FOFA Search
fofa_searchSearch FOFA assets by query with fields including ip, port, domain, title. Supports pagination and full data search.
Instructions
Search FOFA assets with /api/v1/search/all. Query is encoded as qbase64. Supported fields include: ip, port, protocol, country, country_name, region, city, longitude, latitude, asn, org, host, domain, os, server, icp, title, jarm, header, banner, cert, base_protocol, link, cert.issuer.org, cert.issuer.cn, cert.subject.org, cert.subject.cn, tls.ja3s, tls.version, cert.sn, cert.not_before, cert.not_after, cert.domain, status_code, header_hash, banner_hash, banner_fid, cname, lastupdatetime, product, product_category, product.version, icon_hash, cert.is_valid, cname_domain, body, cert.is_match, cert.is_equal, icon, fid, structinfo.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | Set true to search all data instead of one-year data. | |
| page | No | Page number, starting from 1. | |
| size | No | Results per page. | |
| query | Yes | FOFA query, for example body="admin" or domain="example.com" && port="443". | |
| fields | No | Comma-separated return fields. | host,ip,port,domain,title |
| r_type | No | Response type. Use "json" for JSON responses. | json |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||