An IP, a CIDR up to /24, or a domain. Default scanme.nmap.org.
How It Works
Names resolve to IPs. Each IP is looked up in Shodan — no packets go to the target.
Needs a Shodan API key in SHODAN_API_KEY. A free key is enough.
Results
A PDF of open ports, products, and matching CVEs, plus the asset inventory.
Also writes report.json.
Overview
Scanning a third party you do not own is a conversation with your legal team.
Scanning a company you are about to acquire, or a vendor mid-procurement, is often
off the table entirely. Yet their exposure becomes your exposure the day the deal
closes or the integration ships.
This gets you the picture without touching them. Shodan has already scanned the
internet, so a lookup returns what is open, what is running on it, and which known
CVEs match those versions, at the cost of an API call. You end with a per-asset
inventory and a report you can attach to a vendor review or a pre-deal file, which
is exposure management applied to a surface you
are not allowed to scan.
Nothing here reaches the target. Every packet was Shodan's, sent long before you
asked, so the same run is safe against a vendor, an acquisition target, or your
own ranges. This is the one workflow in the set that needs a credential from you:
store your Shodan key as the SHODAN_API_KEY vault variable before the first
run. A free key is enough.
Pipeline
Read the target IP, CIDR, or domain.
Resolve anything that is not already an address down to IPs.
shodan-python looks each IP up against Shodan's
host database.
Extract per-asset intelligence: open ports, transport, product and version,
organization, and matching CVEs.
Collect everything into one report.
Inputs
Target. One per line, as an IP, a CIDR no wider than /24, or a domain
that resolves. Anything that is not already an address is resolved to IPs
first, then each IP is looked up. The safe default is scanme.nmap.org, the
host Nmap publishes for exactly this kind of test.
SHODAN_API_KEY. Your Shodan API key, held as a vault variable rather than
typed into the graph. There is no default and no shared key: the lookup step
fails without it, so set it before the first run with
trickest var set SHODAN_API_KEY <key>. A free Shodan account is enough,
because host lookups do not spend query credits.
Outputs
A PDF report covering the Shodan asset inventory, the live web servers among
them, and the vulnerability findings.
A per-asset record for every IP: open port, transport, product and version
string, and owning organization.
The CVE matches Shodan already associates with those product versions. Treat
each as a lead to confirm rather than a confirmed finding.
Sample output
From a completed run against scanme.nmap.org, the host Nmap publishes for this
purpose.
The host lookup returns the record Shodan already holds:
45.33.32.156Hostnames: scanme.nmap.orgCity: FremontCountry: United States
Each asset is then broken out with what is running on it:
ip
port
transport
product
org
45.33.32.156
22
tcp
OpenSSH (6.6.1p1 Ubuntu 2ubuntu2.13)
Linode
45.33.32.156
80
tcp
Apache httpd (2.4.7)
Linode
45.33.32.156
123
udp
ntpd (3)
Linode
45.33.32.156
9929
tcp
upnp
Linode
45.33.32.156
31337
tcp
Elite
Linode
A product string with a version in it is the part that matters. That is what a CVE
match keys on, and it arrived without a scan.
FAQ
Do I need my own Shodan API key?
Yes, and it is the only thing this workflow asks you to supply. Store it as the
SHODAN_API_KEY vault variable before the first run, with
trickest var set SHODAN_API_KEY <key>. The lookup step fails without it, so set
it first rather than finding out from a failed run.
Does a free Shodan account work?
Yes. Host lookups do not consume query credits, so a free key covers the run.
Long target lists still meet Shodan's per-account rate limits, which is a reason
to split them across runs.
Does any traffic reach the target?
None. Every packet in this data was Shodan's, sent before you asked. The run is a
database lookup, which is what makes it usable against a vendor or an acquisition
target you have no authorization to scan.
How current is the data?
As current as Shodan's last visit to that host, which can be days or weeks old. A
finding here is a lead worth confirming, not live state, and a port that closed
yesterday can still show up.
How large a target can I give it?
An IP, a CIDR up to /24, or a domain that resolves. Split anything wider into
several runs so the per-IP lookups stay inside your rate limit.
Related workflows
ASN-Wide Vulnerability Scan. Reach for this
instead when passive data has gone stale and you are authorized to scan the
range and confirm the findings yourself.
Find Exposed Databases. Reach for this
instead when Shodan flagged a data-store port and you want authentication
actually tested rather than inferred from a banner.
Domain OSINT and Footprinting. Reach
for this instead when you are starting from a domain rather than an IP and need
the name-side picture first.