Automate Shodan Reconnaissance for Pentesting

Provides systematic methodologies for leveraging Shodan as a reconnaissance tool during authorized penetration testing engagements, covering the Shodan web interface, CLI, REST API, search filters, on-demand scanning, and network monitoring for discovering exposed services, vulnerable systems, and IoT devices.

Use this skill for authorized reconnaissance engagements where written permission for the target network exists - discovering exposed hosts and services, identifying vulnerable systems by CVE, mapping an organization's internet-facing infrastructure, or monitoring a network for newly exposed services. Not for reconnaissance against any target without written authorization; active scanning specifically requires authorization even where passive lookup might be permissible, and all activity should be documented.

Setup covers installing the Shodan CLI (pip, easy_install, or pacman), initializing an API key with shodan init, and checking account credits with shodan info. Basic host reconnaissance covers shodan host IP for full host details and shodan honeyscore IP for honeypot probability. Search queries range from free basic keyword search to 1-credit filtered searches (product:mongodb, combined with country/city), credit-free result counting, and downloading/parsing results to JSON or CSV.

Documents the full search filter reference: network filters (ip, net CIDR, hostname, port, asn), geographic filters (country, city, state, geo coordinates), organization filters (org, isp), service/product filters (product, version, os, http.title, ssl.cert.subject.cn), vulnerability filters (vuln:CVE-xxxx, has_vuln:true), and screenshot filters. Covers on-demand scanning (shodan scan submit, monitoring scan status, downloading results by scan ID), search statistics with custom facets, network monitoring alerts via the web dashboard, and both REST API curl calls and the Python shodan library for programmatic search and host lookup.

Provides a quick-reference table of CLI commands with credit costs, a table of common search queries (webcams, MongoDB, Redis, vulnerable RDP via CVE-2019-0708, industrial Modbus systems, exposed Jenkins/Docker APIs), and six worked examples covering organization reconnaissance, vulnerable service discovery (BlueKeep, unauthenticated Elasticsearch, Log4j), IoT device discovery, SSL/TLS certificate analysis, a full Python automation script, and network range assessment. Operational constraints include a 1-request-per-second rate limit, a 24-hour re-scan restriction on non-Enterprise accounts, and data freshness caveats (continuous crawl but data may be days or weeks old).

Uses the Shodan CLI, REST API (via curl or the Python shodan library), and web-based Monitor Dashboard for alerting, with scan and query actions metered against a Shodan account's credit system.

Penetration testers and security researchers performing authorized reconnaissance who need concrete Shodan filter syntax, CLI commands, and credit-cost awareness rather than guessing at query syntax from the web UI alone.

shodan search 'vuln:CVE-2021-44228 country:US'