Shodan: passive host intelligence during recon

Shodan · Commercial API

Shodan continuously scans the internet and sells access to the results. For a pentester its value is that you can learn what ports, services and banners a host exposes without sending it a single packet — the scanning already happened, on someone else’s schedule.

Install

pip install shodan
shodan init <YOUR_API_KEY>

A paid plan is required for most useful queries; the free tier is heavily limited.

Core commands

# everything Shodan knows about one address
shodan host 93.184.216.34

# search by organisation
shodan search 'org:"Example Inc"' --fields ip_str,port,hostnames

# pivot on a favicon hash from httpx
shodan search 'http.favicon.hash:-1545961456' --fields ip_str,port

# certificate-based pivot
shodan search 'ssl.cert.subject.CN:"example.com"' --fields ip_str,port,hostnames

# count without spending query credits on results
shodan count 'org:"Example Inc" port:3389'

Output

{"ip_str":"93.184.216.34","ports":[80,443,8443],
 "hostnames":["example.com"],"org":"Example Inc",
 "data":[{"port":8443,"product":"nginx","version":"1.18.0","timestamp":"2026-08-20T04:11:00Z"}]}

Where it sits in Tandera

Shodan runs in the enrich phase of recon_web_lite and recon_web_full. Because it queries a third-party dataset rather than the target, it is permitted in the NonIntrusive lite flow — which is precisely why it is valuable there: it gives lite flows port and service intelligence they could not otherwise obtain.

Using it in a pentest

The data has a timestamp, and it matters. A service Shodan saw three months ago may be gone. Every Shodan result is a lead to verify with httpx or nmap, never a finding on its own. Check the timestamp field before you act on anything.

Favicon and certificate hashes are the best pivots. http.favicon.hash from your httpx run will find sibling infrastructure — staging, DR, an old environment — that no DNS-based enumeration reaches.

It sees what the perimeter forgot. Hosts exposed directly, outside the CDN and outside the load balancer, are Shodan’s speciality. Those are frequently the highest-value targets in an engagement.

Respect the scope boundary. org: searches return everything the organisation owns, including networks outside your engagement. Filter before probing.