shodan-recon

Discovers Internet-facing assets and vulnerabilities via Shodan queries.

1|1|Updated Feb 8, 2026

Search Tags:#reconnaissance #vulnerability analysis #threat intelligence #asset discovery #attack surface #shodan

Ready to run

npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill shodan-recon-dapperdivers

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: shodan-recon
Source: https://github.com/dapperdivers/roundtable-arsenal/tree/main/security/shodan-recon
Command: npx skills add https://github.com/dapperdivers/roundtable-arsenal --skill shodan-recon-dapperdivers

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, and includes scripts (resource) components.

What problem does it solve?

This Skill helps security teams discover and analyze internet-facing assets, reducing the effort required to understand exposure, vulnerabilities, and attack surface risks.

Core Features & Use Cases

Asset Discovery: Search Shodan for exposed hosts using queries for organizations, services, ports, vulnerabilities, and certificates.
Host Intelligence: Retrieve detailed information about specific IP addresses, including services, banners, vulnerabilities, and location data.
Threat Enrichment: Correlate indicators, investigate vulnerable infrastructure, and identify potential attack surface exposure during security operations.

Quick Start

Use the shodan-recon skill to search Shodan for internet-facing assets matching a specific query and return the exposure details.

Frequently Asked Questions about shodan-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover internet-facing assets using Shodan reconnaissance?▼

You can discover internet-facing assets by running Shodan search queries for organizations, services, ports, vulnerabilities, and certificates. The skill returns exposure details including banners and location data to map your attack surface.

What internet-facing exposure data can I retrieve for a specific IP address?▼

Host intelligence retrieval for a specific IP address provides detailed exposure data including running services, port banners, known vulnerabilities, and geographic location. This correlates indicators to investigate vulnerable infrastructure during incident response.

Do I need a Shodan API key to query threat intelligence and exposure data?▼

Yes, querying threat intelligence and exposure data requires a SHODAN_API_KEY environment variable. The skill uses this key with curl-based scripts to authenticate and interact with Shodan host, search, and exploit APIs for asset discovery.

Can I use curl scripts for attack surface mapping and vulnerability investigation?▼

Yes, attack surface mapping and vulnerability investigation are executed through curl-based scripts. These scripts query Shodan APIs to retrieve exposure details, allowing security teams to search for exposed hosts and investigate vulnerable infrastructure.

What is the best way to enrich threat intelligence with attack surface exposure data?▼

The best way to enrich threat intelligence is correlating indicators against Shodan reconnaissance results. By searching exposed hosts and retrieving host intelligence, security teams identify potential attack surface exposure and investigate vulnerable infrastructure.

Does Shodan reconnaissance work for incident response scenarios and asset discovery?▼

Shodan reconnaissance applies directly to incident response scenarios and asset discovery. It maps internet-facing exposure data, helping security teams investigate vulnerable infrastructure, correlate indicators, and understand attack surface risks during active operations.