sickn33/antigravity-awesome-skills/shodan-reconnaissance

# Find all hosts belonging to target organization
shodan search 'org:"Target Company"'
 
# Get statistics on their infrastructure
shodan stats --facets port,product,country 'org:"Target Company"'
 
# Download detailed data
shodan download target_data.json.gz 'org:"Target Company"'
 
# Parse for specific info
shodan parse --fields ip_str,port,product target_data.json.gz

# Find hosts vulnerable to BlueKeep (RDP CVE)
shodan search 'vuln:CVE-2019-0708 country:US'
 
# Find Elasticsearch banner candidates; absence of an authentication keyword does not prove no auth
shodan search 'product:elastic port:9200 -authentication'
 
# Find Log4j vulnerable systems
shodan search 'vuln:CVE-2021-44228'

# Find exposed webcams
shodan search 'webcam has_screenshot:true country:US'
 
# Find industrial control systems
shodan search 'port:502 product:modbus'
 
# Find exposed printers
shodan search '"HP-ChaiSOE" port:80'
 
# Find smart home devices
shodan search 'product:nest'

# Find hosts with specific SSL cert
shodan search 'ssl.cert.subject.cn:*.example.com'
 
# Find expired certificates
shodan search 'ssl.cert.expired:true org:"Company"'
 
# Find self-signed certificates
# Inspect issuer/subject and verify signature; issuer CN text alone cannot establish self-signing.

#!/usr/bin/env python3
import shodan
import json
import os
API_KEY = os.environ["SHODAN_API_KEY"]
api = shodan.Shodan(API_KEY)
def recon_organization(org_name):
    """Perform reconnaissance on an organization"""
    try:
        # Search for organization
        query = f'org:"{org_name}"'
        results = api.search(query)
        
        print(f"[*] Found {results['total']} matching banners; this response is one page")
        
        # Collect unique IPs and ports
        hosts = {}
        for result in results['matches']:
            ip = result['ip_str']
            port = result['port']
            product = result.get('product', 'unknown')
            
            if ip not in hosts:
                hosts[ip] = []
            hosts[ip].append({'port': port, 'product': product, 'transport': result.get('transport', 'unknown')})
        
        # Output findings
        for ip, services in hosts.items():
            print(f"\n[+] {ip}")
            for svc in services:
                print(f"    - {svc['port']}/{svc['transport']} ({svc['product']})")
        
        return hosts
        
    except shodan.APIError as e:
        print(f"Error: {e}")
        return None
if __name__ == '__main__':
    recon_organization("Target Company")

# Scan a /24 network range
shodan search 'net:203.0.113.0/24'
 
# Get port distribution
shodan stats --facets port 'net:203.0.113.0/24'
 
# Find specific vulnerabilities in range
shodan search 'net:203.0.113.0/24 vuln:CVE-2021-44228'
 
# Export all data for range
shodan download network_scan.json.gz 'net:203.0.113.0/24'