Repolode
Submit
projectdiscovery

projectdiscovery/uncover

A Go CLI that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye and more) to find exposed hosts, with output designed for piping into other tools.

Open-source alternative to:Shodan

View on GitHub
Stars
3,086
Forks
280
Open issues
13
Last commit
6 days ago

What is it?

uncover is a Go wrapper around the APIs of several internet search engines, including Shodan, Censys, FOFA, Hunter, Quake, ZoomEye, Netlas, Criminal IP, Google, and others. You give it a query in each engine's own syntax, and it returns matching IP and port pairs, hostnames, or custom-formatted lines.

It is built for automation. Input can come from stdin, a file of queries, or a config file, and output can be plain text, JSONL, or the raw API response. Results pipe directly into tools such as naabu, httpx, and nuclei. Multiple API keys per provider are supported, with a random key chosen on each run, and rate limits and retries can be configured.

The project can also be imported as a Go library. Shodan InternetDB is available without an API key, and an IP or CIDR input uses it by default to list open ports.

Key features

  • 01Queries multiple search engines in a single run.
  • 02Supports Shodan, Censys, FOFA, ZoomEye, Quake, Hunter, Netlas and about ten other engines.
  • 03Reads queries from stdin, files, or config and writes results to stdout or a file.
  • 04Rotates randomly among multiple API keys per provider.
  • 05Outputs plain text, JSONL, or raw API responses, with selectable fields (ip, port, host).
  • 06Can be used as a Go library.

Use cases

  • Attack surface mapping and reconnaissance during bug bounty or penetration testing.
  • Finding exposed instances of a specific product across the internet for security research.
  • Feeding discovered hosts into port scanners and web probing tools in an automated pipeline.

Quick start

  1. 1

    Install uncover with Go (requires go1.21)

    go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest
  2. 2

    Configure API keys for the search engines you plan to use in the provider config file

  3. 3

    Run a search query with the default Shodan engine

    echo 'ssl:"Uber Technologies, Inc."' | uncover

Things to know

  • Requires API keys from the search engines, most of which need a sign-up.
  • Requires Go 1.21 or newer to install from source.

Topics

#osint#reconnaissance#attack-surface#cli#security-scanning#shodan#asm#bugbounty#hacktoberfest#recon

FAQ

What is uncover?
A Go CLI that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye and more) to find exposed hosts, with output designed for piping into other tools. uncover is a Go wrapper around the APIs of several internet search engines, including Shodan, Censys, FOFA, Hunter, Quake, ZoomEye, Netlas, Criminal IP, Google, and others. You give it a query in each engine's own syntax, and it returns matching IP and port pairs, hostnames, or custom-formatted lines.
Is uncover free to use? What license does it have?
uncover is open source under the MIT license. Check the license terms before using it in commercial products.
Is uncover still maintained?
Actively maintained. The last commit to uncover was on Oct 13, 2026.
What can I use uncover for?
Attack surface mapping and reconnaissance during bug bounty or penetration testing. Finding exposed instances of a specific product across the internet for security research. Feeding discovered hosts into port scanners and web probing tools in an automated pipeline.
How do I install uncover?
Install uncover with Go (requires go1.21): go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest Configure API keys for the search engines you plan to use in the provider config file Run a search query with the default Shodan engine: echo 'ssl:"Uber Technologies, Inc."' | uncover
Where can I get uncover?
The source code and installation instructions are on GitHub: https://github.com/projectdiscovery/uncover

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects