Skip to content
Deepak Gupta markRecon Atlas

Internet exposure search

uncover

Queries Shodan, Censys, FOFA and other internet search engine APIs at once to list exposed hosts and ports.

PassiveScope a pentestAudit your own exposureResearch a competitor

3.1k stars · last push November 9, 2026 · v1.2.1 · MIT

GitHub repositoryOfficial docs

What it finds

uncover sends search queries to internet scanning engines such as Shodan, Censys, FOFA, ZoomEye and Netlas through their APIs. It prints matching IP, port or host values. For IP or CIDR input it defaults to Shodan InternetDB, which needs no key.

  • IP addresses
  • open ports
  • hostnames

Does it touch the target?

Reads third-party sources only. Sends no traffic to the target's systems.

README: "a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet." It only queries search engine APIs; probing the results needs separate tools (the README pipes output to naabu, httpx, nuclei).

API keys: README: "API keys are required and must be configured before running uncover", except shodan-idb, which "doesn't requires an API key and works out of the box".

Install

Install with go
go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Run one query against several search engines
echo jira | uncover -e shodan,censys,fofa,quake,hunter,zoomeye,netlas,criminalip,driftnet,daydaymap

From the project's documentation

Look up known open ports for an IP range via Shodan InternetDB
echo 192.0.2.0/24 | uncover

From the project's documentation

Return only hostnames for a query
uncover -q jira -f host -silent

From the project's documentation

Output formats: jsonl, txt, raw

Limits the project documents

  • API keys must be configured before use, except for shodan-idb.
  • Results are limited to 100 by default; raise with -limit.
  • The query flag supports all and only the filters each search engine supports.

Deepak's take

Analysis, not documentation

Use it when
Use it to see what internet scanners have already indexed about your IP ranges or products, without sending packets yourself.
Skip it when
Skip it for subdomain discovery; subfinder or theHarvester fit better. Skip it without accounts on the engines you need.
What it will miss
It will not show hosts or ports the search engines have not scanned or indexed, and indexed data can be stale.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. uncover is a trademark or project name of its owners; this library is not affiliated with it.