FOFA
Search engine for Internet connected assets and devices
- Authentication
- API Key
- HTTPS
- Yes
- CORS
- Unknown
- Category
- Security
- Documentation / URL
- https://en.fofa.info/api
Overview
FOFA provides asset search — key-based (an invalid account returns HTTP 200 with an error body, verified).
Quick Start
Search (replace YOUR_EMAIL/YOUR_KEY):
curl "https://fofa.info/api/v1/search/all?email=YOUR_EMAIL&key=YOUR_KEY&qbase64=dGVzdA=="{ "error": true, "errmsg": "[-700] 账号无效" }Authentication
- Register at fofa.info → email + key.
- Send them as query parameters (invalid → 200 + error, verified).
⚠️ Gotcha (verified): an invalid account returns HTTP 200 with
error: true— checkerror.
Rate Limits & Notes
- Key-based with a free tier (check the docs).
- Asset/device search.
FAQ
Is FOFA free? Key-based with a free tier per the docs.
Why 200 with an error?
Invalid accounts return 200 + error (verified) — check error.
What’s the auth style?
email + key query params.
More in Security
| API | Auth | HTTPS | CORS | |
|---|---|---|---|---|
| Application Environment Verification Android library and API to verify the safety of user devices, detect rooted devices and other risks | API Key | Yes | Yes | ↗ |
| BinaryEdge Provide access to BinaryEdge 40fy scanning platform | API Key | Yes | Yes | ↗ |
| BitWarden Best open-source password manager | OAuth | Yes | Unknown | ↗ |
| Botd Botd is a browser library for JavaScript bot detection | API Key | Yes | Yes | ↗ |
| Bugcrowd Bugcrowd API for interacting and tracking the reported issues programmatically | API Key | Yes | Unknown | ↗ |