Domain Reconnaissance
A 3-step recipe with Shodan. We can help you get access.
Recipe · 3 steps
Domain Reconnaissance
with Shodan
Map a domain's DNS footprint and inspect a resolved host.
- Retrieve the subdomains and DNS entries known for the domain.
- Resolve the chosen hostname under the domain to its IP address. The response is a map of hostname to IP address.
- Retrieve the full Shodan host record for the resolved IP.
What you'll need to have ready
- apiKey: Shodan API key passed as the `key` query parameter.
- domain: The apex domain to enumerate (e.g. "example.com").
- hostname: A hostname under the domain to resolve (e.g. "www.example.com").
- resolvedIp: The IP returned by the resolve step for the chosen hostname. The resolver responds with a map keyed by hostname, so the chosen IP is carried forward through thi
For your developer
Arazzo workflow shodan:domain-recon, 3 operations: getDomainDns → resolveHostnames → getHost. Specs on APIs.io.