uncover--使用多个搜索引擎快速发现互联网上暴露的主机

• 一次查询多个搜索引擎

• 可用的搜索引擎支持

  
  

• Shodan

• Censys

• FOFA

• Hunter

• Quake

• Zoomeye

• Netlas

• CriminalIP

• 支持多个 API 密钥输入

• 自动 API 密钥随机化

• 输入标准/标准输出支持

  
  

安装直接在发布版本下载使用，也可以：

需要 go1.17 

go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest

用法

uncover -h

这将显示该工具的帮助。以下是它支持的所有标志：

Usage:
  ./uncover [flags]

Flags:
INPUT:
   -q, -query string[]   search query, supports: stdin,file,config input (example: -q 'example query', -q 'query.txt')
   -e, -engine string[]  search engine to query (shodan,shodan-idb,fofa,censys,quake,hunter,zoomeye,netlas,criminalip) (default shodan)

SEARCH-ENGINE:
   -s, -shodan string[]       search query for shodan (example: -shodan 'query.txt')
   -sd, -shodan-idb string[]  search query for shodan-idb (example: -shodan-idb 'query.txt')
   -ff, -fofa string[]        search query for fofa (example: -fofa 'query.txt')
   -cs, -censys string[]      search query for censys (example: -censys 'query.txt')
   -qk, -quake string[]       search query for quake (example: -quake 'query.txt')
   -ht, -hunter string[]      search query for hunter (example: -hunter 'query.txt')
   -ze, -zoomeye string[]     search query for zoomeye (example: -zoomeye 'query.txt')
   -ne, -netlas string[]      search query for netlas (example: -netlas 'query.txt')
   -cl, -criminalip string[]  search query for criminalip (example: -criminalip 'query.txt')

CONFIG:
   -pc, -provider string  provider configuration file (default "$HOME/.config/uncover/provider-config.yaml")
   -config string         flag configuration file (default "$HOME/.config/uncover/config.yaml")
   -timeout int           timeout in seconds (default 30)
   -delay int             delay between requests in seconds (0 to disable) (default 1)
   -retry int             number of times to retry a failed request (default 2)

OUTPUT:
   -o, -output string  output file to write found results
   -f, -field string   field to display in output (ip,port,host) (default "ip:port")
   -j, -json           write output in JSONL(ines) format
   -r, -raw            write raw output as received by the remote api
   -l, -limit int      limit the number of results to return (default 100)
   -nc, -no-color      disable colors in output

DEBUG:
   -silent   show only results in output
   -version  show version of the project
   -v        show verbose output

提供程序配置

默认提供程序配置文件应位于 ，并具有以下内容作为示例。$HOME/.config/uncover/provider-config.yaml

注意：在运行 uncover 之前需要配置 API 密钥。

shodan:
  - SHODAN_API_KEY_1
  - SHODAN_API_KEY_2
censys:
  - CENSYS_API_ID_1:CENSYS_API_SECRET_1
  - CENSYS_API_ID_2:CENSYS_API_SECRET_2
fofa:
  - FOFA_EMAIL_1:FOFA_KEY_2
  - FOFA_EMAIL_2:FOFA_KEY_2
quake:
  - QUAKE_TOKEN_1
  - QUAKE_TOKEN_2
hunter:
  - HUNTER_API_KEY_1
  - HUNTER_API_KEY_2
zoomeye:
  - ZOOMEYE_API_KEY_1
  - ZOOMEYE_API_KEY_2
netlas:
  - NETLAS_API_KEY_1
  - NETLAS_API_KEY_2
criminalip:
  - CRIMINALIP_API_KEY_1
  - CRIMINALIP_API_KEY_2

在配置文件中为同一提供程序指定多个密钥/凭据时，每次执行都将使用随机密钥。

或者，您也可以在 Bash 配置文件中将 API 密钥设置为环境变量。

export SHODAN_API_KEY=xxx
export CENSYS_API_ID=xxx
export CENSYS_API_SECRET=xxx
export FOFA_EMAIL=xxx
export FOFA_KEY=xxx
export QUAKE_TOKEN=xxx
export HUNTER_API_KEY=xxx
export ZOOMEYE_API_KEY=xxx
export NETLAS_API_KEY=xxx
export CRIMINALIP_API_KEY=xxx

所需的API密钥可以通过在以下平台Shodan，Censys，Fofa，Quake，Hunter，ZoomEye，Netlas和CrimeIP上注册来获得。

默认运行：

Uncover 支持多种查询方式，包括 stdin 或 flag，因为如果未指定引擎，则使用默认引擎进行搜索。qshodan

echo 'ssl:"Uber Technologies, Inc."' | uncover 
                                        
  __  ______  _________ _   _____  _____
 / / / / __ / ___/ __  | / / _ / ___/
/ /_/ / / / / /__/ /_/ / |/ /  __/ /    
__,_/_/ /_/___/____/|___/___/_/ v0.0.9    
                                        

		projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[WRN] By using uncover, you also agree to the terms of the APIs used.

107.180.12.116:993
107.180.26.155:443
104.244.99.31:443
161.28.20.79:443
104.21.8.108:443
198.71.233.203:443
104.17.237.13:443
162.255.165.171:443
12.237.119.61:443
192.169.250.211:443
104.16.251.50:443

运行 uncover，文件输入每行包含多个搜索查询。

cat dorks.txt

ssl:"Uber Technologies, Inc."
title:"Grafana"

uncover -q dorks.txt
                                        
  __  ______  _________ _   _____  _____
 / / / / __ / ___/ __  | / / _ / ___/
/ /_/ / / / / /__/ /_/ / |/ /  __/ /    
__,_/_/ /_/___/____/|___/___/_/ v0.0.9    
                                        

    projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[WRN] By using uncover, you also agree to the terms of the APIs used.

107.180.12.116:993
107.180.26.155:443
104.244.99.31:443
161.28.20.79:443
104.21.8.108:443
198.71.233.203:443
2607:7c80:54:3::74:3001
104.198.55.35:80
46.101.82.244:3000
34.147.126.112:80
138.197.147.213:8086

针对多个搜索引擎的单个查询

Uncover支持多个搜索引擎，因为使用默认的shodan，标志可用于对任何或所有搜索引擎运行相同的查询。-e

echo jira | uncover -e shodan,censys,fofa,quake,hunter,zoomeye,netlas,criminalip

  __  ______  _________ _   _____  _____
 / / / / __ / ___/ __  | / / _ / ___/
/ /_/ / / / / /__/ /_/ / |/ /  __/ /    
__,_/_/ /_/___/____/|___/___/_/ v0.0.9  
                                        

    projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[WRN] By using uncover, you also agree to the terms of the APIs used.

176.31.249.189:5001
13.211.116.80:443
43.130.1.221:631
192.195.70.29:443
52.27.22.181:443
117.48.120.226:8889
106.52.115.145:49153
13.69.135.128:443
193.35.99.158:443
18.202.109.218:8089
101.36.105.97:21379
42.194.226.30:2626

针对多个搜索引擎的多个查询

uncover -shodan 'http.component:"Atlassian Jira"' -censys 'services.software.product=`Jira`' -fofa 'app="ATLASSIAN-JIRA"' -quake 'Jira' -hunter 'Jira' -zoomeye 'app:"Atlassian JIRA"' -netlas 'jira' -criminalip 'Jira'

  __  ______  _________ _   _____  _____
 / / / / __ / ___/ __  | / / _ / ___/
/ /_/ / / / / /__/ /_/ / |/ /  __/ /    
__,_/_/ /_/___/____/|___/___/_/ v0.0.9
                                        

    projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[WRN] By using uncover, you also agree to the terms of the APIs used.

104.68.37.129:443
162.222.160.42:443
34.255.84.133:443
52.204.121.166:443
23.198.29.120:443
136.156.180.95:443
54.194.233.15:443
104.117.55.155:443
149.81.4.6:443
54.255.218.95:443
3.223.137.57:443
83.228.124.171:443
23.202.195.82:443
52.16.59.25:443
18.159.145.227:443
104.105.53.236:443

Shodan-InternetDB API

uncover支持shodan-internetdb API为给定的IP / CIDR输入提取可用端口。

shodan-idb当 IP/CIDR 作为输入提供时用作默认引擎，否则使用搜索引擎。shodan

echo 51.83.59.99/24 | uncover

  __  ______  _________ _   _____  _____
 / / / / __ / ___/ __  | / / _ / ___/
/ /_/ / / / / /__/ /_/ / |/ /  __/ /    
__,_/_/ /_/___/____/|___/___/_/ v0.0.9  
                                        

    projectdiscovery.io

[WRN] Use with caution. You are responsible for your actions
[WRN] Developers assume no liability and are not responsible for any misuse or damage.
[WRN] By using uncover, you also agree to the terms of the APIs used.

51.83.59.1:53
51.83.59.1:10000
51.83.59.2:53
51.83.59.3:25
51.83.59.3:80
51.83.59.3:389
51.83.59.3:443
51.83.59.3:465
51.83.59.3:587
51.83.59.3:993

字段格式

-f, -field标志可用于指示要返回的字段、当前、ipporthost

uncover -q jira -f host -silent

ec2-44-198-22-253.compute-1.amazonaws.com
ec2-18-246-31-139.us-west-2.compute.amazonaws.com
tasks.devrtb.com
leased-line-91-149-128-229.telecom.by
74.242.203.213.static.inetbone.net
ec2-52-211-7-108.eu-west-1.compute.amazonaws.com
ec2-54-187-161-180.us-west-2.compute.amazonaws.com
185-2-52-226.static.nucleus.be
ec2-34-241-80-255.eu-west-1.compute.amazonaws.com

字段格式

Uncover有一个标志，可用于自定义输出格式。例如，在 的情况下，ip：port 将在保持格式定义的同时替换为输出中的结果，它还可用于指定已知的方案/路径/文件，以便准备输出，以便可以立即将其作为输入传递给管道中的其他工具。-f, -fielduncover -f https://ip:port/version

echo kubernetes | uncover -f https://ip:port/version -silent

https://35.222.229.38:443/version
https://52.11.181.228:443/version
https://35.239.255.1:443/version
https://34.71.48.11:443/version
https://130.211.54.173:443/version
https://54.184.250.232:443/version

uncover 的输出可以进一步通过管道传输到工作流中接受 stdin 作为输入的其他项目，例如：

• uncover -q example -f ip | naabu- 运行 naabu 以在找到的主机上进行端口扫描。

• uncover -q title:GitLab | httpx- 为 Web 服务器运行 httpx，探测找到的结果。

• uncover -q 51.83.59.99/24 | httpx- 在从 shodan-internetdb 获取的主机/端口上运行 httpx。

uncover -q http.title:GitLab -silent | httpx -silent

https://15.185.150.109
https://139.162.137.16
https://164.68.115.243
https://135.125.215.186
https://163.172.59.119
http://15.236.10.197
https://129.206.117.248

• uncover -q 'org:"Example Inc."' | httpx | nuclei- 运行httpx /nuclei进行漏洞评估。

笔记：

• 在运行或使用此项目之前，需要配置密钥/凭据。

• query标志支持搜索引擎支持的所有且仅支持过滤器。

• 结果仅限于默认值，可以使用 Flag 增加。100limit

• shodan-idbAPI 不需要 API 密钥，开箱即用。

• shodan-idb当 IP/CIDR 作为输入提供时，API 用作默认引擎。

原文始发于微信公众号（蓝猫Sec）：uncover--使用多个搜索引擎快速发现互联网上暴露的主机