You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
clear Manually clear the cache and user information
49
49
50
50
optional arguments:
51
51
-h, --help show this help message and exit
52
+
-v, --version show program's version number and exit
53
+
52
54
53
55
1.initialize token
54
56
^^^^^^^^^^^^^^^^^^
@@ -128,13 +130,14 @@ will explain and demonstrate below.
128
130
129
131
::
130
132
131
-
-num set the number of displays/searches
133
+
-num set the number of displays/searches, support 'all'
132
134
-count query the total amount of this dork in the ZoomEye database
133
135
-facet query the distribution of the full data of the dork
134
136
-stat the distribution of statistical data result sets
135
137
-filter query the list of a certain area in the data result set, or filter according to the content
136
138
-save the result set can be exported according to the filter conditions
137
139
-force ignore the local cache and force the data to be obtained from the API
140
+
-type select web or host search
138
141
139
142
4.number of data
140
143
^^^^^^^^^^^^^^^^
@@ -166,13 +169,23 @@ two commands include:
166
169
167
170
::
168
171
169
-
app statistics by application type
170
-
device statistics by device type
171
-
service statistics by service type
172
-
os statistics by operating system type
173
-
port statistics by port
174
-
country statistics by country
175
-
city statistics by city
172
+
# host searhc
173
+
app statistics by application type
174
+
device statistics by device type
175
+
service statistics by service type
176
+
os statistics by operating system type
177
+
port statistics by port
178
+
country statistics by country
179
+
city statistics by city
180
+
181
+
# web search
182
+
webapp statistics by Web application
183
+
component statistics by Web container
184
+
framework statistics by Web framework
185
+
server statistics by Web server
186
+
waf statistics by Web firewall(WAF)
187
+
os statistics by operating system
188
+
country statistics by country
176
189
177
190
use ``-facet`` to count the application types of all ``telnet`` devices:
178
191
@@ -214,16 +227,35 @@ by this command include:
214
227
215
228
::
216
229
217
-
app show application type details
218
-
version show version information details
219
-
device show device type details
220
-
port show port information details
221
-
city show city details
222
-
country show country details
223
-
asn show as number details
224
-
banner show details of characteristic response
225
-
time show record data time
226
-
* when this symbol is included, show all field details
230
+
# host/search
231
+
app show application type details
232
+
version show version information details
233
+
device show device type details
234
+
port show port information details
235
+
city show city details
236
+
country show country details
237
+
asn show as number details
238
+
banner show details of characteristic response
239
+
timestamp show record data time
240
+
* when this symbol is included, show all field details
241
+
242
+
# web/search
243
+
app show application type details
244
+
headers HTTP header
245
+
keywords meta keyword
246
+
title HTTP Title information
247
+
site site search
248
+
city show city details
249
+
country show country details
250
+
webapp Web application
251
+
component Web container
252
+
framework Web framework
253
+
server Web server
254
+
waf Web firewall(WAF)
255
+
os operating system
256
+
timestamp updated timestamp
257
+
* when this symbol is included, show all field details
258
+
227
259
228
260
Compared to the omitted display by default, the complete data can be
229
261
viewed through ``-filter``, as follows:
@@ -236,18 +268,21 @@ viewed through ``-filter``, as follows:
236
268
237
269
total: 1
238
270
239
-
in addition, you can also filter the data through ``-filter``, you can
240
-
filter the fields according to keywords (regular expressions are
241
-
supported), and the format is ``field=regexp``, for example, we query in
242
-
``banner`` data containing the ``telnet`` keyword:
271
+
When using ``-filter`` to filter, the syntax is: ``key1,key2,key3=value``, where ``key3=value`` is the filter condition, and the displayed content is ``key1,key2`` Example:
243
272
244
273
::
245
274
246
-
$ zoomeye search "telnet" -filter banner=telnet
247
-
ip banner
248
-
222.*.*.* \xff\xfb\x01\xff\xfb\x03\xff\xfd\x03TELNET session now in ESTABLISHED state\r\n\r\n
In the above example: ``banner=Telnet`` is the filter condition, and ``port,app`` is the displayed content. If you need to display ``banner``, the filter statement is like this
@@ -321,7 +356,7 @@ By default, five fields are shown to users:
321
356
::
322
357
323
358
1. time recorded time
324
-
2. service open service
359
+
2. service Open service
325
360
3. port port
326
361
4. app web application
327
362
5. raw fingerprint information
@@ -374,7 +409,7 @@ The `-filter` parameter supports the filtering of the following five fields:
374
409
2.port port information
375
410
3.service open service
376
411
4.app web application
377
-
5.raw original fingerprint information
412
+
5.banner original fingerprint information
378
413
* when this symbol is included, show all field details
379
414
380
415
@@ -386,7 +421,71 @@ A display of the ``id`` field is added during the display. ``id`` is the serial
386
421
387
422
The user quota will also be consumed when using the ``history`` command. The user quota will be deducted for the number of pieces of data returned in the ``history`` command. For example: IP "8.8.8.8" has a total of ``944`` historical records, and the user quota of ``944`` is deducted for one query.
388
423
389
-
10.cleanup function
424
+
10. search IP information
425
+
^^^^^^^^^^^^^^^^^^^^^^^^^
426
+
You can query the information of the specified IP through the ``zoomeye ip`` command, for example:
The ``zoomeye ip`` command also supports the filter parameter ``-filter``, and the syntax is the same as that of ``zoomeye search``. E.g:
448
+
449
+
::
450
+
451
+
$ zoomeye ip "185.*.*.57" -filter "app,app=ntpd"
452
+
Hostnames: [unknown]
453
+
Isp: [unknown]
454
+
Country: Saudi Arabia
455
+
City: [unknown]
456
+
Organization: [unknown]
457
+
Lastupdated: 2021-02-17T02:15:06
458
+
Number of open ports: 0
459
+
Number of historical probes: 1
460
+
461
+
app
462
+
ntpd
463
+
464
+
The fields supported by the ``filter`` parameter are:
465
+
466
+
::
467
+
468
+
1.port port information
469
+
2.service open service
470
+
3.app web application
471
+
4.banner original fingerprint information
472
+
473
+
474
+
475
+
..
476
+
477
+
Note: This function limits the number of queries per user per day based on different user levels.
478
+
479
+
Registered users and developers can query 10 times a day
480
+
481
+
Advanced users can query 20 times a day
482
+
483
+
VIP users can query 30 times a day
484
+
485
+
After the number of times per day is used up, it will be refreshed after 24 hours, that is, counting from the time of the first IP check, and the number of refreshes after 24 hours.
486
+
487
+
488
+
11.cleanup function
390
489
^^^^^^^^^^^^^^^^^^^^
391
490
392
491
Users search for a large amount of data every day, which causes the storage space occupied by the cache folder to gradually increase; if users use ``ZoomEye-python`` on a public server, it may cause their own ``API KEY`` and ``ACCESS TOKEN`` to leak .
@@ -600,14 +699,7 @@ data more conveniently and extract the specified data fields as follows:
600
699
601
700
|**4.Why may the total amount of data in ZoomEye-python and the browser
602
701
search the same dork be different?**
603
-
|``ZoomEye`` provides two search interfaces: ``/host/search``and
604
-
``/web/search``. only ``/host/search``is used in``ZoomEye-python``.
605
-
in most cases, the data provided by the host interface can cover more
606
-
than 90%or even 100% of the data, so the accuracy of the data can be
607
-
guaranteed. when the API makes a request, the user quota will be
608
-
consumed. if the two interfaces are compatible if it does, it will
609
-
consume more user quota; therefore, in the command line tool, only the
610
-
``/host/search`` interface is used for searching.
702
+
|``ZoomEye`` provides two search interfaces: ``/host/search``and``/web/search``. In ``ZoomEye-python``, only ``/host/search``is used by default, and``/web/search``isnot used. Users can choose the search method according to their needs by specifying the ``type`` parameter.
0 commit comments