Shodan & Censys Recon

Shodan and Censys continuously scan the internet and expose the results. You query their data, so reconnaissance stays passive — you never send a packet to the target.

Tools

• Shodan — broadest device/banner coverage. Web, API, and shodan CLI.
• Censys — strong on certificates and structured host data.
• FOFA / ZoomEye / Netlas — useful alternatives with different coverage.

Query patterns (Shodan)