Network
Pull exposed hosts from internet search engines
Passive host discovery across multiple search-engine indexes.
overview
What uncover does
uncover fans one hunt across internet search engines so a single expression can return hosts from FOFA, Quake, Censys, Shodan, and related indexes without scanning the targets yourself.
Per-engine query files (-fofa, -quake, -censys, -shodan) and -engine select sources. -json emits JSONL; -field picks ip, port, or host; -limit and -retry keep large hunts inside provider quotas.
Trickest runs uncover as a managed network node that writes a file and a folder. Pair it with httpx or naabu to actively confirm results, because engine indexes can be stale.
use cases
Where uncover fits
Seed a target list without scanning
Query Shodan or Censys for an org's exposed services and pull back the matching ips and ports, all sourced passively from the engines' own data.
Fan one query across many engines
Run the same search through Shodan, FOFA, Quake, and ZoomEye in a single node so coverage compounds across each provider's index.
Hand structured hosts to active tooling
Emit JSONL and choose the ip:port field so a downstream prober or port scanner receives clean, structured targets to confirm.
Stay inside provider quotas
Set limit, rate-limit, and retry to keep a wide query within each engine's free or paid tier while still covering the surface.
reference
uncover inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| raw | BOOLEAN | -raw | write raw output as received by the remote api |
| fofa | FILE | -fofa | search query for fofa |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| field | STRING | -field | field to display in output (ip,port,host) (default "ip:port") |
| limit | STRING | -limit | limit the number of results to return (default 100) |
| quake | FILE | -quake | search query for quake |
| retry | STRING | -retry | number of times to retry a failed request (default 2) |
Showing key inputs. uncover exposes 29 inputs in total.
Full flag reference (29 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| raw | BOOLEAN | -raw | write raw output as received by the remote api |
| fofa | FILE | -fofa | search query for fofa |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| field | STRING | -field | field to display in output (ip,port,host) (default "ip:port") |
| limit | STRING | -limit | limit the number of results to return (default 100) |
| quake | FILE | -quake | search query for quake |
| retry | STRING | -retry | number of times to retry a failed request (default 2) |
| censys | FILE | -censys | search query for censys |
| config | FILE | -config | configuration file |
| engine | STRING | -engine | search engine to query (shodan,shodan-idb,fofa,censys,quake,hunter,zoomeye,netlas,publicwww,criminalip,hunterhow) (default shodan) |
| FILE | search query for google | ||
| hunter | FILE | -hunter | search query for hunter |
| netlas | FILE | -netlas | search query for netlas |
| shodan | FILE | -shodan | search query for shodan |
| silent | BOOLEAN | -silent | show only results in output |
| timeout | STRING | -timeout | timeout in seconds (default 30) |
| verbose | BOOLEAN | -v | show verbose output |
| zoomeye | FILE | -zoomeye | search query for zoomeye |
| no-color | STRING | -no-color | disable colors in output |
| provider | FILE | -provider | provider configuration file |
| hunterhow | FILE | -hunterhow | search query for hunterhow |
| publicwww | FILE | -publicwww | search query for publicwww |
| criminalip | FILE | -criminalip | search query for criminalip |
| query-file | FILE | -query | search query file |
| rate-limit | STRING | -rate-limit | maximum number of http requests to send per second |
| shodan-idb | FILE | -shodan-idb | search query for shodan-idb |
| query-string | STRING | -query | search query string |
| rate-limit-minute | STRING | -rate-limit-minute | maximum number of requests to send per minute |
| awesome-search-queries | STRING | -awesome-search-queries | use awesome search queries to discover exposed assets on the internet (example: -asq 'jira') |
example
Run uncover
# uncover: pull hosts matching an SSL title from multiple enginesuncover -q 'ssl:"example.com"' -censys -fofa -json -limit 50198.51.100.10:443203.0.113.5:8443api.example.com:443dev.example.com:443192.0.2.8:80staging.example.com:443guidance
Choosing uncover
Use uncover when you want passive exposure data from search engines rather than scanning the internet yourself. API keys are required for most engines. Confirm surfaced hosts with httpx or a port scanner before treating them as live.
shodan-python
Talks to Shodan only. uncover fans the same hunt across many engines.
nrich
Enriches a known IP list with Shodan data. uncover discovers hosts first.
naabu
Active port scanner. Run it after uncover to confirm reported ports.
faq
uncover questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run uncover yourself
A search query feeds uncover, which pulls matching hosts from internet search engines and passes them to httpx for active confirmation before they land as a queryable output.
Facts on this page come from the live Trickest tool library.