External Attack Surface Mapping with Shodan and DNS Recon - n8n Workflow

Cybersecurity Analysts and Pentesters: Users requiring automated domain reconnaissance and vulnerability exposure checks.
DevOps and Infrastructure Managers: Teams needing continuous monitoring of external-facing assets.
n8n Automation Specialists: Individuals seeking advanced n8n templates integrating external security APIs and custom code logic.
Technical Users: Anyone looking for a robust n8n workflow that handles API rate-limiting and complex JSON parsing.

Maintaining a clear understanding of your external attack surface is critical for security. Manually checking every IP address associated with a domain is time-consuming and error-prone. This specialized n8n workflow automates the entire process, starting with a domain name and ending with a detailed report of exposed services and banners gathered from Shodan, stored neatly in a Google Sheet.

This robust n8n workflow utilizes custom HTTP requests for DNS resolution and API calls to Shodan, while incorporating essential features like rate-limiting (via an n8n node delay) to ensure compliance with API provider policies. If you are building security tools, this n8n template provides a solid foundation for continuous threat intelligence.

This automation begins with a manual n8n trigger, which initiates the reconnaissance scan. The overall n8n workflow operates in a highly structured, sequential manner:

1. Trigger and Initialization: The n8n trigger is manually activated. The initial Set Target Domain n8n node defines the domain targeted for scanning.


2. DNS Resolution: An HTTP Request n8n node queries Google’s public DNS service to retrieve all associated records (A, AAAA, CNAME, MX, etc.).


3. Data Extraction: A subsequent Code n8n node processes the often verbose DNS response, extracting all individual records.


4. IP Filtering: An IF n8n node filters these records, keeping only the A and AAAA records (the actual public IP addresses) required for the next Shodan query.


5. Rate Limiting: A crucial Delay n8n node (rate-limit) is introduced, pausing the execution for 10 seconds between processing each IP. This ensures the n8n workflow respects the limits of the Shodan free tier.


6. Shodan API Query: For each unique IP address, an HTTP Request n8n node calls the Shodan Search API to retrieve details about exposed services, ports, and banners.


7. Data Parsing: Another Code n8n node (Parse Shodan Data) handles the complex JSON structure returned by Shodan, flattening the service banners into digestible, structured data rows suitable for spreadsheet entry.


8. Logging: Finally, the parsed data is appended as new rows into a designated Google Sheets document via the Google Sheets n8n node, creating a comprehensive inventory of the attack surface.


9. Error Handling: The n8n workflow includes a designated Error Handler to catch any API or parsing failures without stopping the entire operation.

To deploy this powerful n8n template, follow these steps:

1. Import: Copy the provided JSON code and import it directly into your n8n instance.


2. Set Domain: Navigate to the Set Target Domain1 n8n node and update the configuration to include the target domain you wish to scan.


3. Shodan API Key: Locate the Shodan Search by IP n8n node. You must set up an n8n credential for the Shodan API (using the API Key authentication method) and ensure it is selected in the node settings.


4. Google Sheets Credentials: Configure a Google Sheets credential in n8n. In the Log to Google Sheets1 n8n node, select this credential and specify the Spreadsheet ID and Sheet Name where the results should be written.


5. Execution: Click the "Test workflow" n8n trigger to run the process manually, or activate the n8n workflow for continuous operation (if adapting the trigger).

This n8n workflow relies on several specialized n8n node types for technical execution:

When clicking 'Test workflow' (Manual Trigger n8n trigger): The starting point of the n8n workflow, allowing manual initiation of the scanning process.
Set Target Domain1 (Set n8n node): Initializes the workflow input. It sets the variable domain which controls the target of the DNS lookup.
DNS Lookup (Google)1 (HTTP Request n8n node): Executes the actual DNS query against Google’s public DNS resolver, fetching raw record data.
Extract DNS Records1 (Code n8n node): Essential custom scripting to iterate through the DNS query response and isolate individual records.
Filter: Only IP records1 (IF n8n node): A logic gate that routes only A and AAAA records (IP addresses) to the next step, ignoring CNAMEs or MX records.
Delay (rate-limit) (Wait n8n node): Implements a necessary 10-second delay per item to prevent exceeding Shodan's API rate limits, a critical component for stable, high-volume n8n automation.
Shodan Search by IP (HTTP Request n8n node): Queries the Shodan API using the extracted IP address to gather open port and service banner data.
Parse Shodan Data (Code n8n node): Performs complex data transformation, flattening the nested Shodan JSON output into a uniform table structure suitable for logging.

• Log to Google Sheets1 (Google Sheets n8n node): The final action n8n node, used to persist the reconnaissance results for review and reporting.