# Shodan API

> Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.

- Skill: `liberty91ltd/shodan-api` (Agent Skill)
- Install (CLI): `npx skillmds@latest add liberty91ltd/shodan-api`
- Raw SKILL.md: https://api.skillmd.com/api/skills/liberty91ltd/shodan-api/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: Liberty91LTD (https://skillmd.com/u/liberty91ltd)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/liberty91ltd/shodan-api

---


# Shodan API

## Base URL
`https://api.shodan.io`

## Authentication
Query parameter: `?key=$SHODAN_API_KEY`

## Rate Limits
- Free: 1 request/second, 100 results/search
- Paid: Higher limits and more features

## Key Endpoints

### Host Information
```bash
curl -s "https://api.shodan.io/shodan/host/{ip}?key=$SHODAN_API_KEY"
```
**Useful fields:**
- `ip_str` — IP address
- `ports` — open ports
- `data[]` — service banners per port (product, version, transport)
- `os` — detected OS
- `hostnames` — reverse DNS
- `vulns` — CVE list (paid feature)
- `org` — organisation
- `isp` — ISP
- `country_code` — country
- `last_update` — last scan date

### DNS Resolution
```bash
curl -s "https://api.shodan.io/dns/resolve?hostnames={domain}&key=$SHODAN_API_KEY"
```

### Reverse DNS
```bash
curl -s "https://api.shodan.io/dns/reverse?ips={ip}&key=$SHODAN_API_KEY"
```

### Search
```bash
curl -s "https://api.shodan.io/shodan/host/search?query={query}&key=$SHODAN_API_KEY"
```
**Search filters:** `port:`, `org:`, `country:`, `product:`, `version:`, `ssl.cert.subject.cn:`, `http.title:`, `vuln:`

### API Info (check credits)
```bash
curl -s "https://api.shodan.io/api-info?key=$SHODAN_API_KEY"
```

## Common Queries
- `ssl.cert.subject.cn:example.com` — find hosts with specific SSL certificate
- `org:"Target Org"` — find hosts belonging to an org
- `product:"Apache" port:443 country:RU` — specific service in a country
- `vuln:CVE-2024-12345` — hosts vulnerable to specific CVE (paid)

## Response Summary Format
```yaml
ip: <IP>
hostnames: [<list>]
org: <organisation>
isp: <ISP>
country: <country>
os: <operating system>
open_ports: [<port list>]
services:
  - port: 80
    product: nginx
    version: 1.18.0
vulnerabilities: [<CVE list>]  # paid only
last_update: <date>
```