Shodan API search

shodan search 'apache' --limit 100

Search Shodan for internet-exposed devices and services, querying the scanner index via the API or CLI.

Run it during the reconnaissance phase when you want the target's exposed surface: shodan search queries Shodan's index (internet-scanned devices and services) with the filter — domain hosts, services (apache, ssh, rdp), vulnerabilities — and reports IPs with banners and ports. It's the reference internet scanner: the surface an attacker would see without touching the target. In recon (and red teaming), Shodan gives the target's exposure — public services, forgotten devices, exposed configurations — before active scanning.

Don't use it as a complete inventory: Shodan indexes what it scans (services and ports in its coverage) — the real surface may have more (and less) than indexed; active scanning complements. The Shodan API has limits (plan queries): use it judiciously. And beware: Shodan results require interpretation — an IP with a service doesn't confirm target ownership (shared hosts, CDNs); verify findings. For search without API, use the website; CLI for the recon flow.