ZoomEye AI — Cyberspace Search

Search global network assets via the zoomeyeai CLI at https://www.zoomeye.ai.

Key features: Supports vul.cve, is_bugbounty, bugbounty.source, is_changed, is_new fields.

When to Use

Triggers (MUST load this skill)

• Searching global/overseas network assets
• Building dork queries for ZoomEye international
• Searching assets affected by a CVE
• Bug Bounty asset discovery and filtering
• Searching for assets added or changed in the last 7 days
• User mentions "zoomeyeai", "zoomeye.ai", "ZoomEye AI", "ZoomEye international"

Skip

• Purely theoretical discussion, no execution needed
• User asks about Shodan, Censys, or other search engines

Syntax-only mode

If the user only wants natural language → dork conversion ("how do I search for...", "write me the syntax for..."), skip environment checks and execution. Go directly to Workflow → Step 1 and output the dork.

Prerequisites

Step 1: Check Environment

Always verify the environment before executing any search:

# Check if installed
which zoomeyeai && zoomeyeai --version

# Check if token is configured
zoomeyeai info

Step 2: Guide the User Based on Results

If zoomeyeai is not installed:

pip3 install zoomeyeai

If zoomeyeai info returns an auth error (token not configured):

1. Tell the user they need a ZoomEye AI API-KEY:

   To use ZoomEye international search, you need an API-KEY:

   1. Go to https://www.zoomeye.ai/profile and log in
   2. Find your API-KEY in your profile
   3. Send me the key and I'll initialize it for you

2. Once the user provides the key:

   zoomeyeai init -apikey "\x3CAPIKEY>"
   

3. Verify:

   zoomeyeai info
   

   Confirm the response shows user info and quota, then proceed.

If zoomeyeai info returns normally:

Environment is ready. Proceed to workflow.

CLI Commands

zoomeyeai -h                        # Help
zoomeyeai --version                 # Version
zoomeyeai init -apikey "\x3CKEY>"      # Initialize token
zoomeyeai info                      # Account info & quota
zoomeyeai search "\x3Cdork>" [options] # Core search command

Note: No clear command.

Search Options

Error Handling

Search Syntax

Basic Rules

• Search is case-insensitive (except == exact match)
• Search strings are word-segmented for matching
• Wrap string values in quotes: "Cisco System" or 'Cisco System'
• Escape internal quotes with \: "a\"b"
• Escape parentheses with \: portinfo\(\)

Logical Operators

Search Field Reference

Device & Service Fingerprints

IP, Domain & Organization

Geolocation (English)

SSL/TLS Certificates

HTTP Headers & Body

Protocol Banners, Hashes & Time

Additional Fields

The following fields are available:

Workflow (AI Decision Tree)

Once the environment is verified, follow these steps:

1. Natural Language → Dork Conversion

Geolocation Keywords

Port/Service Keywords

Device/OS Keywords

Additional Keywords

Conversion Examples

2. Build the Dork

Combine fields with operators:

• Narrow down → &&: country="US" && service="redis" && os="Linux"
• Broaden → ||: port=80 || port=443 || port=8080
• Exclude → !=: country="US" && subdivisions!="california"
• Complex logic → (): (country="US" && port!=80) || (country="JP" && title!="404 Not Found")

3. Choose sub_type

4. Execution Strategy (Quota Optimization)

Follow "probe → verify → export":

# Step 1: Small probe to confirm dork syntax and results
zoomeyeai search "\x3Cdork>" -pagesize 10

# Step 2: Check data distribution with facets (pagesize=1 saves quota)
zoomeyeai search "\x3Cdork>" -facets country,service,os -pagesize 1

# Step 3: Bulk retrieval
zoomeyeai search "\x3Cdork>" -pagesize 1000

5. Shell Quoting Rules

Key rule: prefer single quotes as the outer wrapper. Only switch to double quotes when the dork itself contains single quote characters.

Common Search Scenarios

CVE Vulnerability Impact Assessment

# Global distribution of a CVE
zoomeyeai search 'vul.cve="CVE-2021-44228"' -facets country -pagesize 1

# CVE + specific product version
zoomeyeai search 'vul.cve="CVE-2021-44228" && app="Log4j"' -pagesize 100

Bug Bounty Asset Discovery

# Bug Bounty assets from a specific platform
zoomeyeai search 'is_bugbounty=true && bugbounty.source="hackerone"' -pagesize 10

# Specific product in Bug Bounty
zoomeyeai search 'is_bugbounty=true && app="GitLab"' -pagesize 10

# HTTP services across all Bug Bounty platforms
zoomeyeai search 'is_bugbounty=true && bugbounty.source="all" && service="http"' -pagesize 10

New & Changed Asset Monitoring

# SSH services discovered in last 7 days
zoomeyeai search 'service="ssh" && is_new=true' -pagesize 10

# Web assets changed in last 7 days
zoomeyeai search 'service="http" && is_changed=true' -facets country -pagesize 1

# Newly discovered assets affected by a CVE
zoomeyeai search 'vul.cve="CVE-2024-1234" && is_new=true' -pagesize 100

Global Exposure Discovery

# Exposed database services in a country
zoomeyeai search 'country="US" && (service="redis" || service="mysql" || service="mongodb")' -pagesize 10

# Assets of an organization
zoomeyeai search 'org="Stanford University"' -pagesize 100

# Global RDP services, excluding honeypots
zoomeyeai search 'service="rdp" && is_honeypot!="True"' -pagesize 10

Web Application Identification

# Web servers by Server header
zoomeyeai search 'http.header.server="nginx" && country="US"' -sub_type web -pagesize 10

# Admin panels by title
zoomeyeai search '(title="admin" || title="login") && country="JP"' -sub_type web -pagesize 10

# Specific apps by body content
zoomeyeai search 'http.body="phpMyAdmin"' -sub_type web -pagesize 10

SSL Certificate & Fingerprint

# Assets linked to a company's certificate
zoomeyeai search 'ssl="google"' -pagesize 10

# Let's Encrypt issued certificates
zoomeyeai search "ssl.cert.issuer.cn=\"Let's Encrypt\" && country=\"US\"" -pagesize 10

# JARM fingerprint search
zoomeyeai search 'ssl.jarm="29d29d15d29d29d00029d29d29d29dea0f89a2e5fb09e4d8e099befed92cfa"' -pagesize 10

Subnet & IP Scanning

zoomeyeai search 'cidr="52.2.254.36/24"' -pagesize 100
zoomeyeai search 'cidr="52.2.254.36/16" && service="http"' -pagesize 100

SDK Usage

from zoomeyeai.sdk import ZoomEye

zm = ZoomEye(api_key="your-api-key")

# Account info & quota
zm.userinfo()
# Returns: {"email": "", "username": "", "quota": {"plan": "", "end_date": "", "points": "", "zoomeye_points": ""}}

# Search
result = zm.search(
    dork='country=us',
    qbase64='',                  # Base64-encoded query (alternative to dork)
    page=1,
    pagesize=20,                 # SDK default is 20
    sub_type='all',              # v4 / v6 / web / all
    fields='ip,port,domain,os,app,title',
    facets='country,service'
)

Notes