loading
Loading content
loading
Network
Passive host discovery across multiple search-engine indexes.
overview
uncover fans one hunt across internet search engines so a single expression can return hosts from FOFA, Quake, Censys, Shodan, and related indexes without scanning the targets yourself.
Per-engine query files (-fofa, -quake, -censys, -shodan) and -engine select sources. -json emits JSONL; -field picks ip, port, or host; -limit and -retry keep large hunts inside provider quotas.
Trickest runs uncover as a managed network node that writes a file and a folder. Pair it with httpx or naabu to actively confirm results, because engine indexes can be stale.
use cases
Query Shodan or Censys for an org's exposed services and pull back the matching ips and ports, all sourced passively from the engines' own data.
Run the same search through Shodan, FOFA, Quake, and ZoomEye in a single node so coverage compounds across each provider's index.
Emit JSONL and choose the ip:port field so a downstream prober or port scanner receives clean, structured targets to confirm.
Set limit, rate-limit, and retry to keep a wide query within each engine's free or paid tier while still covering the surface.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| raw | BOOLEAN | -raw | write raw output as received by the remote api |
| fofa | FILE | -fofa | search query for fofa |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| field | STRING | -field | field to display in output (ip,port,host) (default "ip:port") |
| limit | STRING | -limit | limit the number of results to return (default 100) |
| quake | FILE | -quake | search query for quake |
| retry | STRING | -retry | number of times to retry a failed request (default 2) |
Showing key inputs. uncover exposes 29 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| raw | BOOLEAN | -raw | write raw output as received by the remote api |
| fofa | FILE | -fofa | search query for fofa |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| field | STRING | -field | field to display in output (ip,port,host) (default "ip:port") |
| limit | STRING | -limit | limit the number of results to return (default 100) |
| quake | FILE | -quake | search query for quake |
| retry | STRING | -retry | number of times to retry a failed request (default 2) |
| censys | FILE | -censys | search query for censys |
| config | FILE | -config | configuration file |
| engine | STRING | -engine | search engine to query (shodan,shodan-idb,fofa,censys,quake,hunter,zoomeye,netlas,publicwww,criminalip,hunterhow) (default shodan) |
| FILE | search query for google | ||
| hunter | FILE | -hunter | search query for hunter |
| netlas | FILE | -netlas | search query for netlas |
| shodan | FILE | -shodan | search query for shodan |
| silent | BOOLEAN | -silent | show only results in output |
| timeout | STRING | -timeout | timeout in seconds (default 30) |
| verbose | BOOLEAN | -v | show verbose output |
| zoomeye | FILE | -zoomeye | search query for zoomeye |
| no-color | STRING | -no-color | disable colors in output |
| provider | FILE | -provider | provider configuration file |
| hunterhow | FILE | -hunterhow | search query for hunterhow |
| publicwww | FILE | -publicwww | search query for publicwww |
| criminalip | FILE | -criminalip | search query for criminalip |
| query-file | FILE | -query | search query file |
| rate-limit | STRING | -rate-limit | maximum number of http requests to send per second |
| shodan-idb | FILE | -shodan-idb | search query for shodan-idb |
| query-string | STRING | -query | search query string |
| rate-limit-minute | STRING | -rate-limit-minute | maximum number of requests to send per minute |
| awesome-search-queries | STRING | -awesome-search-queries | use awesome search queries to discover exposed assets on the internet (example: -asq 'jira') |
example
# uncover: pull hosts matching an SSL title from multiple enginesuncover -q 'ssl:"example.com"' -censys -fofa -json -limit 50198.51.100.10:443203.0.113.5:8443api.example.com:443dev.example.com:443192.0.2.8:80staging.example.com:443guidance
Use uncover when you want passive exposure data from search engines rather than scanning the internet yourself. API keys are required for most engines. Confirm surfaced hosts with httpx or a port scanner before treating them as live.
Talks to Shodan only. uncover fans the same hunt across many engines.
Enriches a known IP list with Shodan data. uncover discovers hosts first.
Active port scanner. Run it after uncover to confirm reported ports.
faq
related
Map an organization's network ranges from ASN data.
Validate public DNS resolvers against trusted baselines.
Parallel ICMP echo sweeps for CIDR ranges and host files.
Probe a domain list for working HTTP and HTTPS servers.
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
Expand, aggregate, and slice CIDR ranges into host lists.
A search query feeds uncover, which pulls matching hosts from internet search engines and passes them to httpx for active confirmation before they land as a queryable output.
Facts on this page come from the live Trickest tool library.