The shodan module provides a comprehensive CLI for the Shodan search engine, enabling network reconnaissance, vulnerability detection, and monitoring of internet-connected assets.
When to Activate
- When performing reconnaissance on specific IPs or domain names.
- When searching for connected devices with specific vulnerabilities (CVEs) or open ports.
- When monitoring network alerts for specific assets.
- When generating real-time network intelligence summaries via AI integration (
::).
Core Principles & Rules
- API Key Management: Remind users to obtain and initialize their Shodan API key via
init. - Targeted Search: Support for powerful filtering based on facets (ports, protocols, countries).
- Data Export: Can download host information and export to structured formats like CSV.
Patterns & Examples
Scan IPs
# Perform a targeted scan on specific IP addresses and ports
x shodan scan create 8.8.8.8 1.1.1.1=53/dns-udp,443/https
Host Information
# Lookup IP information in the Shodan internet database
x shodan internetdb 8.8.8.8
AI Intelligence
# Use AI to summarize Shodan results for specific queries
x shodan :: "critical vulnerabilities in industrial control systems"
Checklist
- Ensure the Shodan API key is configured.
- Verify the search query or target IP range.
- Confirm if the user needs raw data or a summarized report.