loading
Loading content
loading
Recon
Passive Shodan enrichment for IP lists: ports and known CVEs.
overview
nrich takes a file of IPs and adds Shodan-sourced port and vulnerability context so you see what public scanners already recorded.
Lookups are passive: no packets to the target. Use it for early triage of large IP ranges before active scanning.
Trickest runs nrich as a managed Recon node: IP list in, --output shell or json, FILE and FOLDER out. Prefer naabu or masscan for live ports.
use cases
Feed resolved IPs and let nrich rank them by open ports and known CVEs, so scanner time goes to the hosts that already look exposed.
Run nrich after a resolver or ASN expansion to add ports, hostnames, and tech to bare addresses without touching the targets.
Pull Shodan's recorded CVEs for each IP to flag hosts carrying published issues before any active testing begins.
Emit --output json so each enriched IP lands as a row a later node can filter by port, tech, or CVE for targeted follow-up.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| output | STRING | --output | Output format (shell or json) [default: shell] |
| input | FILE | · | File containing an IP per line. Non-IPs are ignored |
Showing key inputs. nrich exposes 2 inputs in total.
example
# nrich: enrich an IP list with Shodan-derived ports/CVEsnrich ips.txt --output json198.51.100.10 ports=[80,443] cves=[CVE-2021-44228]203.0.113.5 ports=[22,8080] cves=[]192.0.2.8 ports=[443] cves=[CVE-2023-44487]198.51.100.44 ports=[25,465] cves=[]203.0.113.90 ports=[3389] cves=[]192.0.2.50 ports=[80,8443] cves=[CVE-2022-22965]guidance
Reach for nrich when you have a list of IPs and want exposure context before scanning. It queries Shodan passively for ports, tech, and CVEs without sending traffic. For an active port scan, use naabu or masscan.
Full Shodan API client for arbitrary queries. nrich is the focused bulk-enrichment path for an IP list.
Pulls hosts from Shodan, Censys, and FOFA by query. nrich enriches IPs you already have.
Active port scanner. Run it when you need live ports rather than Shodan's recorded view.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A list of IPs feeds nrich, which enriches each with Shodan data and writes the ports, tech, and CVEs as a queryable output.
Facts on this page come from the live Trickest tool library.