### Execute Asset Search with ZoomEye Python SDK Example Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/README.rst This example illustrates an interactive Python session demonstrating how to perform an asset search using the ZoomEye Python SDK. It shows the initialization with an API key and a basic search query for assets in 'country=cn', along with the typical tabular output. ```python $ python3 >>> import zoomeyeai.sdk as zoomeye >>> # Use API-KEY search >>> zm = zoomeye.ZoomEye(api_key="01234567-acbd-00000-1111-22222222222") >>> data = zm.search('country=cn') ip port domain update_time 192.53.120.134 7766 [unknown] 2024-12-06T15:20:08 ... ``` -------------------------------- ### Install ZoomEye-python Library Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/README.rst This snippet demonstrates how to install the ZoomEye-python library. Users can choose to install it directly from PyPI using pip3 or from the GitHub repository for the latest development version. ```Shell pip3 install zoomeyeai ``` ```Shell pip3 install git+https://github.com/zoomeye-ai/ZoomEye-python ``` -------------------------------- ### List Python Project Dependencies (requirements.txt) Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/requirements.txt This snippet lists the exact versions of Python packages required for the `/zoomeye-ai/zoomeye-python` project. These dependencies are managed via a `requirements.txt` file, which allows for consistent environment setup across different development and deployment environments. Users can install these packages using `pip install -r requirements.txt`. ```Python certifi==2021.10.8 charset-normalizer==2.0.8 colorama==0.4.4 graphviz==0.19 idna==3.3 requests==2.26.0 ``` -------------------------------- ### ZoomEye API: Search by Product Component Information Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets based on specific product component information. This filter supports searching for mainstream asset components. ```APIDOC product="Cisco" ``` -------------------------------- ### Get User Information with ZoomEye AI API Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md This API endpoint retrieves detailed information about the current user, including their username, email, phone number, creation date, and subscription details. It also provides current general and ZoomEye-specific points. This endpoint requires an API key for authentication and returns user data in JSON format. ```APIDOC POST /v2/userinfo Response Fields: - code (integer): Response code - message (string): Response message - data (object): User information and subscription details - username (string): Username - email (string): User email - phone (string): User phone number - created_at (string, date-time): user creation time - subscription (object): subscription information - plan (string): subscription plan - end_date (string, date-time): subscription end date - points (string): Available General Points, You can also see it from [here](https://www.zoomeye.ai/profile/record) - zoomeye_points (string): Available ZoomEye-Points, You can also see it from [here](https://www.zoomeye.ai/profile/record) ``` ```bash curl -X POST https://api.zoomeye.ai/v2/userinfo -H "API-KEY: $YOUR_API_KEY" ``` ```json { "code": 60000, "message": "success", "data": { "username": "abc", "email": "user@example.com", "phone": "+1234567890", "created_at": "2023-01-15T08:00:00Z", "subscription": { "plan": "Premium", "end_date": "2024-01-20T00:00:00Z", "points": "30000", "zoomeye_points": "10000000" } } } ``` -------------------------------- ### ZoomEye API: Search by Transmission Protocol Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets based on their transmission protocol. Common transmission protocols include TCP, UDP, TCP6, and SCTP. ```APIDOC protocol="TCP" ``` -------------------------------- ### ZoomEye Search: Find Assets by Hostname Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches for assets of related IP hostnames. This filter is useful for identifying devices based on their assigned hostnames. ```APIDOC hostname="google.com" ``` -------------------------------- ### ZoomEye Search: Find C-class IP Assets by CIDR Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches for C-class assets within a specified IP CIDR block. This filter allows for granular IP range searches. For example, 'cidr="52.2.254.36/16"' searches for B-class IPs, and 'cidr="52.2.254.36/8"' searches for A-class IPs. ```APIDOC cidr="52.2.254.36/24" ``` -------------------------------- ### ZoomEye Search: Query by Protocol Messages (Banner) Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches by protocol messages, often used for searching HTTP response header data. This allows for identifying services based on their initial banner responses. ```APIDOC banner="FTP" ``` -------------------------------- ### ZoomEye Search: Query by HTTP Header Version Number Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches by the version number found in the HTTP header. This allows for filtering assets based on the HTTP protocol version they support. ```APIDOC http.header.version="1.2" ``` -------------------------------- ### Initialize ZoomEye-python CLI Token with API Key Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/README.rst Before using the ZoomEye-python CLI, users must initialize their API token for authentication. This example demonstrates how to initialize the token using an API key, which can be obtained from the ZoomEye profile page. The command confirms successful initialization and displays basic role and quota information. ```Shell $ zoomeyeai init -apikey "01234567-acbd-00000-1111-22222222222" successfully initialized Role: developer Quota: 10000 ``` -------------------------------- ### ZoomEye Search: Find Assets by Internet Service Provider (ISP) Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches for assets related to specified network service providers. This filter can be combined with organization data for more refined and targeted searches. ```APIDOC isp="China Mobile" ``` -------------------------------- ### Perform Basic Search with ZoomEye-python CLI Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/README.rst This example demonstrates the core 'search' function of the ZoomEye-python CLI, used to query the ZoomEye database. It shows a simple search for 'telnet' and displays the default output fields: IP address, port, domain, and update time, along with the total number of results. ```Shell $ zoomeyeai search "telnet" ip port domain update_time 192.53.120.134 7766 [unknown] 2024-12-06T15:20:08 total: 1 ``` -------------------------------- ### ZoomEye Search: Find Assets by HTTP Header Hash Value Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches by the hash values calculated from the HTTP header. This provides a unique identifier for specific header configurations, useful for finding similar assets. ```APIDOC http.header_hash="27f9973fe57298c3b63919259877a84d" ``` -------------------------------- ### ZoomEye API: Search by Operating System Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets based on their operating system. Common systems include Linux, Windows, RouterOS, IOS, and JUNOS. Additional systems can be found in the domain name sidebar aggregation display of search results. ```APIDOC os="RouterOS" ``` -------------------------------- ### ZoomEye Search Filters for IP and Domain Data Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md This section provides ZoomEye search filters for identifying assets based on their IPv4 or IPv6 addresses. These filters are essential for targeting specific hosts or networks directly. ```APIDOC ip="8.8.8.8" ``` ```APIDOC ip="2600:3c00::f03c:91ff:fefc:574a" ``` -------------------------------- ### ZoomEye API: API-KEY Authentication Method Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md ZoomEye-API supports API-KEY authentication. Each account has a unique API-KEY string found at the bottom of its profile page. This key must be included in API requests for authentication. ```APIDOC API-KEY: [Your API Key Here] Location: User profile page (e.g., https://www.zoomeye.ai/profile) ``` -------------------------------- ### ZoomEye API: Search by DNS Dig Content Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets based on their DNS dig content, including domain and IP address. This allows for targeted searches related to DNS records. ```APIDOC dig="baidu.com 220.181.38.148" ``` -------------------------------- ### ZoomEye API Query Parameter Reference Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md This section details the available query parameters for the ZoomEye API, including their data types, descriptions, and the required user plan for access. These parameters are used to refine search queries for asset information. ```APIDOC Parameters: - name: honeypot type: integer description: Is it a honeypot (0 for no, 1 for yes) access: All users - name: ssl type: string description: SSL x509 certificate information access: All users - name: primary_industry type: string description: Primary industry information access: Business plan and above - name: sub_industry type: string description: Sub-industry information access: Business plan and above - name: rank type: integer description: Asset importance ranking, the higher the score, the more important. access: Business plan and above ``` -------------------------------- ### ZoomEye Search: Find Assets by HTML Body Content Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches by content within the HTML body of web pages. This allows for identifying assets based on specific keywords or phrases present in their web content. ```APIDOC http.body="document" ``` -------------------------------- ### ZoomEye API: Filter for Honeypot Assets Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Filter search results to specifically include or exclude honeypot assets. Setting this filter to 'True' will only show identified honeypots. ```APIDOC is_honeypot="True" ``` -------------------------------- ### ZoomEye Search: Search for Domain-Related Assets Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Used to search for domain and subdomain data, finding assets related to a specified domain. This helps in discovering infrastructure associated with a particular web presence. ```APIDOC domain="baidu.com" ``` -------------------------------- ### ZoomEye API: Search by File Hash Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets with related content based on the parsed file data's hash. This is useful for identifying assets associated with specific files, such as those parsed with 'Gitlab'. ```APIDOC filehash="0b5ce08db7fb8fffe4e14d05588d49d9" ``` -------------------------------- ### ZoomEye Search: Find Assets by Service Protocol Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches for assets related to a specified service protocol. Common service protocols include: http, ftp, ssh, telnet, etc. Other services can be found in the domain name sidebar aggregation display of search results. ```APIDOC service="ssh" ``` -------------------------------- ### Bash: Convert Query Condition to Base64 Encoding Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md This snippet demonstrates how to convert a query condition string into base64 encoding using the `base64` command-line tool in Bash. The resulting base64 string can then be passed as a `qbase64` parameter to the ZoomEye API for encoded queries. ```bash echo 'title="knownsec"' | base64 ``` -------------------------------- ### ZoomEye Query Interface Response Fields APIDOC Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Defines the structure and details of fields returned by the ZoomEye query interface. Each entry specifies the field name, data type, a brief description of its content, and the minimum permission level required to access it. This reference is essential for developers integrating with ZoomEye data. ```APIDOC [ { "field_name": "ip", "type": "string", "description": "IP address (used when the web asset is incomplete)", "permission": "All users" }, { "field_name": "domain", "type": "string", "description": "Domain", "permission": "All users" }, { "field_name": "url", "type": "string", "description": "Full URL of the asset (for web assets)", "permission": "All users" }, { "field_name": "ssl.jarm", "type": "string", "description": "SSL JARM fingerprint", "permission": "All users" }, { "field_name": "ssl.ja3s", "type": "string", "description": "SSL JA3S fingerprint", "permission": "All users" }, { "field_name": "iconhash_md5", "type": "string", "description": "MD5 value of the icon image", "permission": "Professional plan and above" }, { "field_name": "robots_md5", "type": "string", "description": "MD5 value of the robots.txt file", "permission": "Business plan and above" }, { "field_name": "security_md5", "type": "string", "description": "MD5 value of the security settings file", "permission": "Business plan and above" }, { "field_name": "hostname", "type": "string", "description": "Hostname information", "permission": "All users" }, { "field_name": "os", "type": "string", "description": "Operating system information", "permission": "All users" }, { "field_name": "port", "type": "integer", "description": "Port number", "permission": "All users" }, { "field_name": "service", "type": "string", "description": "Provided application protocol (e.g., HTTP, SSH)", "permission": "All users" }, { "field_name": "title", "type": "list", "description": "Webpage title", "permission": "All users" }, { "field_name": "version", "type": "string", "description": "Component version information", "permission": "All users" }, { "field_name": "device", "type": "string", "description": "Device name", "permission": "All users" }, { "field_name": "rdns", "type": "string", "description": "Reverse DNS information", "permission": "All users" }, { "field_name": "product", "type": "string", "description": "Product component information", "permission": "All users" }, { "field_name": "header", "type": "string", "description": "HTTP response header information", "permission": "All users" }, { "field_name": "header_hash", "type": "string", "description": "Hash calculated from HTTP response header", "permission": "Professional plan and above" }, { "field_name": "banner", "type": "string", "description": "Service banner information", "permission": "All users" }, { "field_name": "body", "type": "string", "description": "HTML Body content", "permission": "Business plan and above" }, { "field_name": "body_hash", "type": "string", "description": "Hash calculated from the HTML body", "permission": "Professional plan and above" }, { "field_name": "update_time", "type": "string", "description": "Asset update time", "permission": "All users" }, { "field_name": "header.server.name", "type": "string", "description": "Server name in the HTTP response header", "permission": "All users" }, { "field_name": "continent.name", "type": "string", "description": "Name of the continent", "permission": "All users" }, { "field_name": "country.name", "type": "string", "description": "Name of the country", "permission": "All users" }, { "field_name": "province.name", "type": "string", "description": "Name of the province", "permission": "All users" }, { "field_name": "city.name", "type": "string", "description": "Name of the city", "permission": "All users" }, { "field_name": "isp.name", "type": "string", "description": "ISP name", "permission": "All users" }, { "field_name": "organization.name", "type": "string", "description": "Organization name", "permission": "All users" }, { "field_name": "zipcode", "type": "integer", "description": "Postal code", "permission": "All users" }, { "field_name": "idc", "type": "string", "description": "Is it an IDC (0 for no, 1 for yes)", "permission": "All users" }, { "field_name": "lon", "type": "string", "description": "Geolocation longitude", "permission": "All users" }, { "field_name": "lat", "type": "string", "description": "Geolocation latitude", "permission": "All users" }, { "field_name": "asn", "type": "string", "description": "Autonomous System Number", "permission": "All users" }, { "field_name": "protocol", "type": "string", "description": "Transport layer protocol (e.g., TCP, UDP)", "permission": "All users" } ] ``` -------------------------------- ### ZoomEye API: Search by Device Type Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets based on their device type. Common types include router, switch, and storage-misc. Other types can be found in the domain name sidebar aggregation display of search results. ```APIDOC device="router" ``` -------------------------------- ### ZoomEye Search: Filter by HTTP Header Server Field Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Searches by the server field within the HTTP header. This is used for identifying web servers based on their reported server software, such as 'Nginx'. ```APIDOC http.header.server="Nginx" ``` -------------------------------- ### ZoomEye API: Search by HTML Title Content Source: https://github.com/zoomeye-ai/zoomeye-python/blob/master/api.md Search for assets where the HTML content's title contains a specific string. This filter targets the