shodan

Identify exposed internet devices and services via Shodan API queries.

779|139|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/taracodlabs/aiden --skill shodan-taracodlabs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: shodan
Source: https://github.com/taracodlabs/aiden/tree/main/skills/shodan
Command: npx skills add https://github.com/taracodlabs/aiden --skill shodan-taracodlabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams and researchers need quick visibility into internet-exposed devices, their ports, and services to assess risk and discover assets.

Core Features & Use Cases

  • Asset discovery: identify internet-exposed devices and enumerate open ports and banners.
  • Service enumeration & risk awareness: collect service information and related CVEs for asset risk assessment.
  • Use Case: Enumerate all exposed devices for a target organization and map assets to prioritize remediation.

Quick Start

Look up a target IP or domain with Shodan to reveal open ports, services, and banners.

Frequently Asked Questions about shodan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find internet-exposed devices and open ports for an organization?

To discover internet-exposed devices, query a target IP or domain to enumerate open ports, services, and banners, mapping assets to prioritize remediation during security audits.

What is Shodan used for in threat hunting and reconnaissance?

Shodan is used for reconnaissance and threat hunting to identify internet-facing devices, collect service information, and inventory exposed assets along with their associated CVEs for risk assessment.

Do I need an API key to scan for exposed services and CVEs?

Yes, you need a SHODAN_API_KEY to query the Shodan API for exposed services. The queries enforce rate limits and safe usage when gathering port and CVE data.

Can I use search queries instead of IPs for asset discovery?

Yes, you can perform asset discovery using custom search queries, as well as by IP or domain, to identify exposed devices and collect their service banners and vulnerability data.

Are there rate limits when querying for internet-facing devices?

Yes, querying for internet-facing devices enforces rate limits and safe usage constraints via the Shodan API to ensure controlled reconnaissance and service enumeration.