skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

uncover-search

Query multiple internet search engines to discover exposed assets with uncover.

1.7k|238|Updated Dec 7, 2019
Search Tags:#reconnaissance#asset discovery#attack surface#osint#fofa#Shodan#uncover
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill uncover-search
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: uncover-search
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/uncover-search
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill uncover-search

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually querying Shodan, Censys, FOFA, Hunter, Quake, and ZoomEye one by one for asset discovery is slow and inconsistent. This Skill uses uncover to aggregate multiple cyberspace search engines behind a single command-line interface, returning unified results for exposure analysis.

Core Features & Use Cases

  • Multi-Engine Aggregation: Query Shodan, Censys, FOFA, Hunter, Quake, ZoomEye, and Netlas with one command using the -e flag.
  • Flexible Output: Limit result counts, emit JSON to files, or use silent mode to output only IP:Port pairs.
  • Pipeline Integration: Chain results directly into httpx for HTTP probing, naabu for port scanning, or nuclei for vulnerability scanning.
  • Use Case: During external reconnaissance on a target organization, run uncover -q "org:target.com" -e shodan,censys,fofa -silent | httpx -silent to enumerate exposed hosts and immediately verify which ones serve live HTTP services.

Quick Start

Use uncover to search Shodan, Censys, and FOFA for assets belonging to target.com and pipe the live hosts into httpx for verification.

Frequently Asked Questions about uncover-search

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query Shodan and FOFA at the same time?▼

Use uncover with the -e flag listing multiple engines, for example: uncover -q "target.com" -e shodan,censys,fofa. This runs the query against all specified engines and returns unified results in one output.

How to pipe uncover results into httpx or nuclei?▼

Run uncover with -silent to output only IP:Port pairs, then pipe into the next tool: uncover -q "org:target.com" -e shodan -silent | httpx -silent. You can chain further into naabu or nuclei for port and vulnerability scanning.

Does uncover require API keys for each search engine?▼

Yes, uncover requires API keys for each engine you query. Add them to ~/.config/uncover/provider-config.yaml before running searches against Shodan, Censys, FOFA, Hunter, Quake, or ZoomEye.

What query syntax does each search engine use in uncover?▼

Each engine keeps its native syntax: Shodan uses hostname:target.com, FOFA uses domain="target.com", Hunter uses domain="target.com", and Quake uses domain:"target.com". Censys accepts plain domain strings like target.com.

How do I export uncover results to a JSON file?▼

Add the -json and -o flags to your query: uncover -q "org:target.com" -e shodan -json -o results.json. Use -l to limit the number of returned results, for example -l 200.

Related Skills

Explore More Software Engineering Skills→
duriandurinoduriandurino

recon

Perform passive reconnaissance, OSINT gathering, and DNS analysis for penetration testing.

Community
Intermediate
zebbernzebbern
5

port-scan

Identify open ports and running services using naabu, masscan, and nmap.

Community
Intermediate
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced
jcastillotxjcastillotx

Shodan Reconnaissance and Pentesting

Identify exposed devices and services using Shodan search filters and API.

Community
Advanced