Runner Fofa icon

Runner Fofa

Interact with Fofa

Overview

This node integrates with the Fofa API, a service that allows users to search and gather information about internet-connected assets based on custom queries. It is useful for cybersecurity professionals, researchers, or IT administrators who want to discover hosts, IPs, ports, protocols, and other metadata related to networked devices.

Typical use cases include:

  • Performing asset discovery by querying specific IP ranges, domains, or protocols.
  • Gathering detailed metadata about discovered hosts for vulnerability assessment.
  • Automating reconnaissance tasks in security workflows.

For example, a user can input a query like app="nginx" to find all servers running Nginx, specifying which fields to retrieve and how many results per page.

Properties

Name Meaning
Query The search query string to filter assets in Fofa's database.
Page The page number of results to retrieve (pagination).
Size Number of results per page (maximum items returned).
Fields Comma-separated list of fields to return for each result (e.g., ip,port,host).
Full Boolean flag indicating whether to return full data or partial data from the API.

Output

The node outputs an array of JSON objects representing the discovered assets matching the query. Each object contains:

  • Basic properties such as ip, domain (hostname), port, and protocol.
  • Additional metadata fields as specified by the fields input.
  • The domain field is normalized from the host or IP.
  • URLs are normalized to include protocol prefixes (http:// or https://) based on port.
  • The output structure is consistent and wrapped with execution metadata for n8n.

No binary data is produced by this node.

Dependencies

  • Requires an active connection to the Fofa API via an API key credential configured in n8n.
  • Uses HTTP GET requests to https://fofa.info/api/v1/search/all.
  • The node expects the API key credential to be set up under a generic "API authentication token" configuration.

Troubleshooting

  • Common issues:
    • Invalid or missing API credentials will cause authentication failures.
    • Queries returning no results will produce empty output arrays.
    • Pagination parameters exceeding available pages may return empty results.
  • Error messages:
    • If the API returns an error with a message not containing code 820031, the node throws an error with the message from Fofa.
    • To resolve errors, verify the correctness of the query syntax, API key validity, and network connectivity.

Links and References

Discussion