Passive Port & CVE Scan (Shodan)

Overview

Scanning a third party you do not own is a conversation with your legal team. Scanning a company you are about to acquire, or a vendor mid-procurement, is often off the table entirely. Yet their exposure becomes your exposure the day the deal closes or the integration ships.

This gets you the picture without touching them. Shodan has already scanned the internet, so a lookup returns what is open, what is running on it, and which known CVEs match those versions, at the cost of an API call. You end with a per-asset inventory and a report you can attach to a vendor review or a pre-deal file, which is exposure management applied to a surface you are not allowed to scan.

Nothing here reaches the target. Every packet was Shodan's, sent long before you asked, so the same run is safe against a vendor, an acquisition target, or your own ranges. This is the one workflow in the set that needs a credential from you: store your Shodan key as the SHODAN_API_KEY vault variable before the first run. A free key is enough.

Pipeline

1. Read the target IP, CIDR, or domain.
2. Resolve anything that is not already an address down to IPs.
3. shodan-python looks each IP up against Shodan's host database.
4. Extract per-asset intelligence: open ports, transport, product and version, organization, and matching CVEs.
5. Collect everything into one report.

Inputs

• Target. One per line, as an IP, a CIDR no wider than /24, or a domain that resolves. Anything that is not already an address is resolved to IPs first, then each IP is looked up. The safe default is scanme.nmap.org, the host Nmap publishes for exactly this kind of test.
• SHODAN_API_KEY. Your Shodan API key, held as a vault variable rather than typed into the graph. There is no default and no shared key: the lookup step fails without it, so set it before the first run with trickest var set SHODAN_API_KEY <key>. A free Shodan account is enough, because host lookups do not spend query credits.

Outputs

• A PDF report covering the Shodan asset inventory, the live web servers among them, and the vulnerability findings.
• A per-asset record for every IP: open port, transport, product and version string, and owning organization.
• The CVE matches Shodan already associates with those product versions. Treat each as a lead to confirm rather than a confirmed finding.

Sample output

From a completed run against scanme.nmap.org, the host Nmap publishes for this purpose.

The host lookup returns the record Shodan already holds:

45.33.32.156
Hostnames:               scanme.nmap.org
City:                    Fremont
Country:                 United States

Each asset is then broken out with what is running on it:

A product string with a version in it is the part that matters. That is what a CVE match keys on, and it arrived without a scan.

FAQ

Do I need my own Shodan API key?

Yes, and it is the only thing this workflow asks you to supply. Store it as the SHODAN_API_KEY vault variable before the first run, with trickest var set SHODAN_API_KEY <key>. The lookup step fails without it, so set it first rather than finding out from a failed run.

Does a free Shodan account work?

Yes. Host lookups do not consume query credits, so a free key covers the run. Long target lists still meet Shodan's per-account rate limits, which is a reason to split them across runs.

Does any traffic reach the target?

None. Every packet in this data was Shodan's, sent before you asked. The run is a database lookup, which is what makes it usable against a vendor or an acquisition target you have no authorization to scan.

How current is the data?

As current as Shodan's last visit to that host, which can be days or weeks old. A finding here is a lead worth confirming, not live state, and a port that closed yesterday can still show up.

How large a target can I give it?

An IP, a CIDR up to /24, or a domain that resolves. Split anything wider into several runs so the per-IP lookups stay inside your rate limit.

Related workflows

• ASN-Wide Vulnerability Scan. Reach for this instead when passive data has gone stale and you are authorized to scan the range and confirm the findings yourself.
• Find Exposed Databases. Reach for this instead when Shodan flagged a data-store port and you want authentication actually tested rather than inferred from a banner.
• Domain OSINT and Footprinting. Reach for this instead when you are starting from a domain rather than an IP and need the name-side picture first.