projectdiscovery

uncover: Find Exposed Hosts Through Search Engine APIs

uncover is a Go command-line tool that queries internet search engine APIs to find exposed hosts and ports. It brings results from multiple providers into a pipeline-friendly format for reconnaissance and attack-surface discovery.

ActiveGoMITCLISecurityAttack Surface Discovery
View on GitHub Compare
Stars
3.1k
Forks
279
Last commit
3 months ago
Contributors
32
Releases, 12 months
2

Our take

Activerecent releases

Health score

46/100

How it is scored
Activity
44
Community
56
Issues
53
Pull requests
31
  • Slower to merge pull requests than 98% of the projects we track

uncover is an actively maintained, focused reconnaissance utility, with recent releases and merged changes, though its value depends on access to external search APIs and their terms.

Good fit if

  • You already use search-engine APIs and want one CLI to query several providers.
  • Your reconnaissance workflow consumes standard input and host, IP, or port output.
  • You want a Go tool under the MIT license and can provide the required provider credentials.

Look elsewhere if

  • You need host discovery that does not depend on external search services or their API coverage.
  • You need a complete scanning or vulnerability-assessment platform rather than a search-results collection tool.
  • You cannot configure and manage API credentials for the providers you plan to query.
All health signals
Last commit2026-08-05 (3 months ago)
Commits, last 90 days1
Releases, last 12 months2 (latest v1.2.1, 2026-05-20)
Contributors32 (top contributor: 64% of commits)
Issues closed, last 90 days2
Pull requests merged, last 90 days11 (typically merged in 33 days)
Project age4 years

Checked on 2026-10-24 with the GitHub API.

Overview

uncover is a Go wrapper around APIs from internet search engines such as Shodan and Censys. It helps security researchers and reconnaissance teams find exposed hosts without having to query each provider separately, and returns results that can be fed into other command-line tools.

It supports queries across multiple providers, as well as IP and CIDR lookups through Shodan InternetDB and Driftnet. The tool is designed for automation, but results depend on provider access, credentials, query syntax, and API terms.

Key Features

  • Send a query to several supported search engines in one run.
  • Accept queries from flags, files, or standard input.
  • Look up IP and CIDR ranges using Shodan InternetDB or Driftnet.
  • Configure multiple credentials for a provider, with random selection per execution.
  • Choose output fields or format results for downstream tools.
  • Write results to a file or emit JSON Lines or raw provider responses.
  • Set request rate limits, timeouts, retries, and an HTTP proxy.

Use Cases

  • A bug bounty researcher can search for in-scope technologies across several providers, then pass discovered hosts to probing tools.
  • An attack-surface team can turn a list of organization or product queries into host-and-port results for follow-up review.
  • A security engineer can use IP or CIDR input to retrieve known open-port information through supported lookup APIs.
  • A recon operator can automate recurring searches by feeding query files or standard input into an existing command-line pipeline.

What you need

Detected in the repository

  • Go 1.25.0 or newer (from go.mod)
  • A Dockerfile, so it can run in a container
  • Automated checks on GitHub Actions

License in plain words

MITpermissive

  • Commercial use: yes
  • Modify and redistribute: yes
  • You must keep: the copyright and license notice
  • Share your changes: no

A summary, not legal advice: the LICENSE file is what applies.

Getting Started

Install with Go:

go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest

Configure provider credentials, then try uncover -h for available flags. See the README for provider configuration and usage examples.

Considerations

  • Provider API credentials are required for the search engines you use. Access, query syntax, result availability, and usage terms are controlled by those services. Shodan InternetDB is an exception and does not require a key.
  • The project documents Go 1.21 as its install requirement, while the repository's current go.mod specifies Go 1.25.0. Check the current module requirements when installing.
  • The tool reports results from search and lookup services. It does not itself establish that a host is authorized for testing; use it only within an approved scope and follow provider terms.
  • Repository health data marks the project active, with recent releases and merged pull requests. It has contributions from multiple people, so development is not concentrated in a single contributor. The measured recent commit count is low, so release activity provides the stronger signal of ongoing maintenance.

Found this useful?

Share it with someone who would like uncover.