Recon
Triage IP lists with passive Shodan context
Passive Shodan enrichment for IP lists: ports and known CVEs.
overview
What nrich does
nrich takes a file of IPs and adds Shodan-sourced port and vulnerability context so you see what public scanners already recorded.
Lookups are passive: no packets to the target. Use it for early triage of large IP ranges before active scanning.
Trickest runs nrich as a managed Recon node: IP list in, --output shell or json, FILE and FOLDER out. Prefer naabu or masscan for live ports.
use cases
Where nrich fits
Triage an IP list by exposure
Feed resolved IPs and let nrich rank them by open ports and known CVEs, so scanner time goes to the hosts that already look exposed.
Enrich discovery output passively
Run nrich after a resolver or ASN expansion to add ports, hostnames, and tech to bare addresses without touching the targets.
Surface known vulnerabilities early
Pull Shodan's recorded CVEs for each IP to flag hosts carrying published issues before any active testing begins.
Feed structured records downstream
Emit --output json so each enriched IP lands as a row a later node can filter by port, tech, or CVE for targeted follow-up.
reference
nrich inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| output | STRING | --output | Output format (shell or json) [default: shell] |
| input | FILE | · | File containing an IP per line. Non-IPs are ignored |
Showing key inputs. nrich exposes 2 inputs in total.
example
Run nrich
# nrich: enrich an IP list with Shodan-derived ports/CVEsnrich ips.txt --output json198.51.100.10 ports=[80,443] cves=[CVE-2021-44228]203.0.113.5 ports=[22,8080] cves=[]192.0.2.8 ports=[443] cves=[CVE-2023-44487]198.51.100.44 ports=[25,465] cves=[]203.0.113.90 ports=[3389] cves=[]192.0.2.50 ports=[80,8443] cves=[CVE-2022-22965]guidance
Choosing nrich
Reach for nrich when you have a list of IPs and want exposure context before scanning. It queries Shodan passively for ports, tech, and CVEs without sending traffic. For an active port scan, use naabu or masscan.
shodan-python
Full Shodan API client for arbitrary queries. nrich is the focused bulk-enrichment path for an IP list.
uncover
Pulls hosts from Shodan, Censys, and FOFA by query. nrich enriches IPs you already have.
naabu
Active port scanner. Run it when you need live ports rather than Shodan's recorded view.
faq
nrich questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run nrich yourself
A list of IPs feeds nrich, which enriches each with Shodan data and writes the ports, tech, and CVEs as a queryable output.
Facts on this page come from the live Trickest tool library.