fofa_search
Search FOFA's cyberspace mapping platform to discover internet-connected assets like hosts, IPs, and domains using field-based query syntax for security research and asset inventory.
Instructions
Search FOFA cyberspace mapping platform. Requires FOFA_EMAIL and FOFA_KEY environment variables. Query syntax: field="value" format. Matching operators: = (match), == (exact match), != (not match), *= (fuzzy match with wildcards). Logical operators: && (AND), || (OR). Examples: body="miner start", server=="nginx", domain="example.com" && port="443"
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | FOFA search query. Matching operators: = (match), == (exact match), != (not match), *= (fuzzy with * or ?). Logical: && (AND), || (OR). Examples: body="admin", server=="Microsoft-IIS/10", domain="example.com" && port!="80" | |
| size | No | Number of results to return (default: 100, max: 10000). IMPORTANT: If user specifies a number (e.g., '查询10个', 'find 5 results'), use that number as size value. | |
| page | No | Page number (default: 1) | |
| fields | No | Comma-separated fields to return. Available fields: host, ip, port, domain, title, protocol, server, banner, cert, icp, country, city, as_organization, etc. Default: 'host,ip,port,domain,title' | host,ip,port,domain,title |