uncover is a small command-line tool from ProjectDiscovery that sends one query to many internet-scan search engines at once and prints a clean list of IP:port or host results. It supports Shodan and Shodan InternetDB, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Onyphe, Driftnet, GreyNoise, PublicWWW, Hunter, Quake, HunterHow, DayDayMap, NerdyData and Google, each with its own query syntax, and it reads queries from flags, files or stdin and writes plain text or JSON lines for the next tool in a pipeline.
It never touches the hosts itself. Every result comes from an index those companies have already built by scanning the internet, which makes it a quick way to answer questions like which of our certificates, titles or IP ranges show up exposed in Shodan and Censys, without sending a packet to anything. ProjectDiscovery also maintains nuclei, httpx, subfinder and dnsx, and uncover is MIT-licensed with about 3,100 stars, 34 contributors and a 1.2.1 release in May 2026; the last push was the day before our scan.
- Repository: github.com/projectdiscovery/uncover
- Licence: MIT (MIT License)
- Language: Go. Stars: 3,096. Forks: 280. Last push: Oct 27, 2026.
- Scan: safe, Oct 28, 2026, commit 823cd7f
Who it is for
Security and IT teams mapping their own organisation's internet-facing footprint, bug bounty researchers working inside a programme's scope, and researchers who already pay for one or more scan-index APIs and want them behind a single command.
Getting started
1. Install with Go (or brew install uncover; binaries are on the releases page)
go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest2. Add your API keys to the provider config (or export SHODAN_API_KEY and friends)
$EDITOR ~/.config/uncover/provider-config.yaml3. Search for your own organisation's certificates across several engines
uncover -q 'ssl:"Your Company Ltd"' -e shodan,censys -j -o exposed.jsonlEvery engine needs its own API key, and some are paid. Each run also checks api.pdtm.sh for a newer version, sending your OS, CPU architecture, Go version and a hashed machine ID; add -duc to turn that off. Results are other companies' scan data, so stick to assets you own or are authorised to assess, and follow each engine's terms.
Safety scan
We cloned projectdiscovery/uncover at commit 823cd7f on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across 96 files. The hosts the scan lists are the search engines' APIs plus a.example and b.example in tests. integration-tests/run.sh is a 20-line script that builds the binary and runs the integration tests; it uses no sudo and downloads nothing.
- go.mod lists 34 known advisories, 7 critical. All seven are in golang.org/x/crypto v0.51.0, an indirect dependency, and all seven concern its SSH packages (agent key constraints, certificate revocation, security-key presence checks, server deadlocks). We built the dependency graph of the uncover command and no SSH package is in it; govulncheck agrees that none of them is reachable. The one x/crypto package that is linked is openpgp, used by the self-updater, which carries an unrated advisory for being unmaintained.
- The remaining reachable items are moderate or unrated: archive extraction bugs in mholt/archiver, rardecode and xz, which come in through the logging library and are never used to unpack untrusted files, a goldmark XSS issue in the update notes renderer, and HTTP/2 client fixes in golang.org/x/net. A rebuild against current modules clears most of them.
- Eight workflows, none using pull_request_target. The nine third-party action uses are pinned to tags rather than commits. Dependabot and CodeQL are on and Scorecard's code-review check scores 10, though the repository has no SECURITY.md or contributing guide of its own.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 8 workflows. None use pull_request_target. 9 of 9 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 20 distinct hosts referenced from source; most often a.example, api.driftnet.io, b.example, api.binaryedge.io. No URLs to bare IP addresses. |
| Known vulnerabilities | 34 advisories across 112 pinned packages: 7 critical, 3 high, 7 moderate, 0 low, 17 unrated. go.mod: 112 packages, 34 advisories. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file. Missing security policy, contributing guide. |
| OpenSSF Scorecard | 5.6 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- integration-tests/run.sh, 20 lines
Worst known vulnerabilities (24 of 34)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-5cgq-3rg8-m6cv | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status |
| GHSA-89gr-r52h-f8rx | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed |
| GHSA-f5wc-c3c7-36mc | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys |
| GHSA-jppx-rxg9-jmrx | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto doesn't enforce invoking key constraints |
| GHSA-rm3j-f69w-wqmq | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto vulnerable to infinite loop on large channel writes |
| GHSA-vgwf-h737-ff37 | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses |
| GHSA-x527-x647-q7gg | critical | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement |
| GHSA-7vpp-9cxj-q8gv | high | github.com/mholt/archiver/v3@3.5.1 | mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File |
| GHSA-q4h4-gmj2-qvw2 | high | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic |
| GHSA-w879-237q-wc7r | high | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS |
| GHSA-rhh4-rh7c-7r5v | moderate | github.com/mholt/archiver/v3@3.5.1 | Archiver Path Traversal vulnerability |
| GHSA-rwvp-r38j-9rgg | moderate | github.com/nwaples/rardecode@1.1.3 | rardecode: DoS risk due to unrestricted RAR dictionary sizes |
| GHSA-jc7w-c686-c4v9 | moderate | github.com/ulikunitz/xz@0.5.11 | github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives |
| GHSA-45gg-vh54-h5m9 | moderate | golang.org/x/crypto@0.51.0 | golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions |
| GHSA-78mq-xcr3-xm33 | moderate | golang.org/x/crypto@0.51.0 | golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow |
| GHSA-9m57-25v3-79x9 | moderate | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking pathological inputs can lead to client panic |
| GHSA-qpw4-5x99-6vjp | moderate | golang.org/x/crypto@0.51.0 | golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS |
| CVE-2026-56865 | unknown | golang.org/x/mod@0.35.0 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog |
| CVE-2026-56864 | unknown | golang.org/x/mod@0.35.0 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb |
| CVE-2026-46600 | unknown | golang.org/x/net@0.55.0 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage |
| CVE-2026-78659 | unknown | golang.org/x/net@0.55.0 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78660 | unknown | golang.org/x/net@0.55.0 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78669 | unknown | golang.org/x/net@0.55.0 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78663 | unknown | golang.org/x/net@0.55.0 | Double flow control refund on HTTP/2 server streams in net/http |
By the numbers
| Stars | 3,096 |
|---|---|
| Forks | 280 |
| Contributors | 34 |
| Commits | 886 |
| Open issues | 6 |
| Open pull requests | 0 |
| Releases | 23 |
| Latest release | v1.2.1 |
| Licence | MIT |
| Main language | Go |
| Project age | 4 years |
| Last push | Oct 27, 2026 |
| Tracked files | 96 |
| Lines of code | 18K |
| Checkout size | 899 KB |
Lines by language: JSON 11.4K, Go 5,686, Markdown 574, YAML 385, Shell 20.
Questions
Is uncover free?
Yes. uncover is MIT-licensed and free to install and use. The search engines behind it are separate services: Shodan InternetDB needs no key, most others have a limited free tier, and several, including Shodan's full API and Censys at volume, are paid.
Is it legal to use uncover?
Querying a search engine you have an account with is legal in most places, and uncover sends nothing to the hosts it lists. What you do next is what matters: probing or logging in to systems you do not own or have permission to test is illegal in most countries. Use it to find your own exposed assets or inside an authorised scope, and respect each engine's terms of use.
Does uncover need all those API keys?
No. It queries Shodan by default and only uses the engines you name with -e and have a key for; the rest are skipped. Keys go in provider-config.yaml or environment variables, and if you list several keys for one engine it picks one at random on each run to spread the quota.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.