Recon
Shodan
Internet-wide service search for banners, certs, and known exposures on in-scope IPs and orgs.
What it is
Shodan is a query service, not a scanner. Use it to see what the internet already knows about the client's allocations, certificates, and products before you send a packet. Results are historical — confirm anything you report with an in-window authorized scan.
Reach for it when
External recon and cloud perimeter reviews when the client has given org names, CIDRs, or certificate subjects.
Watch-outs
Queries against unrelated orgs or 'nearby' IPs are out of scope. Do not treat a Shodan hit as a live finding without verification. Honor the client's wish not to use third-party datasets that retain their banners.
Typical invocation
shodan search "org:\"Northwind Health\" port:443" --fields ip_str,port,org
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- Nmap
Network mapper for host discovery, port scans, and service/version detection on in-scope ranges.
- OWASP Amass
Attack-surface mapper for subdomain enumeration, ASN mapping, and OSINT on in-scope domains.
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.