In modern cybersecurity and threat surface mapping, tracking exposed public-facing infrastructure requires querying multiple internet search engines, such as Shodan, Censys, FOFA, Hunter, Zoomeye, and Netlas. Each platform uses distinct web interfaces, unique search syntax, and separate REST APIs. Navigating multiple web portals and manually exporting CSV spreadsheets to correlate findings is slow and error-prone. Uncover, developed by ProjectDiscovery, solves this by providing a unified, high-speed command-line interface to search multiple internet search engines simultaneously.
Written in Go, Uncover standardizes queries across popular threat intelligence platforms, allowing security engineers and system administrators to discover exposed hosts, vulnerable services, and SSL certificate fingerprints directly from the Linux terminal.
Supported Search Engine Providers
Uncover integrates natively with leading cyberspace search engines through API keys:
- Shodan: Searches worldwide internet-connected devices, open ports, and banner grab records.
- Censys: Provides detailed IPv4/IPv6 host scanning, TLS certificates, and cloud provider mappings.
- FOFA: Extensive cyberspace search engine specializing in global web assets and CMS fingerprinting.
- Hunter (QI-ANXIN): Broad enterprise asset search engine tracking global IP address blocks and domain associations.
- ZoomEye & Netlas: Additional infrastructure and DNS intelligence search platforms.
Installing Uncover on Linux
You can install Uncover via official pre-compiled binaries or through the Go toolchain:
# Method 1: Download Official Pre-compiled Binary (Recommended)
curl -s https://api.github.com/repos/projectdiscovery/uncover/releases/latest | grep "browser_download_url.*linux_amd64.tar.gz" | cut -d : -f 2,3 | tr -d \" | wget -qi -
tar -xvf uncover_*_linux_amd64.tar.gz
sudo mv uncover /usr/local/bin/
uncover -version
# Method 2: Via Go (Requires Go 1.21+)
go install -v github.com/projectdiscovery/uncover/cmd/uncover@latestConfiguring API Keys
To query external search engines, populate your account API keys in Uncover’s provider configuration file:
nano ~/.config/uncover/provider-config.yamlAdd your keys under the respective service headers:
shodan:
- YOUR_SHODAN_API_KEY
censys:
- YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET
fofa:
- YOUR_FOFA_EMAIL:YOUR_FOFA_KEY
hunter:
- YOUR_HUNTER_API_KEYSave and close the file.
Command Flags and Filter Options
The table below highlights essential command-line arguments in Uncover:
| Flag | Functionality | Usage Example |
|---|---|---|
-q <query> |
Search query string | uncover -q "nginx" |
-e, -engine <names> |
Specify search engines (shodan, censys, fofa, all) | uncover -e shodan,censys -q "org:'Target Corp'" |
-limit <n> |
Maximum number of results to retrieve per engine | uncover -q "port:8080" -limit 50 (default 100) |
-silent |
Outputs only host:port records (suppress banner) | uncover -q "apache" -silent |
-o <file> |
Write results to output file | uncover -q "grafana" -o exposed_grafana.txt |
Running Practical Discovery Scans
1. Searching Shodan for Exposed Services
To search Shodan for exposed Jenkins automation servers belonging to an organisation:
uncover -e shodan -q "org:'Example Corp' title:'Dashboard [Jenkins]'" -o jenkins_hosts.txt2. Multi-Engine Query with Unified Output
Search across both Shodan and Censys simultaneously for specific SSL certificates or headers:
uncover -e shodan,censys -q "ssl.cert.subject.cn:example.com" -limit 1003. Seamless Reconnaissance Pipeline: Uncover to httpx to Nuclei
Query exposed assets, verify which services are active HTTP endpoints, and immediately audit for critical vulnerabilities:
uncover -q "org:'Example Inc'" -silent | httpx -silent | nuclei -severity critical,highThis automated pipeline transforms a single search query into actionable security remediation insights in seconds.
Frequently Asked Questions
Does running Uncover consume search engine API credits?
Yes. Querying Shodan, Censys, or Hunter consumes API query credits from your respective accounts based on the -limit parameter supplied.
Can Uncover return results without any API keys?
No. Internet search engines require authenticated API accounts to query their indexed databases. You must configure at least one active API key in provider-config.yaml.