Menu
Search Shodan for internet-connected devices, lookup IPs, find exploits — via Python shodan library
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | shodan-recon |
| description | Search Shodan for internet-connected devices, lookup IPs, find exploits — via Python shodan library |
Use the Python shodan library via Bash to query the Shodan API. Requires SHODAN_API_KEY environment variable.
pip install shodan
The API key is read from $SHODAN_API_KEY. If not set, all commands will fail with an auth error.
Find internet-connected devices matching a query. Supports Shodan query syntax: port:22, country:US, product:Apache, city:Berlin, org:"Amazon", os:"Linux", etc.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
results = api.search('QUERY_HERE', limit=10)
print(f\"Total results: {results['total']}\")
for r in results['matches'][:10]:
ip = r['ip_str']
port = r['port']
org = r.get('org', '?')
product = r.get('product', '')
country = r.get('location', {}).get('country_name', '?')
vulns = ', '.join(r.get('vulns', {}).keys()) or 'none'
print(f'{ip}:{port} | {org} | {product} | {country} | vulns: {vulns}')
"
Adjust limit= to control how many results are returned (default 10, max 100 for free tier).
Get detailed information about a specific IP address: open ports, services, OS, vulnerabilities, hostnames.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
info = api.host('TARGET_IP')
print(f\"IP: {info.get('ip_str', '?')}\")
print(f\"Organization: {info.get('org', '?')}\")
print(f\"OS: {info.get('os', '?')}\")
print(f\"Ports: {', '.join(str(p) for p in info.get('ports', []))}\")
print(f\"Hostnames: {', '.join(info.get('hostnames', []))}\")
vulns = info.get('vulns', [])
print(f\"Vulns: {', '.join(vulns) if vulns else 'none'}\")
print(f\"Last update: {info.get('last_update', '?')}\")
if info.get('data'):
print(f\"Services ({len(info['data'])}):\" )
for svc in info['data'][:5]:
print(f\" port {svc.get('port')}/{svc.get('transport','?')}: {svc.get('product', '?')} {svc.get('version', '')}\")
"
Search for known exploits related to a product, CVE, or keyword.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
results = api.exploits.search('QUERY_HERE', limit=5)
matches = results.get('matches', [])
if not matches:
print('No exploits found')
else:
print(f'Exploits ({len(matches)} results):')
for e in matches:
source = e.get('source', '?')
desc = e.get('description', '?')[:120]
print(f' [{source}] {desc}')
if e.get('cve'):
print(f' CVEs: {chr(44).join(e[\"cve\"])}')
"
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
print(f'Your public IP: {api.tools.myip()}')
"
api.search_cursor() for pagination.webcam -- internet-connected camerasport:23 default password -- telnet with default credsproduct:Apache country:DE -- Apache servers in Germanynet:192.168.0.0/16 -- devices in a specific rangehas_screenshot:true -- devices with screenshotsRun sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.
Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.
Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop
BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices
Run a sustained security assessment campaign — a real pentest, not a simulation
Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials