Shodan — Internet Device Search

Shodan — Internet Device Search

Shodan indexes internet-connected devices and exposes metadata: open ports, running services, banners, TLS certificates, and known CVEs. Use it for security audits, reconnaissance, and asset discovery.

Requires: SHODAN_API_KEY — free tier at https://account.shodan.io (1 req/sec, 100 queries/month).

When to Use

• User wants to know what ports/services are exposed on a specific IP
• User wants to find vulnerable systems of a specific type (e.g. exposed databases)
• User is doing a security audit and needs external exposure info
• User asks "what does Shodan show for IP X" or "find exposed Redis servers"
• Asset discovery: find all internet-exposed assets for a company/ASN

How to Use

Look up a specific IP address

$ip  = "8.8.8.8"
$key = $env:SHODAN_API_KEY
$url = "https://api.shodan.io/shodan/host/${ip}?key=${key}"

$host = Invoke-RestMethod -Uri $url
Write-Host "IP:           $($host.ip_str)"
Write-Host "Organization: $($host.org)"
Write-Host "OS:           $($host.os)"
Write-Host "Country:      $($host.country_name)"
Write-Host "Open ports:   $($host.ports -join ', ')"
Write-Host ""
Write-Host "Services:"
$host.data | ForEach-Object {
    Write-Host "  Port $($_.port)/$($_.transport) — $($_.product) $($_.version)"
}

Search for exposed services by query

$query = [Uri]::EscapeDataString("port:27017 product:MongoDB")