---

name: shodan-recon description: Perform comprehensive reconnaissance using Shodan. Use for asset discovery, network mapping, and identifying internet-facing systems. Triggers on requests for "recon", "reconnaissance", "asset discovery", "find hosts", or "map network".

Shodan Reconnaissance Skill

Perform comprehensive reconnaissance and asset discovery using Shodan's extensive internet scanning database.

When to Use

• User requests reconnaissance on a domain or organization
• Need to discover internet-facing assets
• Mapping an organization's attack surface
• Finding exposed services or systems
• Authorized security assessments

Workflow

1. Initial Scope

   • Identify target (domain, organization, IP range)
   • Verify authorization for reconnaissance
   • Check Shodan API credits with shodan_api_info

2. DNS Enumeration

   • Use shodan_dns_lookup for domain resolution
   • Use shodan_dns_reverse for IP to hostname mapping

3. Asset Discovery

   • Use shodan_host_search with organization name
   • Common queries:
     • org:"Company Name"
     • hostname:example.com
     • net:192.168.0.0/24
     • ssl:"example.com"

4. Port and Service Enumeration

   • Analyze discovered hosts for open ports
   • Identify running services and versions
   • Check for common vulnerable services

5. Detailed Host Analysis

   • Use shodan_host_info for deep dive on interesting hosts
   • Include historical data for change tracking
   • Note vulnerabilities and weak configurations

6. Reporting

   • Summarize discovered assets
   • Highlight critical findings
   • Recommend next steps

Example Queries

Find Organization Assets

Copyorg:"Example Corp"

Find Web Servers by Domain

Copyhostname:example.com port:80,443

Find Exposed Databases

Copy"mongodb server information" port:27017 org:"Example Corp"

Find VPN Gateways

Copyssl:"example.com" port:443 product:vpn

Find Exposed Remote Access

Copyport:3389 org:"Example Corp"  # RDP
port:22 org:"Example Corp"    # SSH
port:5900 org:"Example Corp"  # VNC

Best Practices

1. Always verify authorization before reconnaissance
2. Start broad, then narrow down
3. Use facets to aggregate results efficiently
4. Cross-reference findings with other sources
5. Document all discovered assets
6. Respect rate limits and API quotas
7. Focus on actionable intelligence

Output Format

Provide results in structured format:

• Summary: Total assets discovered
• Critical Findings: High-priority items
• Asset Inventory: Categorized list of discovered systems
• Vulnerabilities: Known CVEs or weak configurations
• Recommendations: Next steps for analysis or remediation