---
name: Shodan Reconnaissance and Pentesting
description: "สกิลสำหรับ Shodan Reconnaissance ใช้เมื่อต้องการแนวทาง ขั้นตอน Template หรือคำแนะนำเชิงปฏิบัติสำหรับงาน IT, SysAdmin, Infrastructure, Security, Network, Server และระบบปฏิบัติการ ในหัวข้อนี้"
metadata:
  author: zebbern
  version: "1.1"
---

# สกิล: Shodan Reconnaissance

## Purpose

Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.

## Inputs / Prerequisites

- **Shodan Account**: Free or paid account at shodan.io
- **API Key**: Obtained from Shodan account dashboard
- **Target Information**: IP addresses, domains, or network ranges to investigate
- **Shodan CLI**: Python-based command-line tool installed
- **Authorization**: Written permission for reconnaissance on target networks

## Outputs / Deliverables

- **Asset Inventory**: List of discovered hosts, ports, and services
- **Vulnerability Report**: Identified CVEs and exposed vulnerable services
- **Banner Data**: Service banners revealing software versions
- **Network Mapping**: Geographic and organizational distribution of assets
- **Screenshot Gallery**: Visual reconnaissance of exposed interfaces
- **Exported Data**: JSON/CSV files for further analysis

## Core Workflow

### 1. Setup and Configuration

#### Install Shodan CLI
```bash
# สกิล: Shodan Reconnaissance
pip install shodan

# สกิล: Shodan Reconnaissance
easy_install shodan

# สกิล: Shodan Reconnaissance
sudo pacman -S python-shodan
```

#### Initialize API Key
```bash
# สกิล: Shodan Reconnaissance
shodan init YOUR_API_KEY

# สกิล: Shodan Reconnaissance
shodan info
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
```

#### Check Account Status
```bash
# สกิล: Shodan Reconnaissance
shodan info

# สกิล: Shodan Reconnaissance
shodan myip

# สกิล: Shodan Reconnaissance
shodan version
```

### 2. Basic Host Reconnaissance

#### Query Single Host
```bash
# สกิล: Shodan Reconnaissance
shodan host 1.1.1.1

# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
```

#### Check if Host is Honeypot
```bash
# สกิล: Shodan Reconnaissance
shodan honeyscore 192.168.1.100

# สกิล: Shodan Reconnaissance
# สกิล: Shodan Reconnaissance
```

### 3. Search Queries

#### Basic Search (Free)
```bash
# สกิล: Shodan Reconnaissance
shodan search apache

# สกิล: Shodan Reconnaissance
shodan search --fields ip_str,port,os smb
```

#### Filtered Search (1 Credit)
```bash
# สกิล: Shodan Reconnaissance
shodan search product:mongodb

# สกิล: Shodan Reconnaissance
shodan search product:nginx country:US city:"New York"
```

#### Count Results
```bash
# สกิล: Shodan Reconnaissance
shodan count openssh
# สกิล: Shodan Reconnaissance

shodan count openssh 7
# สกิล: Shodan Reconnaissance
```

#### Download Results
```bash
# สกิล: Shodan Reconnaissance
shodan download results.json.gz "apache country:US"

# สกิล: Shodan Reconnaissance
shodan download --limit 5000 results.json.gz "nginx"

# สกิล: Shodan Reconnaissance
shodan download --limit -1 all_results.json.gz "query"
```

#### Parse Downloaded Data
```bash
# สกิล: Shodan Reconnaissance
shodan parse --fields ip_str,port,hostnames results.json.gz

# สกิล: Shodan Reconnaissance
shodan parse --fields location.country_code3,ip_str -f port:22 results.json.gz

# สกิล: Shodan Reconnaissance
shodan parse --fields ip_str,port,org --separator , results.json.gz > results.csv
```

### 4. Search Filters Reference

#### Network Filters
```
ip:1.2.3.4                  # Specific IP address
net:192.168.0.0/24          # Network range (CIDR)
hostname:example.com        # Hostname contains
port:22                     # Specific port
asn:AS15169                 # Autonomous System Number
```

#### Geographic Filters
```
country:US                  # Two-letter country code
country:"United States"     # Full country name
city:"San Francisco"        # City name
state:CA                    # State/region
postal:94102                # Postal/ZIP code
geo:37.7,-122.4             # Lat/long coordinates
```

#### Organization Filters
```
org:"Google"                # Organization name
isp:"Comcast"               # ISP name
```

#### Service/Product Filters
```
product:nginx               # Software product
version:1.14.0              # Software version
os:"Windows Server 2019"    # Operating system
http.title:"Dashboard"      # HTTP page title
http.html:"login"           # HTML content
http.status:200             # HTTP status code
ssl.cert.subject.cn:*.example.com  # SSL certificate
ssl:true                    # Has SSL enabled
```

#### Vulnerability Filters
```
vuln:CVE-2019-0708          # Specific CVE
has_vuln:true               # Has any vulnerability
```

#### Screenshot Filters
```
has_screenshot:true         # Has screenshot available
screenshot.label:webcam     # Screenshot type
```

### 5. On-Demand Scanning

#### Submit Scan
```bash
# สกิล: Shodan Reconnaissance
shodan scan submit 192.168.1.100

# สกิล: Shodan Reconnaissance
shodan scan submit --verbose 192.168.1.100

# สกิล: Shodan Reconnaissance
shodan scan submit --filename scan_results.json.gz 192.168.1.100
```

#### Monitor Scan Status
```bash
# สกิล: Shodan Reconnaissance
shodan scan list

# สกิล: Shodan Reconnaissance
shodan scan status SCAN_ID

# สกิล: Shodan Reconnaissance
shodan download --limit -1 results.json.gz scan:SCAN_ID
```

#### Available Scan Protocols
```bash
# สกิล: Shodan Reconnaissance
shodan scan protocols
```

### 6. Statistics and Analysis

#### Get Search Statistics
```bash
# สกิล: Shodan Reconnaissance
shodan stats nginx

# สกิล: Shodan Reconnaissance
shodan stats --facets domain,port,asn --limit 5 nginx

# สกิล: Shodan Reconnaissance
shodan stats --facets country,org -O stats.csv apache
```

### 7. Network Monitoring

#### Setup Alerts (Web Interface)
```
1. Navigate to Monitor Dashboard
2. Add IP, range, or domain to monitor
3. Configure notification service (email, Slack, webhook)
4. Select trigger events (new service, vulnerability, etc.)
5. View dashboard for exposed services
```

### 8. REST API Usage

#### Direct API Calls
```bash
# สกิล: Shodan Reconnaissance
curl -s "https://api.shodan.io/api-info?key=YOUR_KEY" | jq

# สกิล: Shodan Reconnaissance
curl -s "https://api.shodan.io/shodan/host/1.1.1.1?key=YOUR_KEY" | jq

# สกิล: Shodan Reconnaissance
curl -s "https://api.shodan.io/shodan/host/search?key=YOUR_KEY&query=apache" | jq
```

#### Python Library
```python
import shodan

api = shodan.Shodan('YOUR_API_KEY')

# สกิล: Shodan Reconnaissance
results = api.search('apache')
print(f'Results found: {results["total"]}')
for result in results['matches']:
    print(f'IP: {result["ip_str"]}')

# สกิล: Shodan Reconnaissance
host = api.host('1.1.1.1')
print(f'IP: {host["ip_str"]}')
print(f'Organization: {host.get("org", "n/a")}')
for item in host['data']:
    print(f'Port: {item["port"]}')
```

## Quick Reference

### Essential CLI Commands

| Command | Description | Credits |
|---------|-------------|---------|
| `shodan init KEY` | Initialize API key | 0 |
| `shodan info` | Show account info | 0 |
| `shodan myip` | Show your IP | 0 |
| `shodan host IP` | Host details | 0 |
| `shodan count QUERY` | Result count | 0 |
| `shodan search QUERY` | Basic search | 0* |
| `shodan download FILE QUERY` | Save results | 1/100 results |
| `shodan parse FILE` | Extract data | 0 |
| `shodan stats QUERY` | Statistics | 1 |
| `shodan scan submit IP` | On-demand scan | 1/IP |
| `shodan honeyscore IP` | Honeypot check | 0 |

*Filters consume 1 credit per query

### Common Search Queries

| Purpose | Query |
|---------|-------|
| Find webcams | `webcam has_screenshot:true` |
| MongoDB databases | `product:mongodb` |
| Redis servers | `product:redis` |
| Elasticsearch | `product:elastic port:9200` |
| Default passwords | `"default password"` |
| Vulnerable RDP | `port:3389 vuln:CVE-2019-0708` |
| Industrial systems | `port:502 modbus` |
| Cisco devices | `product:cisco` |
| Open VNC | `port:5900 authentication disabled` |
| Exposed FTP | `port:21 anonymous` |
| WordPress sites | `http.component:wordpress` |
| Printers | `"HP-ChaiSOE" port:80` |
| Cameras (RTSP) | `port:554 has_screenshot:true` |
| Jenkins servers | `X-Jenkins port:8080` |
| Docker APIs | `port:2375 product:docker` |

### Useful Filter Combinations

| Scenario | Query |
|---------|-------|
| Target org recon | `org:"Company Name"` |
| Domain enumeration | `hostname:example.com` |
| Network range scan | `net:192.168.0.0/24` |
| SSL cert search | `ssl.cert.subject.cn:*.target.com` |
| Vulnerable servers | `vuln:CVE-2021-44228 country:US` |
| Exposed admin panels | `http.title:"admin" port:443` |
| Database exposure | `port:3306,5432,27017,6379` |

### Credit System

| Action | Credit Type | Cost |
|--------|-------------|------|
| Basic search | Query | 0 (no filters) |
| Filtered search | Query | 1 |
| Download 100 results | Query | 1 |
| Generate report | Query | 1 |
| Scan 1 IP | Scan | 1 |
| Network monitoring | Monitored IPs | Depends on plan |

## Constraints and Limitations

### Operational Boundaries
- Rate limited to 1 request per second
- Scan results not immediate (asynchronous)
- Cannot re-scan same IP within 24 hours (non-Enterprise)
- Free accounts have limited credits
- Some data requires paid subscription

### Data Freshness
- Shodan crawls continuously but data may be days/weeks old
- On-demand scans provide current data but cost credits
- Historical data available with paid plans

### Legal Requirements
- Only perform reconnaissance on authorized targets
- Passive reconnaissance generally legal but verify jurisdiction
- Active scanning (scan submit) requires authorization
- Document all reconnaissance activities

## Examples

### Example 1: Organization Reconnaissance
```bash
# สกิล: Shodan Reconnaissance
shodan search 'org:"Target Company"'

# สกิล: Shodan Reconnaissance
shodan stats --facets port,product,country 'org:"Target Company"'

# สกิล: Shodan Reconnaissance
shodan download target_data.json.gz 'org:"Target Company"'

# สกิล: Shodan Reconnaissance
shodan parse --fields ip_str,port,product target_data.json.gz
```

### Example 2: Vulnerable Service Discovery
```bash
# สกิล: Shodan Reconnaissance
shodan search 'vuln:CVE-2019-0708 country:US'

# สกิล: Shodan Reconnaissance
shodan search 'product:elastic port:9200 -authentication'

# สกิล: Shodan Reconnaissance
shodan search 'vuln:CVE-2021-44228'
```

### Example 3: IoT Device Discovery
```bash
# สกิล: Shodan Reconnaissance
shodan search 'webcam has_screenshot:true country:US'

# สกิล: Shodan Reconnaissance
shodan search 'port:502 product:modbus'

# สกิล: Shodan Reconnaissance
shodan search '"HP-ChaiSOE" port:80'

# สกิล: Shodan Reconnaissance
shodan search 'product:nest'
```

### Example 4: SSL/TLS Certificate Analysis
```bash
# สกิล: Shodan Reconnaissance
shodan search 'ssl.cert.subject.cn:*.example.com'

# สกิล: Shodan Reconnaissance
shodan search 'ssl.cert.expired:true org:"Company"'

# สกิล: Shodan Reconnaissance
shodan search 'ssl.cert.issuer.cn:self-signed'
```

### Example 5: Python Automation Script
```python
#!/usr/bin/env python3
import shodan
import json

API_KEY = 'YOUR_API_KEY'
api = shodan.Shodan(API_KEY)

def recon_organization(org_name):
    """Perform reconnaissance on an organization"""
    try:
        # Search for organization
        query = f'org:"{org_name}"'
        results = api.search(query)
        
        print(f"[*] Found {results['total']} hosts for {org_name}")
        
        # Collect unique IPs and ports
        hosts = {}
        for result in results['matches']:
            ip = result['ip_str']
            port = result['port']
            product = result.get('product', 'unknown')
            
            if ip not in hosts:
                hosts[ip] = []
            hosts[ip].append({'port': port, 'product': product})
        
        # Output findings
        for ip, services in hosts.items():
            print(f"\n[+] {ip}")
            for svc in services:
                print(f"    - {svc['port']}/tcp ({svc['product']})")
        
        return hosts
        
    except shodan.APIError as e:
        print(f"Error: {e}")
        return None

if __name__ == '__main__':
    recon_organization("Target Company")
```

### Example 6: Network Range Assessment
```bash
# สกิล: Shodan Reconnaissance
shodan search 'net:192.168.1.0/24'

# สกิล: Shodan Reconnaissance
shodan stats --facets port 'net:192.168.1.0/24'

# สกิล: Shodan Reconnaissance
shodan search 'net:192.168.1.0/24 vuln:CVE-2021-44228'

# สกิล: Shodan Reconnaissance
shodan download network_scan.json.gz 'net:192.168.1.0/24'
```

## Troubleshooting

| Issue | Cause | Solution |
|-------|-------|----------|
| No API Key Configured | Key not initialized | Run `shodan init YOUR_API_KEY` then verify with `shodan info` |
| Query Credits Exhausted | Monthly credits consumed | Use credit-free queries (no filters), wait for reset, or upgrade |
| Host Recently Crawled | Cannot re-scan IP within 24h | Use `shodan host IP` for existing data, or wait 24 hours |
| Rate Limit Exceeded | >1 request/second | Add `time.sleep(1)` between API requests |
| Empty Search Results | Too specific or syntax error | Use quotes for phrases: `'org:"Company Name"'`; broaden criteria |
| Downloaded File Won't Parse | Corrupted or wrong format | Verify with `gunzip -t file.gz`, re-download with `--limit` |
