菜单
Search Shodan for internet-connected devices, lookup IPs, find exploits — via Python shodan library
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | shodan-recon |
| description | Search Shodan for internet-connected devices, lookup IPs, find exploits — via Python shodan library |
Use the Python shodan library via Bash to query the Shodan API. Requires SHODAN_API_KEY environment variable.
pip install shodan
The API key is read from $SHODAN_API_KEY. If not set, all commands will fail with an auth error.
Find internet-connected devices matching a query. Supports Shodan query syntax: port:22, country:US, product:Apache, city:Berlin, org:"Amazon", os:"Linux", etc.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
results = api.search('QUERY_HERE', limit=10)
print(f\"Total results: {results['total']}\")
for r in results['matches'][:10]:
ip = r['ip_str']
port = r['port']
org = r.get('org', '?')
product = r.get('product', '')
country = r.get('location', {}).get('country_name', '?')
vulns = ', '.join(r.get('vulns', {}).keys()) or 'none'
print(f'{ip}:{port} | {org} | {product} | {country} | vulns: {vulns}')
"
Adjust limit= to control how many results are returned (default 10, max 100 for free tier).
Get detailed information about a specific IP address: open ports, services, OS, vulnerabilities, hostnames.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
info = api.host('TARGET_IP')
print(f\"IP: {info.get('ip_str', '?')}\")
print(f\"Organization: {info.get('org', '?')}\")
print(f\"OS: {info.get('os', '?')}\")
print(f\"Ports: {', '.join(str(p) for p in info.get('ports', []))}\")
print(f\"Hostnames: {', '.join(info.get('hostnames', []))}\")
vulns = info.get('vulns', [])
print(f\"Vulns: {', '.join(vulns) if vulns else 'none'}\")
print(f\"Last update: {info.get('last_update', '?')}\")
if info.get('data'):
print(f\"Services ({len(info['data'])}):\" )
for svc in info['data'][:5]:
print(f\" port {svc.get('port')}/{svc.get('transport','?')}: {svc.get('product', '?')} {svc.get('version', '')}\")
"
Search for known exploits related to a product, CVE, or keyword.
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
results = api.exploits.search('QUERY_HERE', limit=5)
matches = results.get('matches', [])
if not matches:
print('No exploits found')
else:
print(f'Exploits ({len(matches)} results):')
for e in matches:
source = e.get('source', '?')
desc = e.get('description', '?')[:120]
print(f' [{source}] {desc}')
if e.get('cve'):
print(f' CVEs: {chr(44).join(e[\"cve\"])}')
"
python3 -c "
import shodan, os
api = shodan.Shodan(os.environ['SHODAN_API_KEY'])
print(f'Your public IP: {api.tools.myip()}')
"
api.search_cursor() for pagination.webcam -- internet-connected camerasport:23 default password -- telnet with default credsproduct:Apache country:DE -- Apache servers in Germanynet:192.168.0.0/16 -- devices in a specific rangehas_screenshot:true -- devices with screenshotsRun sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.
Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.
Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop
BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices
Run a sustained security assessment campaign — a real pentest, not a simulation
Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials