shodan-recon

You can discover internet-facing assets by running Shodan search queries for organizations, services, ports, vulnerabilities, and certificates. The skill returns exposure details including banners and location data to map your attack surface.

Host intelligence retrieval for a specific IP address provides detailed exposure data including running services, port banners, known vulnerabilities, and geographic location. This correlates indicators to investigate vulnerable infrastructure during incident response.

Yes, querying threat intelligence and exposure data requires a SHODAN_API_KEY environment variable. The skill uses this key with curl-based scripts to authenticate and interact with Shodan host, search, and exploit APIs for asset discovery.

Yes, attack surface mapping and vulnerability investigation are executed through curl-based scripts. These scripts query Shodan APIs to retrieve exposure details, allowing security teams to search for exposed hosts and investigate vulnerable infrastructure.

The best way to enrich threat intelligence is correlating indicators against Shodan reconnaissance results. By searching exposed hosts and retrieving host intelligence, security teams identify potential attack surface exposure and investigate vulnerable infrastructure.

Shodan reconnaissance applies directly to incident response scenarios and asset discovery. It maps internet-facing exposure data, helping security teams investigate vulnerable infrastructure, correlate indicators, and understand attack surface risks during active operations.