⛔ In-depth reference: For the complete query syntax and API invocation methods of each engine, see
references/search-engine-syntax.md
The core advantage of passive reconnaissance iszero contact—it leaves no traces in the target's logs. Suitable for pre-penetration preliminary research, red team reconnaissance, or scenarios where only passive collection is permitted outside the authorized scope.
Phase 1: Multi-engine asset search
FOFA
Via http_request or curl query the FOFA API (https://fofa.info/api/v1/search/all?...) — the largest cyberspace mapping engine in China, suitable for discovering domestic assets.
Common query patterns:
- Domain assets:
domain="example.com" - IP ranges:
ip="192.168.1.0/24" - Specific services:
domain="example.com" && port="8080" - Specific components:
domain="example.com" && app="WordPress"
Quake
Via http_request or curl query the Quake API (https://quake.360.net/api/v3/search/quake_service) — 360 Cyberspace Mapping, skilled at deep fingerprinting.
Common query patterns:
- Domain:
domain:"example.com" - Service:
domain:"example.com" AND port:8443 - Component:
domain:"example.com" AND app:"Apache Tomcat"
Hunter
Via http_request or curl query the Hunter API (https://hunter.qianxin.com/openApi/search) — the Yingtu platform, skilled at IP correlation analysis and asset aggregation.
Phase 2: Cross-comparison of results
The three engines each have their own focus; only cross-comparison can yield a complete view:
| Dimension | Analysis method |
|---|---|
| IP/domain list | Deduplicate and merge across the three engines, and flag those found by only a single engine (possibly newly online/offline) |
| Port distribution | Count high-risk ports (22/3306/6379/9200), and flag non-standard ports |
| Technology stack | Summarize web frameworks, middleware, and CMS versions |
| Admin panels | Search for assets whose title contains "login"/"admin"/"dashboard" |
| Certificate information | The CN/SAN in SSL certificates may leak internal domains |
| Historical data | Compare data from different points in time to discover newly added/offline assets |
Phase 3: High-value target identification
From the passive collection results, prioritize flagging:
- Exposed admin panels — usually the shortest attack path
- Expired/unmaintained services — older component versions are more likely to have known vulnerabilities
- Accidentally exposed internal systems — services such as OA/VPN/GitLab/Jenkins that should not be publicly reachable
- Exposed database ports — unauthenticated Redis/MongoDB/Elasticsearch is a common problem
- Development/test environments — dev/test/staging subdomains usually have weaker security measures
Notes
- Pure passive collection,do notdirectly access or scan the target
- Search engine data has timeliness; the latest assets may not be indexed
- Different engines have different query syntaxes; be careful to distinguish them
Multi-engine cross-validation
- Results unique to a single engine may be newly online or already offline
- Data timeliness: each engine has different indexing times and update frequencies
- Label the source: mark assets discovered by only a single engine, which require further verification
- Note: do not scan, do not directly access the target, do not perform port scanning
Other passive information sources
- WHOIS query for domain registration information
- DNS history records
- GitHub search for leaked code/credentials
- Other public sources (social media, forums, etc.)