> ## Documentation Index > Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt > Use this file to discover all available pages before exploring further. # Uncover providers # Uncover Provider & API Key Reference > Generated from [projectdiscovery/uncover](https://github.com/projectdiscovery/uncover) source code analysis. > Supported agents: **19 total** (18 requiring API keys + 1 anonymous) *** ## Provider Overview | # | Provider | Engine Name | API Keys Required | Config Format | Free Tier | | -- | --------------------------------------------------------- | ------------ | ----------------- | ----------------------------------------- | --------------- | | 1 | [Shodan](https://shodan.io) | `shodan` | 1 | `SHODAN_API_KEY` | Yes (limited) | | 2 | [Shodan InternetDB](https://internetdb.shodan.io) | `shodan-idb` | **None** | (anonymous) | Unlimited | | 3 | [Censys](https://search.censys.io) | `censys` | 2 | `CENSYS_API_TOKEN:CENSYS_ORGANIZATION_ID` | Yes (250/mo) | | 4 | [FOFA](https://fofa.info) | `fofa` | 2 | `FOFA_EMAIL:FOFA_KEY` | Yes | | 5 | [Quake (360)](https://quake.360.net) | `quake` | 1 | `QUAKE_TOKEN` | Yes | | 6 | [Hunter (Qianxin)](https://hunter.qianxin.com) | `hunter` | 1 | `HUNTER_API_KEY` | Yes | | 7 | [ZoomEye](https://www.zoomeye.ai) | `zoomeye` | 1 | `ZOOMEYE_API_KEY` | Yes | | 8 | [Netlas](https://netlas.io) | `netlas` | 1 | `NETLAS_API_KEY` | Yes (250/mo) | | 9 | [CriminalIP](https://www.criminalip.io) | `criminalip` | 1 | `CRIMINALIP_API_KEY` | Yes | | 10 | [PublicWWW](https://publicwww.com) | `publicwww` | 1 | `PUBLICWWW_API_KEY` | Yes | | 11 | [HunterHow](https://hunter.how) | `hunterhow` | 1 | `HUNTERHOW_API_KEY` | Yes | | 12 | [Google CSE](https://programmablesearchengine.google.com) | `google` | 2 | `GOOGLE_API_KEY:GOOGLE_API_CX` | Yes (100/day) | | 13 | [ODIN](https://odin.io) | `odin` | 1 | `ODIN_API_KEY` | Yes | | 14 | [BinaryEdge](https://www.binaryedge.io) | `binaryedge` | 1 | `BINARYEDGE_API_KEY` | Yes (limited) | | 15 | [Onyphe](https://www.onyphe.io) | `onyphe` | 1 | `ONYPHE_API_KEY` | Yes | | 16 | [Driftnet](https://driftnet.io) | `driftnet` | 1 | `DRIFTNET_API_KEY` | Yes | | 17 | [GreyNoise](https://www.greynoise.io) | `greynoise` | 1 | `GREYNOISE_API_KEY` | Yes (community) | | 18 | [DayDayMap](https://www.daydaymap.com) | `daydaymap` | 1 | `DAYDAYMAP_API_KEY` | Yes | | 19 | [NerdyData](https://www.nerdydata.com) | `nerdydata` | 1 | `NERDYDATA_API_KEY` | Yes | *** ## Provider Details ### 1. Shodan | Field | Value | | ------------------------ | ---------------------------------------------------------------------------------- | | **Website** | [https://www.shodan.io](https://www.shodan.io) | | **Engine Name** | `shodan` | | **Signup URL** | [https://account.shodan.io/register](https://account.shodan.io/register) | | **API Key Page** | [https://account.shodan.io/](https://account.shodan.io/) (logged in) | | **Required Credentials** | 1 API key | | **Config Format** | `SHODAN_API_KEY_1` | | **Env Variable** | `SHODAN_API_KEY` | | **Free Tier** | Yes — 50 credits/month, limited results | | **Paid Plans** | Developer ($59/mo), Business ($399/mo), Enterprise (\$999/mo) | | **Rate Limits** | 1 request/sec (free), higher on paid plans | | **Registration** | Email + password required | | **Notes** | Most widely used internet device search engine. Queries use Shodan search filters. | ### 2. Shodan InternetDB | Field | Value | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://internetdb.shodan.io](https://internetdb.shodan.io) | | **Engine Name** | `shodan-idb` | | **API Keys Required** | **None** (anonymous) | | **Free Tier** | Unlimited | | **Notes** | Queries IP/CIDR for open ports only. **No API key required.** Used as default engine when IP/CIDR is provided as input. Only returns ports, no search filtering. | ### 3. Censys | Field | Value | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://search.censys.io](https://search.censys.io) | | **Engine Name** | `censys` | | **Signup URL** | [https://censys.io/register](https://censys.io/register) | | **Required Credentials** | API Token + Organization ID | | **Config Format** | `CENSYS_API_TOKEN:CENSYS_ORGANIZATION_ID` | | **Env Variables** | `CENSYS_API_TOKEN`, `CENSYS_ORGANIZATION_ID` | | **Free Tier** | Yes — 250 queries/month | | **Paid Plans** | Explore (\$69/mo), Enterprise (custom) | | **Registration** | Email, Google, or GitHub auth | | **Notes** | API Token is found in Account > API. Organization ID is in Account > Workspace. Format is colon-separated: `token:org_id`. | ### 4. FOFA | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ | | **Website** | [https://fofa.info](https://fofa.info) | | **Engine Name** | `fofa` | | **Signup URL** | [https://fofa.info/toLogin](https://fofa.info/toLogin) | | **Required Credentials** | Email + Key | | **Config Format** | `FOFA_EMAIL:FOFA_KEY` | | **Env Variables** | `FOFA_EMAIL`, `FOFA_KEY` | | **Free Tier** | Yes — limited results | | **Paid Plans** | Member, Professional, Enterprise (pricing varies) | | **Registration** | Email + phone verification required (China-based) | | **Notes** | Popular Chinese asset search engine. Registration requires Chinese phone number or international option. Format is colon-separated: `email:key`. | ### 5. Quake (360) | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------- | | **Website** | [https://quake.360.net/quake/#/index](https://quake.360.net/quake/#/index) | | **Engine Name** | `quake` | | **Signup URL** | [https://quake.360.net/quake/#/index](https://quake.360.net/quake/#/index) (register) | | **Required Credentials** | 1 API token | | **Config Format** | `QUAKE_TOKEN_1` | | **Env Variable** | `QUAKE_TOKEN` | | **Free Tier** | Yes — daily limited queries | | **Paid Plans** | Subscription-based (360.cn platform) | | **Registration** | Phone number required (China-based) | | **Notes** | Operated by 360.cn. API token available in user settings after login. | ### 6. Hunter (Qianxin) | Field | Value | | ------------------------ | ---------------------------------------------------------------------------------------------- | | **Website** | [https://hunter.qianxin.com](https://hunter.qianxin.com) | | **Engine Name** | `hunter` | | **Signup URL** | [https://user.skyeye.qianxin.com/user/register](https://user.skyeye.qianxin.com/user/register) | | **Required Credentials** | 1 API key | | **Config Format** | `HUNTER_API_KEY_1` | | **Env Variable** | `HUNTER_API_KEY` | | **Free Tier** | Yes — limited monthly queries | | **Paid Plans** | Subscription-based (Qianxin platform) | | **Registration** | Phone number required (China-based) | | **Notes** | Chinese attack surface mapping platform. Also known as "SkyEye". | ### 7. ZoomEye | Field | Value | | ------------------------ | --------------------------------------------------------------------------- | | **Website** | [https://www.zoomeye.ai](https://www.zoomeye.ai) | | **Engine Name** | `zoomeye` | | **Signup URL** | [https://www.zoomeye.ai](https://www.zoomeye.ai) (register) | | **Required Credentials** | 1 API key | | **Config Format** | `ZOOMEYE_API_KEY_1` | | **Env Variable** | `ZOOMEYE_API_KEY` | | **Free Tier** | Yes — limited results | | **Paid Plans** | Member, Professional, Enterprise | | **Registration** | Email required | | **Notes** | Asset discovery engine by Knownsec. API key in personal center after login. | ### 8. Netlas | Field | Value | | ------------------------ | -------------------------------------------------------------------------- | | **Website** | [https://netlas.io](https://netlas.io) | | **Engine Name** | `netlas` | | **Signup URL** | [https://app.netlas.io/registration/](https://app.netlas.io/registration/) | | **Required Credentials** | 1 API key | | **Config Format** | `NETLAS_API_KEY_1` | | **Env Variable** | `NETLAS_API_KEY` | | **Free Tier** | Yes — 250 requests/month | | **Paid Plans** | Researcher ($9/mo), Business ($99/mo), Enterprise (custom) | | **Registration** | Email + password required | | **Notes** | Internet OSINT search engine. API key in profile settings. | ### 9. CriminalIP | Field | Value | | ------------------------ | --------------------------------------------------------------------------- | | **Website** | [https://www.criminalip.io](https://www.criminalip.io) | | **Engine Name** | `criminalip` | | **Signup URL** | [https://www.criminalip.io/register](https://www.criminalip.io/register) | | **Required Credentials** | 1 API key | | **Config Format** | `CRIMINALIP_API_KEY_1` | | **Env Variable** | `CRIMINALIP_API_KEY` | | **Free Tier** | Yes — limited monthly queries | | **Paid Plans** | Pro, Business, Enterprise | | **Registration** | Email required | | **Notes** | Cyber threat intelligence search engine. API key in My Page > API Settings. | ### 10. PublicWWW | Field | Value | | ------------------------ | -------------------------------------------------------------------------------------- | | **Website** | [https://publicwww.com](https://publicwww.com) | | **Engine Name** | `publicwww` | | **Signup URL** | [https://publicwww.com/profile/signup.html](https://publicwww.com/profile/signup.html) | | **Required Credentials** | 1 API key | | **Config Format** | `PUBLICWWW_API_KEY_1` | | **Env Variable** | `PUBLICWWW_API_KEY` | | **Free Tier** | Yes — limited queries | | **Paid Plans** | Personal (€19/mo), Professional, Enterprise | | **Registration** | Email required | | **Notes** | Website source code search engine. Finds sites containing specific HTML/JS/CSS. | ### 11. HunterHow | Field | Value | | ------------------------ | ----------------------------------------------------------------- | | **Website** | [https://hunter.how](https://hunter.how) | | **Engine Name** | `hunterhow` | | **Signup URL** | [https://hunter.how](https://hunter.how) (register/login) | | **Required Credentials** | 1 API key | | **Config Format** | `HUNTERHOW_API_KEY_1` | | **Env Variable** | `HUNTERHOW_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Varies | | **Registration** | Email or social login | | **Notes** | Asset discovery platform by "Hunter How". API key from dashboard. | ### 12. Google Custom Search | Field | Value | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://programmablesearchengine.google.com](https://programmablesearchengine.google.com) | | **Engine Name** | `google` | | **Console URLs** | [API Key](https://developers.google.com/custom-search/v1/introduction#identify_your_application_to_google_with_api_key), [CX](https://programmablesearchengine.google.com/controlpanel/create) | | **Required Credentials** | API Key + Search Engine ID (CX) | | **Config Format** | `GOOGLE_API_KEY:GOOGLE_API_CX` | | **Env Variables** | `GOOGLE_API_KEY`, `GOOGLE_API_CX` | | **Free Tier** | 100 queries/day | | **Paid Plans** | \$5 per 1K queries beyond free tier | | **Registration** | Google Cloud Platform account required | | **Notes** | Google Custom Search API. Requires: (1) API key from Google Cloud console, and (2) Programmable Search Engine ID (cx) created via control panel. Format is colon-separated: `api_key:cx`. | ### 13. ODIN | Field | Value | | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://odin.io](https://odin.io) | | **Engine Name** | `odin` | | **Signup URL** | [https://odin.io](https://odin.io) (register) | | **Required Credentials** | 1 API key | | **Config Format** | `ODIN_API_KEY_1` | | **Env Variable** | `ODIN_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Varies | | **Registration** | Email required | | **Notes** | Cyber asset attack surface management platform. API key from dashboard. **Note: Not shown in README but present in source code.** | ### 14. BinaryEdge | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | **Website** | [https://www.binaryedge.io](https://www.binaryedge.io) | | **Engine Name** | `binaryedge` | | **Signup URL** | [https://app.binaryedge.io/register](https://app.binaryedge.io/register) | | **Required Credentials** | 1 API key | | **Config Format** | `BINARYEDGE_API_KEY_1` | | **Env Variable** | `BINARYEDGE_API_KEY` | | **Free Tier** | Yes — 100 requests/month | | **Paid Plans** | Pro (€49/mo), Premium (€199/mo), Enterprise | | **Registration** | Email required | | **Notes** | Threat intelligence and internet scanning platform. API key in account settings. **Note: Not shown in README but present in source code.** | ### 15. Onyphe | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://www.onyphe.io](https://www.onyphe.io) | | **Engine Name** | `onyphe` | | **Signup URL** | [https://search.onyphe.io/signup](https://search.onyphe.io/signup) | | **Required Credentials** | 1 API key | | **Config Format** | `ONYPHE_API_KEY_1` | | **Env Variable** | `ONYPHE_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Web ($25/mo), Researcher ($50/mo), Enterprise | | **Registration** | Email required | | **Notes** | Cyber threat intelligence search engine. API key in account settings. Supports full-text search on internet-sourced data. | ### 16. Driftnet | Field | Value | | ------------------------ | ---------------------------------------------------------------------------------------- | | **Website** | [https://driftnet.io](https://driftnet.io) | | **Engine Name** | `driftnet` | | **Signup URL** | [https://driftnet.io/auth?state=signup](https://driftnet.io/auth?state=signup) | | **Required Credentials** | 1 API key | | **Config Format** | `DRIFTNET_API_KEY_1` | | **Env Variable** | `DRIFTNET_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Varies | | **Registration** | Email required | | **Notes** | Internet scanning and asset discovery API. Fast lookup of open ports for IP/CIDR ranges. | ### 17. GreyNoise | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | **Website** | [https://www.greynoise.io](https://www.greynoise.io) | | **Engine Name** | `greynoise` | | **Signup URL** | [https://www.greynoise.io/signup](https://www.greynoise.io/signup) | | **Required Credentials** | 1 API key | | **Config Format** | `GREYNOISE_API_KEY_1` | | **Env Variable** | `GREYNOISE_API_KEY` | | **Free Tier** | Yes — Community (500 queries/month) | | **Paid Plans** | Pro (\$99/mo), Enterprise | | **Registration** | Email required | | **Notes** | Noise/censor alerting for internet scanning. Filters benign from malicious. **Note: Not shown in README but present in source code.** | ### 18. DayDayMap | Field | Value | | ------------------------ | ----------------------------------------------------------------- | | **Website** | [https://www.daydaymap.com](https://www.daydaymap.com) | | **Engine Name** | `daydaymap` | | **Signup URL** | [https://www.daydaymap.com](https://www.daydaymap.com) (register) | | **Required Credentials** | 1 API key | | **Config Format** | `DAYDAYMAP_API_KEY_1` | | **Env Variable** | `DAYDAYMAP_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Varies | | **Registration** | Required (platform in Chinese) | | **Notes** | Chinese asset mapping platform. May require phone verification. | ### 19. NerdyData | Field | Value | | ------------------------ | ------------------------------------------------------------------------------------------- | | **Website** | [https://www.nerdydata.com](https://www.nerdydata.com) | | **Engine Name** | `nerdydata` | | **API Page** | [https://www.nerdydata.com/api](https://www.nerdydata.com/api) | | **Required Credentials** | 1 API key | | **Config Format** | `NERDYDATA_API_KEY_1` | | **Env Variable** | `NERDYDATA_API_KEY` | | **Free Tier** | Yes — limited | | **Paid Plans** | Pro ($49/mo), Agency ($99/mo), Enterprise | | **Registration** | Email required | | **Notes** | Technology lookup and website code search engine. Search by HTML, JavaScript, CSS patterns. | *** ## Configuration Systems Uncover supports **two** configuration methods: ### Method 1: YAML Config File (`provider-config.yaml`) Default location: `~/.uncover-config/provider-config.yaml` ```yaml theme={"theme":{"light":"github-light","dark":"one-dark-pro"}} # Single key format (most providers): shodan: - "your-shodan-api-key" # Colon-separated format (requires two values): censys: - "your-censys-token:your-censys-org-id" fofa: - "your-email:your-fofa-key" google: - "your-google-api-key:your-google-cx" # Multiple keys per provider (random selection): shodan: - "key1" - "key2" - "key3" ``` ### Method 2: Environment Variables Every provider can be configured via individual environment variables. These are read at runtime by `LoadProviderKeysFromEnv()`. #### Environment Variable Reference | Provider | Env Variable(s) | Required | | ---------- | --------------------------------------------- | ------------- | | Shodan | `SHODAN_API_KEY` | Yes | | Censys | `CENSYS_API_TOKEN` + `CENSYS_ORGANIZATION_ID` | Both required | | FOFA | `FOFA_EMAIL` + `FOFA_KEY` | Both required | | Quake | `QUAKE_TOKEN` | Yes | | Hunter | `HUNTER_API_KEY` | Yes | | ZoomEye | `ZOOMEYE_API_KEY` | Yes | | Netlas | `NETLAS_API_KEY` | Yes | | CriminalIP | `CRIMINALIP_API_KEY` | Yes | | PublicWWW | `PUBLICWWW_API_KEY` | Yes | | HunterHow | `HUNTERHOW_API_KEY` | Yes | | Google | `GOOGLE_API_KEY` + `GOOGLE_API_CX` | Both required | | ODIN | `ODIN_API_KEY` | Yes | | BinaryEdge | `BINARYEDGE_API_KEY` | Yes | | Onyphe | `ONYPHE_API_KEY` | Yes | | Driftnet | `DRIFTNET_API_KEY` | Yes | | GreyNoise | `GREYNOISE_API_KEY` | Yes | | DayDayMap | `DAYDAYMAP_API_KEY` | Yes | | NerdyData | `NERDYDATA_API_KEY` | Yes | *** ## Engine Names for `-e` / `--engine` Flag Use these with the Uncover CLI or SDK: ``` shodan, shodan-idb, censys, fofa, quake, hunter, zoomeye, netlas, criminalip, publicwww, hunterhow, google, odin, binaryedge, onyphe, driftnet, greynoise, daydaymap, nerdydata ``` *** ## Uncover SDK Configuration Behavior When `uncover.New()` is called: 1. Creates a new `Provider` via `sources.NewProvider()` 2. `NewProvider()` loads the YAML config from `DefaultProviderConfigLocation` 3. Then overlays environment variables via `LoadProviderKeysFromEnv()` 4. Env vars **append** to any keys loaded from YAML (don't override) 5. Multiple keys for same provider are randomized on each execution **Important note for Docker/distroless:** The `init()` function in `provider.go` attempts to create `~/.uncover-config/provider-config.yaml` if it doesn't exist. In distroless containers running as nonroot, this will log a warning but not crash. Configuration via environment variables is the recommended approach for containerized deployments. *** ## Usage Notes * **Shodan InternetDB** (`shodan-idb`) is the only engine that requires **no API key** and works out of the box. * Multiple API keys for the same provider enable automatic key rotation (random selection). * Results are limited to 100 by default; use `-limit` flag for more. * The `query` flag supports **all and only filters supported by the target search engine**. * Chinese platforms (FOFA, Quake, Hunter) typically require phone number verification. *** ## Recon Service Integration The recon service uses Uncover via Go SDK at: `services/recon-service/internal/pd/runner.go` — `RunUncoverSDK()` Configuration is loaded from: 1. **Environment variables** set in the container (preferred for Docker) 2. **Volume-mounted config file** at `/etc/uncover/provider-config.yaml` (optional) The provider config is mounted in the Docker Compose stack at: ```yaml theme={"theme":{"light":"github-light","dark":"one-dark-pro"}} volumes: - ./services/recon-service/config/provider-config.yaml:/etc/uncover/provider-config.yaml:ro ``` With the environment variable override: ```yaml theme={"theme":{"light":"github-light","dark":"one-dark-pro"}} UNCOVER_PROVIDER_CONFIG: /etc/uncover/provider-config.yaml ```