Space Query Skill#

Multi-platform query builder for FOFA, Quake, ZoomEye, and Shodan.

Quick Start#

1. Detect platform — Use specified platform or ask user
2. Analyze intent — What to find, where, attributes, exclusions
3. Build query — Apply correct syntax for the platform
4. Present result — Use the output format below

Platform Selection#

PlatformBest ForSyntax StyleFOFAGlobal coverage, protocol detailsfield="value"Quake (鹰图)China data, threat intelfield:valueZoomEyeService fingerprintsfield:valueShodanIoT,漏洞关联field:value

Core Patterns#

Pattern 1: Exposed Service#

text

FOFA:   product="Redis" && port="6379" && country="CN"
Quake:  app:Redis AND port:6379 AND country:China
Shodan: product:Redis port:6379 country:CN

Pattern 2: Login Page#

text

FOFA:   (title="登录" || title="admin" || title="后台") && country="CN"
Quake:  (keyword:登录 OR keyword:admin) AND country:China
Shodan: title:"login" country:CN

Pattern 3: File Upload#

text

FOFA:   (body="plupload" || body="webuploader" || title="上传") && country="CN"
Shodan: http.html:"type=\"file\"" country:CN

Pattern 4: SSL Certificate Issue#

text

FOFA:   cert.is_expired=true && country="CN"
Shodan: ssl.cert.expired:true country:CN

Pattern 5: CVE/Vulnerability Search#

Critical: Always extract features from CVE info and use platform-specific product identifiers.

CVE Query Workflow

text

┌─────────────────────────────────────────────────────────────┐
│  Step 1: WebSearch for official queries                    │
│  Search: "[Platform] CVE-XXXX-XXXX" or "[CVE] + FOFA"  │
└─────────────────────────┬───────────────────────────────────┘
                          ▼
┌─────────────────────────────────────────────────────────────┐
│  Step 2: Find official source                               │
│  - Platform blog (en.fofa.info, quake.360.net/blog)     │
│  - Security sites (securityonline.info, nvd.nist.gov)     │
│  - GitHub PoC repos often contain platform queries         │
└─────────────────────────┬───────────────────────────────────┘
                          ▼
┌─────────────────────────────────────────────────────────────┐
│  Step 3: Extract platform-specific product ID               │
│  - FOFA uses app="product-name"                            │
│  - Quake uses app:product-name                             │
│  - Shodan uses product:product-name                        │
└─────────────────────────┬───────────────────────────────────┘
                          ▼
┌─────────────────────────────────────────────────────────────┐
│  Step 4: Build query                                       │
└─────────────────────────────────────────────────────────────┘

How to Find Official Sources

When given a CVE, ALWAYS use WebSearch first:

bash

# Search for platform-specific queries
web_search: "CVE-2024-38819 FOFA query"
web_search: "CVE-2024-38819 fofa.info"
web_search: "CVE-2024-38819 Quake 360"
web_search: "CVE-2024-38819 PoC github"

# Search for official platform announcements
web_search: "site:en.fofa.info CVE-2024-38819"
web_search: "site:quake.360.net CVE"

Official Sources to Check:

SourceURLWhat to FindFOFA Blogen.fofa.infoOfficial queries with exact app IDsQuake Blogquake.360.net/blogThreat intel announcementsNVDnvd.nist.govCVE details, affected productsSecurityOnlinesecurityonline.infoPoC with platform queriesGitHubgithub.comPoC exploits often include FOFA/Quake queries

Example - CVE-2024-38819

Step 1: WebSearch

text

Search: "CVE-2024-38819 FOFA"
Result: en.fofa.info shows "app="vmware-Spring-Framework""

Step 2: Official Query Found

text

FOFA: app="vmware-Spring-Framework"  (25k+ results)

Step 3: Cross-platform translation

text

FOFA:   app="vmware-Spring-Framework"
Shodan: product:"Spring Framework"
Quake:  app:Spring
ZoomEye: app:spring

Wrong vs Correct Approach

Wrong (lazy):

text

body="CVE-2024-38819"     ❌ CVE ID in body, no results
product="Spring"           ❌ Wrong product ID for most platforms

Correct (official product ID):

text

app="vmware-Spring-Framework"  ✅ FOFA official query

Verified CVE Query Table

CVEAffectsFOFAShodanQuakeCVE-2024-38819Spring Frameworkapp="vmware-Spring-Framework"``product:"Spring Framework"``app:SpringCVE-2021-44228Apache Log4japp="Apache-log4j2"``product:log4j``app:log4jCVE-2019-0708Windows RDPapp="Microsoft-RDP"``vuln:CVE-2019-0708``app:RDPCVE-2022-22965Spring4Shellapp="vmware-Spring-Framework"``product:Spring``app:Spring

Rule: When you find an official query from a trusted source (platform blog, security site, verified PoC), use that exact query.

Operator Precedence#

text

() > == > = > != > && > ||

Rule: Always wrap multiple OR conditions with ().

Output Format#

Present queries using this structure:

markdown

## Query

**Platform:** [Platform]

[Query Here]

text

### Explanation
- **Target:** What this finds
- **Fields:** Main fields used
- **Logic:** AND/OR relationship

### Suggestions
- Additional filters to consider
- Known limitations
- Alternative approaches

Field Reference#

See resources/fields.md for complete field lists per platform.

Important Notes#

1. Parentheses — (A || B) && C not A || B && C
2. Platform syntax differs — FOFA uses =" while others use :
3. Chinese chars — country="中国" works in FOFA, prefer English elsewhere
4. Time filtering — after/ before in FOFA/Quake

Troubleshooting#

IssueSolutionNo resultsAdd status_code="200" or remove strict filtersToo many resultsAdd country, time, or product filtersWrong syntaxCheck platform in reference files