Shodan

Shodan

The Shodan module is one of the most powerful reconnaissance engines in the framework. It interfaces with the Shodan search engine to extract profound intelligence on IP addresses, subdomains, open ports, banners, and vulnerabilities.

Important

Data Attribution: All hostnames, open ports, vulnerabilities, software tags, and related infrastructure intelligence, etc., extracted by this module are exclusively provided by Shodan.

To maximize flexibility, this module provides two entirely separate paths depending on your configuration in API Credentials.

1. Free InternetDB Intelligence

Condition: No API key configured.

If no API key is provided, the module operates in a free mode targeting internetdb.shodan.io. This allows unlimited, quota-free scans. The module accepts IPv4 and IPv6 nodes and extracts:

• Hostnames: Identifies associated PTR hostnames, tagging them as Reverse IP domains.
• Open Ports: Extracts a list of open Port numbers.
• Vulnerabilities: Identifies associated CVE identifiers. If vulnerabilities are found, the target IP itself is tagged with CVE.
• Software/Tags: Extracts CPE strings and high-level behavioral Tag properties.

---

2. Premium Intelligence (Shodan API)

Condition: Valid API key configured.

If an API key is present, the module switches to the premium Shodan API.

Note

The module performs preflight checks to monitor your query credits. If your API key is invalid or your credits drop to 0, it halts execution gracefully. You can configure parameters like ShodanScanSubdomains, ShodanDomainHistory, and ShodanIPHistory in your Network Configuration to tune the depth of the scans.

The premium capabilities are split into two distinct functions with different quota costs:

A. IP Host Profiling

Quota Cost: 0 Credits (Does not consume query credits)

The module accepts IPv4 and IPv6 nodes, pulling exhaustive details from the Shodan Host API:

• Network & ISP: Extracts the precise Organization, ISP, and ASN.
• Hostnames & Domains: Extracts reverse hostnames (tagged Reverse IP or PTR) and any root domains hosted on the IP.
• Service Banners: Extracts granular data for every open Port, including the exact Service, Web Server, CPE (and CPE23), Banner Timestamp, and geographic location.
• Vulnerability Scoring: Extracts exact CVE IDs along with their Summary, CVSS score, EPSS percentage, and whether the vulnerability is Verified by Shodan. (e.g. Heartbleed is extracted as a specific property).
• SSL Certificates: Deeply parses SSL banners to extract domains from the Subject Alternative Name (SAN) field (tagged San, and Wildcard if applicable), Cert Issuer, Cert Expiration, TLS Versions, Cert Fingerprint, and JARM signatures.

B. Domain & DNS Intelligence

Quota Cost: 1 Credit per successful page request

The module accepts Domain nodes (and optionally Subdomain nodes if configured). It queries the Shodan DNS API, paginating through results to map massive infrastructure perimeters:

• Subdomains: Discovers hundreds of subdomains, automatically tagging them as PDNS. If historical mode is enabled, it tags them as Historical.
• Deep DNS Parsing: Extracts and intelligently links a vast array of DNS records (e.g., A/AAAA, CNAME, MX, NS, TXT, etc.).
• DNS Contextualization: The module performs deep parsing and validation of the discovered DNS records, graphing inner targets (such as emails from SOA/DMARC, or IPs from SPF). The extraction logic is identical to the core DNS module.
• Timestamps: Attaches a Last Seen timestamp to every discovered DNS record.