quake_search
Search the Quake 360 cyberspace mapping platform to discover assets, ports, and services using field-based queries with logical operators for security research and reconnaissance.
Instructions
Search Quake 360 cyberspace mapping platform using scroll API (supports deep pagination). Requires QUAKE_KEY environment variable. Query syntax: field:value format (e.g., port:443, title:"keyword"). Logical operators: AND, OR, NOT (uppercase). Examples: port:443, ip:1.1.1.1 AND port:80, service:http AND NOT response:"baidu". IMPORTANT: Use 'include' parameter to specify which fields to return. NOTE: Field names must be exact - use 'asn' and 'org' (NOT 'as_org'), use specific component fields like 'components.product_name_cn' (NOT just 'components'). Supports pagination_id for getting more pages.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Quake search query using colon syntax. Logical operators: AND, OR, NOT (uppercase). Examples: title:"后台管理", port:3389 AND country:"China", port:80 AND NOT response:"baidu", domain:example.com OR domain:test.com | |
| size | No | Number of results to return per page (default: 100, larger size = longer request time). IMPORTANT: If user specifies a number (e.g., '查询10个', 'find 5 results'), use that number as size value. | |
| pagination_id | No | Pagination ID from previous response. Use this to get next page. Expires in 5 minutes. Leave empty for first request. | |
| include | No | Comma-separated fields to include. REGISTERED USERS can use: ip, port, hostname, transport, asn, org, service.name, location.country_cn, location.province_cn, location.city_cn, service.http.host, service.http.title, service.http.server. MEMBER USERS can additionally use: time, domain, service.response, service.cert, components.product_catalog, components.product_type, components.product_level, components.product_vendor, location.country_en, location.province_en, location.city_en, location.district_en, location.district_cn, location.isp, service.http.body, components.product_name_cn, components.version, service.http.infomation.mail, service.http.favicon.hash, service.http.favicon.data, service.http.status_code. IMPORTANT: Use exact field names - 'asn' and 'org' (NOT 'as_org'), specific component fields like 'components.product_name_cn' (NOT 'components'). Example: 'ip,port,service.http.title,org,asn' for basic info with organization. | |
| exclude | No | Comma-separated fields to exclude from results | |
| ignore_cache | No | Whether to ignore cache (default: false) | |
| latest | No | Whether to use latest data (default: true) | |
| start_time | No | Query start time in format: 2020-10-14 00:00:00 (UTC timezone) | |
| end_time | No | Query end time in format: 2020-10-14 00:00:00 (UTC timezone) |