n    print(f'IP: {result[\"ip_str\"]}')\n\n# Host lookup\nhost = api.host('1.1.1.1')\nprint(f'IP: {host[\"ip_str\"]}')\nprint(f'Organization: {host.get(\"org\", \"n\u002Fa\")}')\nfor item in host['data']:\n    print(f'Port: {item[\"port\"]}')\n```\n\n## Quick Reference\n\n### Essential CLI Commands\n\n| Command | Description | Credits |\n|---------|-------------|---------|\n| `shodan init KEY` | Initialize API key | 0 |\n| `shodan info` | Show account info | 0 |\n| `shodan myip` | Show your IP | 0 |\n| `shodan host IP` | Host details | 0 |\n| `shodan count QUERY` | Result count | 0 |\n| `shodan search QUERY` | Basic search | 0* |\n| `shodan download FILE QUERY` | Save results | 1\u002F100 results |\n| `shodan parse FILE` | Extract data | 0 |\n| `shodan stats QUERY` | Statistics | 1 |\n| `shodan scan submit IP` | On-demand scan | 1\u002FIP |\n| `shodan honeyscore IP` | Honeypot check | 0 |\n\n*Filters consume 1 credit per query\n\n### Common Search Queries\n\n| Purpose | Query |\n|---------|-------|\n| Find webcams | `webcam has_screenshot:true` |\n| MongoDB databases | `product:mongodb` |\n| Redis servers | `product:redis` |\n| Elasticsearch | `product:elastic port:9200` |\n| Default passwords | `\"default password\"` |\n| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |\n| Industrial systems | `port:502 modbus` |\n| Cisco devices | `product:cisco` |\n| Open VNC | `port:5900 authentication disabled` |\n| Exposed FTP | `port:21 anonymous` |\n| WordPress sites | `http.component:wordpress` |\n| Printers | `\"HP-ChaiSOE\" port:80` |\n| Cameras (RTSP) | `port:554 has_screenshot:true` |\n| Jenkins servers | `X-Jenkins port:8080` |\n| Docker APIs | `port:2375 product:docker` |\n\n### Useful Filter Combinations\n\n| Scenario | Query |\n|---------|-------|\n| Target org recon | `org:\"Company Name\"` |\n| Domain enumeration | `hostname:example.com` |\n| Network range scan | `net:192.168.0.0\u002F24` |\n| SSL cert search | `ssl.cert.subject.cn:*.target.com` |\n| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |\n| Exposed admin panels | `http.title:\"admin\" port:443` |\n| Database exposure | `port:3306,5432,27017,6379` |\n\n### Credit System\n\n| Action | Credit Type | Cost |\n|--------|-------------|------|\n| Basic search | Query | 0 (no filters) |\n| Filtered search | Query | 1 |\n| Download 100 results | Query | 1 |\n| Generate report | Query | 1 |\n| Scan 1 IP | Scan | 1 |\n| Network monitoring | Monitored IPs | Depends on plan |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Rate limited to 1 request per second\n- Scan results not immediate (asynchronous)\n- Cannot re-scan same IP within 24 hours (non-Enterprise)\n- Free accounts have limited credits\n- Some data requires paid subscription\n\n### Data Freshness\n- Shodan crawls continuously but data may be days\u002Fweeks old\n- On-demand scans provide current data but cost credits\n- Historical data available with paid plans\n\n### Legal Requirements\n- Only perform reconnaissance on authorized targets\n- Passive reconnaissance generally legal but verify jurisdiction\n- Active scanning (scan submit) requires authorization\n- Document all reconnaissance activities\n\n## Examples\n\n### Example 1: Organization Reconnaissance\n```bash\n# Find all hosts belonging to target organization\nshodan search 'org:\"Target Company\"'\n\n# Get statistics on their infrastructure\nshodan stats --facets port,product,country 'org:\"Target Company\"'\n\n# Download detailed data\nshodan download target_data.json.gz 'org:\"Target Company\"'\n\n# Parse for specific info\nshodan parse --fields ip_str,port,product target_data.json.gz\n```\n\n### Example 2: Vulnerable Service Discovery\n```bash\n# Find hosts vulnerable to BlueKeep (RDP CVE)\nshodan search 'vuln:CVE-2019-0708 country:US'\n\n# Find exposed Elasticsearch with no auth\nshodan search 'product:elastic port:9200 -authentication'\n\n# Find Log4j vulnerable systems\nshodan search 'vuln:CVE-2021-44228'\n```\n\n### Example 3: IoT Device Discovery\n```bash\n# Find exposed webcams\nshodan search 'webcam has_screenshot:true country:US'\n\n# Find industrial control systems\nshodan search 'port:502 product:modbus'\n\n# Find exposed printers\nshodan search '\"HP-ChaiSOE\" port:80'\n\n# Find smart home devices\nshodan search 'product:nest'\n```\n\n### Example 4: SSL\u002FTLS Certificate Analysis\n```bash\n# Find hosts with specific SSL cert\nshodan search 'ssl.cert.subject.cn:*.example.com'\n\n# Find expired certificates\nshodan search 'ssl.cert.expired:true org:\"Company\"'\n\n# Find self-signed certificates\nshodan search 'ssl.cert.issuer.cn:self-signed'\n```\n\n### Example 5: Python Automation Script\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport shodan\nimport json\n\nAPI_KEY = 'YOUR_API_KEY'\napi = shodan.Shodan(API_KEY)\n\ndef recon_organization(org_name):\n    \"\"\"Perform reconnaissance on an organization\"\"\"\n    try:\n        # Search for organization\n        query = f'org:\"{org_name}\"'\n        results = api.search(query)\n        \n        print(f\"[*] Found {results['total']} hosts for {org_name}\")\n        \n        # Collect unique IPs and ports\n        hosts = {}\n        for result in results['matches']:\n            ip = result['ip_str']\n            port = result['port']\n            product = result.get('product', 'unknown')\n            \n            if ip not in hosts:\n                hosts[ip] = []\n            hosts[ip].append({'port': port, 'product': product})\n        \n        # Output findings\n        for ip, services in hosts.items():\n            print(f\"\\n[+] {ip}\")\n            for svc in services:\n                print(f\"    - {svc['port']}\u002Ftcp ({svc['product']})\")\n        \n        return hosts\n        \n    except shodan.APIError as e:\n        print(f\"Error: {e}\")\n        return None\n\nif __name__ == '__main__':\n    recon_organization(\"Target Company\")\n```\n\n### Example 6: Network Range Assessment\n```bash\n# Scan a \u002F24 network range\nshodan search 'net:192.168.1.0\u002F24'\n\n# Get port distribution\nshodan stats --facets port 'net:192.168.1.0\u002F24'\n\n# Find specific vulnerabilities in range\nshodan search 'net:192.168.1.0\u002F24 vuln:CVE-2021-44228'\n\n# Export all data for range\nshodan download network_scan.json.gz 'net:192.168.1.0\u002F24'\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |\n| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |\n| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |\n| Rate Limit Exceeded | >1 request\u002Fsecond | Add `time.sleep(1)` between API requests |\n| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:\"Company Name\"'`; broaden criteria |\n| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Shodan Reconnaissance and Pentesting\n\n## Purpose\n\nProvide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.\n\n## Inputs \u002F Prerequisites\n\n- **Shodan Account**: Free or paid account at shodan.io\n- **API Key**: Obtained from Shodan account dashboard\n- **Target Information**: IP addresses, domains, or network ranges to investigate\n- **Shodan CLI**: Python-based command-line tool installed\n- **Authorization**: Written permission for reconnaissance on target networks\n\n## Outputs \u002F Deliverables\n\n- **Asset Inventory**: List of discovered hosts, ports, and services\n- **Vulnerability Report**: Identified CVEs and exposed vulnerable services\n- **Banner Data**: Service banners revealing software versions\n- **Network Mapping**: Geographic and organizational distribution of assets\n- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces\n- **Exported Data**: JSON\u002FCSV files for further analysis\n\n## Core Workflow\n\n### 1. Setup and Configuration\n\n#### Install Shodan CLI\n```bash\n# Using pip\npip install shodan\n\n# Or easy_install\neasy_install shodan\n\n# On BlackArch\u002FArch Linux\nsudo pacman -S python-shodan\n```\n\n#### Initialize API Key\n```bash\n# Set your API key\nshodan init YOUR_API_KEY\n\n# Verify setup\nshodan info\n# Output: Query credits available: 100\n#         Scan credits available: 100\n```\n\n#### Check Account Status\n```bash\n# View credits and plan info\nshodan info\n\n# Check your external IP\nshodan myip\n\n# Check CLI version\nshodan version\n```\n\n### 2. Basic Host Reconnaissance\n\n#### Query Single Host\n```bash\n# Get all information about an IP\nshodan host 1.1.1.1\n\n# Example output:\n# 1.1.1.1\n# Hostnames: one.one.one.one\n# Country: Australia\n# Organization: Mountain View Communications\n# Number of open ports: 3\n# Ports:\n#   53\u002Fudp\n#   80\u002Ftcp\n#   443\u002Ftcp\n```\n\n#### Check if Host is Honeypot\n```bash\n# Get honeypot probability score\nshodan honeyscore 192.168.1.100\n\n# Output: Not a honeypot\n#         Score: 0.3\n```\n\n### 3. Search Queries\n\n#### Basic Search (Free)\n```bash\n# Simple keyword search (no credits consumed)\nshodan search apache\n\n# Specify output fields\nshodan search --fields ip_str,port,os smb\n```\n\n#### Filtered Search (1 Credit)\n```bash\n# Product-specific search\nshodan search product:mongodb\n\n# Search with multiple filters\nshodan search product:nginx country:US city:\"New York\"\n```\n\n#### Count Results\n```bash\n# Get result count without consuming credits\nshodan count openssh\n# Output: 23128\n\nshodan count openssh 7\n# Output: 219\n```\n\n#### Download Results\n```bash\n# Download 1000 results (default)\nshodan download results.json.gz \"apache country:US\"\n\n# Download specific number of results\nshodan download --limit 5000 results.json.gz \"nginx\"\n\n# Download all available results\nshodan download --limit -1 all_results.json.gz \"query\"\n```\n\n#### Parse Downloaded Data\n```bash\n# Extract specific fields from downloaded data\nshodan parse --fields ip_str,port,hostnames results.json.gz\n\n# Filter by specific criteria\nshodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz\n\n# Export to CSV format\nshodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv\n```\n\n### 4. Search Filters Reference\n\n#### Network Filters\n```\nip:1.2.3.4                  # Specific IP address\nnet:192.168.0.0\u002F24          # Network range (CIDR)\nhostname:example.com        # Hostname contains\nport:22                     # Specific port\nasn:AS15169                 # Autonomous System Number\n```\n\n#### Geographic Filters\n```\ncountry:US                  # Two-letter country code\ncountry:\"United States\"     # Full country name\ncity:\"San Francisco\"        # City name\nstate:CA                    # State\u002Fregion\npostal:94102                # Postal\u002FZIP code\ngeo:37.7,-122.4             # Lat\u002Flong coordinates\n```\n\n#### Organization Filters\n```\norg:\"Google\"                # Organization name\nisp:\"Comcast\"               # ISP name\n```\n\n#### Service\u002FProduct Filters\n```\nproduct:nginx               # Software product\nversion:1.14.0              # Software version\nos:\"Windows Server 2019\"    # Operating system\nhttp.title:\"Dashboard\"      # HTTP page title\nhttp.html:\"login\"           # HTML content\nhttp.status:200             # HTTP status code\nssl.cert.subject.cn:*.example.com  # SSL certificate\nssl:true                    # Has SSL enabled\n```\n\n#### Vulnerability Filters\n```\nvuln:CVE-2019-0708          # Specific CVE\nhas_vuln:true               # Has any vulnerability\n```\n\n#### Screenshot Filters\n```\nhas_screenshot:true         # Has screenshot available\nscreenshot.label:webcam     # Screenshot type\n```\n\n### 5. On-Demand Scanning\n\n#### Submit Scan\n```bash\n# Scan single IP (1 credit per IP)\nshodan scan submit 192.168.1.100\n\n# Scan with verbose output (shows scan ID)\nshodan scan submit --verbose 192.168.1.100\n\n# Scan and save results\nshodan scan submit --filename scan_results.json.gz 192.168.1.100\n```\n\n#### Monitor Scan Status\n```bash\n# List recent scans\nshodan scan list\n\n# Check specific scan status\nshodan scan status SCAN_ID\n\n# Download scan results later\nshodan download --limit -1 results.json.gz scan:SCAN_ID\n```\n\n#### Available Scan Protocols\n```bash\n# List available protocols\u002Fmodules\nshodan scan protocols\n```\n\n### 6. Statistics and Analysis\n\n#### Get Search Statistics\n```bash\n# Default statistics (top 10 countries, orgs)\nshodan stats nginx\n\n# Custom facets\nshodan stats --facets domain,port,asn --limit 5 nginx\n\n# Save to CSV\nshodan stats --facets country,org -O stats.csv apache\n```\n\n### 7. Network Monitoring\n\n#### Setup Alerts (Web Interface)\n```\n1. Navigate to Monitor Dashboard\n2. Add IP, range, or domain to monitor\n3. Configure notification service (email, Slack, webhook)\n4. Select trigger events (new service, vulnerability, etc.)\n5. View dashboard for exposed services\n```\n\n### 8. REST API Usage\n\n#### Direct API Calls\n```bash\n# Get API info\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fapi-info?key=YOUR_KEY\" | jq\n\n# Host lookup\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002F1.1.1.1?key=YOUR_KEY\" | jq\n\n# Search query\ncurl -s \"https:\u002F\u002Fapi.shodan.io\u002Fshodan\u002Fhost\u002Fsearch?key=YOUR_KEY&query=apache\" | jq\n```\n\n#### Python Library\n```python\nimport shodan\n\napi = shodan.Shodan('YOUR_API_KEY')\n\n# Search\nresults = api.search('apache')\nprint(f'Results found: {results[\"total\"]}')\nfor result in results['matches']:\n    print(f'IP: {result[\"ip_str\"]}')\n\n# Host lookup\nhost = api.host('1.1.1.1')\nprint(f'IP: {host[\"ip_str\"]}')\nprint(f'Organization: {host.get(\"org\", \"n\u002Fa\")}')\nfor item in host['data']:\n    print(f'Port: {item[\"port\"]}')\n```\n\n## Quick Reference\n\n### Essential CLI Commands\n\n| Command | Description | Credits |\n|---------|-------------|---------|\n| `shodan init KEY` | Initialize API key | 0 |\n| `shodan info` | Show account info | 0 |\n| `shodan myip` | Show your IP | 0 |\n| `shodan host IP` | Host details | 0 |\n| `shodan count QUERY` | Result count | 0 |\n| `shodan search QUERY` | Basic search | 0* |\n| `shodan download FILE QUERY` | Save results | 1\u002F100 results |\n| `shodan parse FILE` | Extract data | 0 |\n| `shodan stats QUERY` | Statistics | 1 |\n| `shodan scan submit IP` | On-demand scan | 1\u002FIP |\n| `shodan honeyscore IP` | Honeypot check | 0 |\n\n*Filters consume 1 credit per query\n\n### Common Search Queries\n\n| Purpose | Query |\n|---------|-------|\n| Find webcams | `webcam has_screenshot:true` |\n| MongoDB databases | `product:mongodb` |\n| Redis servers | `product:redis` |\n| Elasticsearch | `product:elastic port:9200` |\n| Default passwords | `\"default password\"` |\n| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |\n| Industrial systems | `port:502 modbus` |\n| Cisco devices | `product:cisco` |\n| Open VNC | `port:5900 authentication disabled` |\n| Exposed FTP | `port:21 anonymous` |\n| WordPress sites | `http.component:wordpress` |\n| Printers | `\"HP-ChaiSOE\" port:80` |\n| Cameras (RTSP) | `port:554 has_screenshot:true` |\n| Jenkins servers | `X-Jenkins port:8080` |\n| Docker APIs | `port:2375 product:docker` |\n\n### Useful Filter Combinations\n\n| Scenario | Query |\n|---------|-------|\n| Target org recon | `org:\"Company Name\"` |\n| Domain enumeration | `hostname:example.com` |\n| Network range scan | `net:192.168.0.0\u002F24` |\n| SSL cert search | `ssl.cert.subject.cn:*.target.com` |\n| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |\n| Exposed admin panels | `http.title:\"admin\" port:443` |\n| Database exposure | `port:3306,5432,27017,6379` |\n\n### Credit System\n\n| Action | Credit Type | Cost |\n|--------|-------------|------|\n| Basic search | Query | 0 (no filters) |\n| Filtered search | Query | 1 |\n| Download 100 results | Query | 1 |\n| Generate report | Query | 1 |\n| Scan 1 IP | Scan | 1 |\n| Network monitoring | Monitored IPs | Depends on plan |\n\n## Constraints and Limitations\n\n### Operational Boundaries\n- Rate limited to 1 request per second\n- Scan results not immediate (asynchronous)\n- Cannot re-scan same IP within 24 hours (non-Enterprise)\n- Free accounts have limited credits\n- Some data requires paid subscription\n\n### Data Freshness\n- Shodan crawls continuously but data may be days\u002Fweeks old\n- On-demand scans provide current data but cost credits\n- Historical data available with paid plans\n\n### Legal Requirements\n- Only perform reconnaissance on authorized targets\n- Passive reconnaissance generally legal but verify jurisdiction\n- Active scanning (scan submit) requires authorization\n- Document all reconnaissance activities\n\n## Examples\n\n### Example 1: Organization Reconnaissance\n```bash\n# Find all hosts belonging to target organization\nshodan search 'org:\"Target Company\"'\n\n# Get statistics on their infrastructure\nshodan stats --facets port,product,country 'org:\"Target Company\"'\n\n# Download detailed data\nshodan download target_data.json.gz 'org:\"Target Company\"'\n\n# Parse for specific info\nshodan parse --fields ip_str,port,product target_data.json.gz\n```\n\n### Example 2: Vulnerable Service Discovery\n```bash\n# Find hosts vulnerable to BlueKeep (RDP CVE)\nshodan search 'vuln:CVE-2019-0708 country:US'\n\n# Find exposed Elasticsearch with no auth\nshodan search 'product:elastic port:9200 -authentication'\n\n# Find Log4j vulnerable systems\nshodan search 'vuln:CVE-2021-44228'\n```\n\n### Example 3: IoT Device Discovery\n```bash\n# Find exposed webcams\nshodan search 'webcam has_screenshot:true country:US'\n\n# Find industrial control systems\nshodan search 'port:502 product:modbus'\n\n# Find exposed printers\nshodan search '\"HP-ChaiSOE\" port:80'\n\n# Find smart home devices\nshodan search 'product:nest'\n```\n\n### Example 4: SSL\u002FTLS Certificate Analysis\n```bash\n# Find hosts with specific SSL cert\nshodan search 'ssl.cert.subject.cn:*.example.com'\n\n# Find expired certificates\nshodan search 'ssl.cert.expired:true org:\"Company\"'\n\n# Find self-signed certificates\nshodan search 'ssl.cert.issuer.cn:self-signed'\n```\n\n### Example 5: Python Automation Script\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport shodan\nimport json\n\nAPI_KEY = 'YOUR_API_KEY'\napi = shodan.Shodan(API_KEY)\n\ndef recon_organization(org_name):\n    \"\"\"Perform reconnaissance on an organization\"\"\"\n    try:\n        # Search for organization\n        query = f'org:\"{org_name}\"'\n        results = api.search(query)\n        \n        print(f\"[*] Found {results['total']} hosts for {org_name}\")\n        \n        # Collect unique IPs and ports\n        hosts = {}\n        for result in results['matches']:\n            ip = result['ip_str']\n            port = result['port']\n            product = result.get('product', 'unknown')\n            \n            if ip not in hosts:\n                hosts[ip] = []\n            hosts[ip].append({'port': port, 'product': product})\n        \n        # Output findings\n        for ip, services in hosts.items():\n            print(f\"\\n[+] {ip}\")\n            for svc in services:\n                print(f\"    - {svc['port']}\u002Ftcp ({svc['product']})\")\n        \n        return hosts\n        \n    except shodan.APIError as e:\n        print(f\"Error: {e}\")\n        return None\n\nif __name__ == '__main__':\n    recon_organization(\"Target Company\")\n```\n\n### Example 6: Network Range Assessment\n```bash\n# Scan a \u002F24 network range\nshodan search 'net:192.168.1.0\u002F24'\n\n# Get port distribution\nshodan stats --facets port 'net:192.168.1.0\u002F24'\n\n# Find specific vulnerabilities in range\nshodan search 'net:192.168.1.0\u002F24 vuln:CVE-2021-44228'\n\n# Export all data for range\nshodan download network_scan.json.gz 'net:192.168.1.0\u002F24'\n```\n\n## Troubleshooting\n\n| Issue | Cause | Solution |\n|-------|-------|----------|\n| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |\n| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |\n| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |\n| Rate Limit Exceeded | >1 request\u002Fsecond | Add `time.sleep(1)` between API requests |\n| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:\"Company Name\"'`; broaden criteria |\n| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":36,"source":27,"metadata":37,"description":7},"unknown",{"author":38,"version":39},"zebbern","1.1","master","dff58085da947e81e8418c922055644bf0082b1b","data\u002Fshodan-reconnaissance","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills","https:\u002F\u002Fgithub.com\u002Freikiplanet","https:\u002F\u002Fwww.reiki-planet.com","Reiki Planet Game","2026-03-29 06:02:29",{"source":8,"skillName":5,"commands":49,"prompt":59,"zipAvailable":60},[50,53,56],{"tool":51,"command":52},"npx","npx skills add reikiplanet\u002Fdaoskills --skill shodan-reconnaissance",{"tool":54,"command":55},"bunx","bunx skills add reikiplanet\u002Fdaoskills --skill shodan-reconnaissance",{"tool":57,"command":58},"pnpm","pnpm dlx skills add reikiplanet\u002Fdaoskills --skill shodan-reconnaissance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fdata\u002Fshodan-reconnaissance\u002FSKILL.md",true,[],[63,89,101,116,136,159],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":31},"01M6G614JTEQJHPT8AKK3YQ18S","web-games","Web browser game development principles. Framework selection, WebGPU, optimization, PWA.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fweb-games\u002FSKILL.md",[],[70,71,72,73,74,75,27,76,77,78,79,80,81,82,83,84,85,86,87,88],"games","web games","web","grep","principles","selection","framework selection","edit","write","read","pwa","game","web browser","game development","Optimization","framework","browser","development","webgpu",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":31},"01M6G611H2YGV0GZFP90D38ZMJ","vr-ar","VR\u002FAR development principles. Comfort, interaction, performance requirements.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fvr-ar\u002FSKILL.md",[],[96,97,87,98,99,27,77,78,79,73,100,74],"ar","vr ar","interaction","requirements","performance",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":31},"01M6G60XNMHAMV1SV0EJ1CX0AY","templates","Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Ftemplates\u002FSKILL.md",[],[103,108,109,110,111,112,27,113,79,114,115,73],"project scaffolding","From Scratch","tech","project","scaffolding","use","projects","applications",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":31},"01M6G60T0GATMK3Q5H8GDC1Z8S","wcag-audit-patterns","Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or implementing ac...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fwcag-audit-patterns\u002FSKILL.md",[],[123,124,125,126,127,27,128,129,130,131,113,132,133,134,135],"wcag audit patterns","wcag audit","patterns","WCAG","audit","manual","with","automated testing","guidance","remediation","verification","accessibility","testing",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":31},"01M6G60PMCHW1FRZ63F931QK3R","vulnerability-scanner","Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fvulnerability-scanner\u002FSKILL.md",[],[143,144,145,146,147,148,149,150,27,79,73,151,74,152,153,154,155,156,157,158],"scanner","vulnerability scanner","vulnerability","prioritization","2025","mapping","chain","supply chain","Bash","analysis","risk","owasp","supply chain security","security","supply","advanced",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":31},"01M6G60JZBB8DK0W3DSG1WNMZK","threat-modeling-expert","Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture r...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fthreat-modeling-expert\u002FSKILL.md",[],[166,167,168,169,170,171,172,173,156,113,174,175,176,27,177,178,179,153,180,181],"modeling","threat modeling expert","threat modeling","expert","threat","risk assessment","architecture review","architecture","security architecture review","trees","security architecture","security requirement extraction","assessment","extraction","review","stride"]