shodan-reconnaissance-and-pentesting
This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search
Оригинален текст · няма потвърден превод на българскиПърво прочетете инструкцията.
Файлът се зарежда от посочения източник само по ваше действие. Можете да го прочетете тук, да го копирате или да го запазите като .md.
GitHub хранилище- Звезди на репото
- 428
- Лиценз
- Не е посочен. Проверете в репозитория.
- Последна проверка на записа
- Няма посочена дата
Добавете в своя инструмент.
Командата отваря избора на skills от репозитория. Прочетете файла и условията на автора преди изпълнение.
npx skills add aiskillstore/marketplaceСтраницата копира текст. Не инсталира и не изпълнява нищо на устройството ви.
Откъс от SKILL.md
Началото на файла на автора, без превод.
Shodan Reconnaissance and Pentesting
Purpose
Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.
Inputs / Prerequisites
- Shodan Account: Free or paid account at shodan.io
- API Key: Obtained from Shodan account dashboard
- Target Information: IP addresses, domains, or network ranges to investigate
- Shodan CLI: Python-based command-line tool installed
- Authorization: Written permission for reconnaissance on target networks
Outputs / Deliverables
- Asset Inventory: List of discovered hosts, ports, and services
- Vulnerability Report: Identified CVEs and exposed vulnerable services
- Banner Data: Service banners revealing software versions
- Network Mapping: Geographic and organizational distribution of assets
- Screenshot Gallery: Visual reconnaissance of exposed interfaces
- Exported Data: JSON/CSV files for further analysis
Core Workflow
1. Setup and Configuration
Install Shodan CLI
# Using pip
pip install shodan
# Or easy_install
easy_install shodan
# On BlackArch/Arch Linux
sudo pacman -S python-shodan
Initialize API Key
# Set your API key
shodan init YOUR_API_KEY
# Verify setup
shodan info
# Output: Query credits available: 100
# Scan credits available: 100
Check Account Status
# View credits and plan info
shodan info
# Check your external IP
shodan myip
# Check CLI version
shodan version
2. Basic Host Reconnaissance
Query Single Host
# Get all information about an IP
shodan host 1.1.1.1
# Example output:
# 1.1.1.1
# Hostnames: one.one.one.one
# Country: Australia
# Organization: Mountain View Communications
# Number of open ports: 3
# Ports:
# 53/udp
# 80/tcp
# 443/tcp
Check if Host is Honeypot
# Get honeypot probability score
shodan honeyscore 192.168.1.100
# Output: Not a honeypot
# Score: 0.3
3. Search Queries
Basic Search (Free)
# Simple keyword search (no credits consumed)
shodan search apache
# Specify output fields
shodan search --fields ip_str,port,os smb