# Shodan: passive host intelligence during recon

> How to use the Shodan CLI and API for passive enrichment, and how Tandera uses it without sending traffic to the target.

Shodan continuously scans the internet and sells access to the results. For a pentester its value is that you can learn what ports, services and banners a host exposes **without sending it a single packet** — the scanning already happened, on someone else's schedule.

## Install

```bash
pip install shodan
shodan init <YOUR_API_KEY>
```

A paid plan is required for most useful queries; the free tier is heavily limited.

## Core commands

```bash
# everything Shodan knows about one address
shodan host 93.184.216.34

# search by organisation
shodan search 'org:"Example Inc"' --fields ip_str,port,hostnames

# pivot on a favicon hash from httpx
shodan search 'http.favicon.hash:-1545961456' --fields ip_str,port

# certificate-based pivot
shodan search 'ssl.cert.subject.CN:"example.com"' --fields ip_str,port,hostnames

# count without spending query credits on results
shodan count 'org:"Example Inc" port:3389'
```

## Output

```json
{"ip_str":"93.184.216.34","ports":[80,443,8443],
 "hostnames":["example.com"],"org":"Example Inc",
 "data":[{"port":8443,"product":"nginx","version":"1.18.0","timestamp":"2026-08-20T04:11:00Z"}]}
```

## Where it sits in Tandera

Shodan runs in the **enrich** phase of `recon_web_lite` and `recon_web_full`. Because it queries a third-party dataset rather than the target, it is permitted in the `NonIntrusive` lite flow — which is precisely why it is valuable there: it gives lite flows port and service intelligence they could not otherwise obtain.

## Using it in a pentest

**The data has a timestamp, and it matters.** A service Shodan saw three months ago may be gone. Every Shodan result is a lead to verify with `httpx` or `nmap`, never a finding on its own. Check the `timestamp` field before you act on anything.

**Favicon and certificate hashes are the best pivots.** `http.favicon.hash` from your `httpx` run will find sibling infrastructure — staging, DR, an old environment — that no DNS-based enumeration reaches.

**It sees what the perimeter forgot.** Hosts exposed directly, outside the CDN and outside the load balancer, are Shodan's speciality. Those are frequently the highest-value targets in an engagement.

**Respect the scope boundary.** `org:` searches return everything the organisation owns, including networks outside your engagement. Filter before probing.

---

Canonical: https://tandera.io/tools/shodan
This page as markdown: https://tandera.io/tools/shodan.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.