---
title: "Passive Port & CVE Scan (Shodan)"
canonical: https://trickest.com/library/shodan-threat-intelligence
description: "Read a target's open ports, product versions and matching CVEs out of Shodan's own data, so nothing you run reaches the target."
---

# Passive Port & CVE Scan (Shodan)

## Overview

Scanning a third party you do not own is a conversation with your legal team.
Scanning a company you are about to acquire, or a vendor mid-procurement, is often
off the table entirely. Yet their exposure becomes your exposure the day the deal
closes or the integration ships.

This gets you the picture without touching them. Shodan has already scanned the
internet, so a lookup returns what is open, what is running on it, and which known
CVEs match those versions, at the cost of an API call. You end with a per-asset
inventory and a report you can attach to a vendor review or a pre-deal file, which
is [exposure management](/use-cases/exposure-management) applied to a surface you
are not allowed to scan.

Nothing here reaches the target. Every packet was Shodan's, sent long before you
asked, so the same run is safe against a vendor, an acquisition target, or your
own ranges. This is the one workflow in the set that needs a credential from you:
store your Shodan key as the `SHODAN_API_KEY` vault variable before the first
run. A free key is enough.

## Pipeline

1. Read the target IP, CIDR, or domain.
2. Resolve anything that is not already an address down to IPs.
3. [shodan-python](/tools/shodan-python) looks each IP up against Shodan's
   host database.
4. Extract per-asset intelligence: open ports, transport, product and version,
   organization, and matching CVEs.
5. Collect everything into one report.

## Inputs

- **Target.** One per line, as an IP, a CIDR no wider than `/24`, or a domain
  that resolves. Anything that is not already an address is resolved to IPs
  first, then each IP is looked up. The safe default is `scanme.nmap.org`, the
  host Nmap publishes for exactly this kind of test.
- **SHODAN_API_KEY.** Your Shodan API key, held as a vault variable rather than
  typed into the graph. There is no default and no shared key: the lookup step
  fails without it, so set it before the first run with
  `trickest var set SHODAN_API_KEY <key>`. A free Shodan account is enough,
  because host lookups do not spend query credits.

## Outputs

- A PDF report covering the Shodan asset inventory, the live web servers among
  them, and the vulnerability findings.
- A per-asset record for every IP: open port, transport, product and version
  string, and owning organization.
- The CVE matches Shodan already associates with those product versions. Treat
  each as a lead to confirm rather than a confirmed finding.

## Sample output

From a completed run against `scanme.nmap.org`, the host Nmap publishes for this
purpose.

The host lookup returns the record Shodan already holds:

```
45.33.32.156
Hostnames:               scanme.nmap.org
City:                    Fremont
Country:                 United States
```

Each asset is then broken out with what is running on it:

```jsonl
{"ip": "45.33.32.156", "port": 22, "transport": "tcp", "product": "OpenSSH (6.6.1p1 Ubuntu 2ubuntu2.13)", "org": "Linode"}
{"ip": "45.33.32.156", "port": 80, "transport": "tcp", "product": "Apache httpd (2.4.7)", "org": "Linode"}
{"ip": "45.33.32.156", "port": 123, "transport": "udp", "product": "ntpd (3)", "org": "Linode"}
{"ip": "45.33.32.156", "port": 9929, "transport": "tcp", "product": "upnp", "org": "Linode"}
{"ip": "45.33.32.156", "port": 31337, "transport": "tcp", "product": "Elite", "org": "Linode"}
```

A product string with a version in it is the part that matters. That is what a CVE
match keys on, and it arrived without a scan.

## FAQ

### Do I need my own Shodan API key?

Yes, and it is the only thing this workflow asks you to supply. Store it as the
`SHODAN_API_KEY` vault variable before the first run, with
`trickest var set SHODAN_API_KEY <key>`. The lookup step fails without it, so set
it first rather than finding out from a failed run.

### Does a free Shodan account work?

Yes. Host lookups do not consume query credits, so a free key covers the run.
Long target lists still meet Shodan's per-account rate limits, which is a reason
to split them across runs.

### Does any traffic reach the target?

None. Every packet in this data was Shodan's, sent before you asked. The run is a
database lookup, which is what makes it usable against a vendor or an acquisition
target you have no authorization to scan.

### How current is the data?

As current as Shodan's last visit to that host, which can be days or weeks old. A
finding here is a lead worth confirming, not live state, and a port that closed
yesterday can still show up.

### How large a target can I give it?

An IP, a CIDR up to `/24`, or a domain that resolves. Split anything wider into
several runs so the per-IP lookups stay inside your rate limit.

## Related workflows

- [ASN-Wide Vulnerability Scan](/library/asn-vulnerability-scanner). Reach for this
  instead when passive data has gone stale and you are authorized to scan the
  range and confirm the findings yourself.
- [Find Exposed Databases](/library/exposed-database-scanner). Reach for this
  instead when Shodan flagged a data-store port and you want authentication
  actually tested rather than inferred from a banner.
- [Domain OSINT and Footprinting](/library/domain-osint-and-footprinting). Reach
  for this instead when you are starting from a domain rather than an IP and need
  the name-side picture first.

---
_Markdown source of https://trickest.com/library/shodan-threat-intelligence._