Uncover — multi-engine exposed host discovery

★ 3.1K

uncover is an open-source Go command-line tool that queries multiple device search engine APIs simultaneously to discover internet-exposed hosts matching a given query. Reach for it when you need to map your organisation's external attack surface, find services accidentally exposed to the internet, or build a seed target list before an authorised penetration test or bug-bounty recon. It fans out queries across Shodan, Censys, FOFA, Hunter, Quake, ZoomEye, Netlas, CriminalIP, PublicWWW, HunterHow, Google, Onyphe, Driftnet, DayDayMap, and NerdyData, merging all results into a single output stream. Results can be formatted as ip:port, host, or JSONL; full stdin/stdout support makes it easy to pipe output into nuclei, nmap, or other projectdiscovery tools. Install via go install (requires Go 1.21+); provider API keys are stored in a YAML config file with automatic key randomisation across multiple keys. This is a dual-use tool — use it only against infrastructure you own or have explicit written authorisation to test. It suits automated perimeter recon pipelines but does not replace active port scanning and is limited to what the connected search engines have already indexed.