We're excited to share that NerdyData is now a built-in search engine option for Uncover, Project Discovery's open-source tool for querying internet search engines. Uncover already brings together Shodan, Censys, FOFA, ZoomEye and others behind one command. Now it can search the source code of hundreds of millions of websites too.
For security researchers, that means a new kind of question can be answered from the terminal: not just "which servers are exposed?", but "which websites are running this code?"
# 1. Install Uncover (Go 1.21+)
~ $ go install -v github.com/projectdiscovery/uncover/cmd/uncover@latest
# 2. Add your NerdyData API key
~ $ export NERDYDATA_API_KEY=xxx
# 3. Search website source code
~ $ uncover -nerdydata "/livewire/livewire.js" -silent -limit 10
gigsalad.com
ddw.nl
vectorportal.com
polyfacefarms.com
vilt.be
guiato.com.br
xalkiadakis.gr
leftronic.com
highampress.co.uk
cycloneshockey.comGet your key from the NerdyData API page. Use -nerdydata on its own, or combine it with other engines using -e shodan,nerdydata.
Network search engines index what a server answers on the wire: open ports, banners and certificates. A lot of real-world risk lives somewhere else: in the JavaScript libraries, CMS plugins and third-party scripts a website loads in the browser. That code is often served from a CDN and invisible to a port scan.
NerdyData indexes exactly that layer: page source, loaded scripts, cookies, response headers and JavaScript variables. Adding it to Uncover fills a gap in the open-source recon toolkit.
Supply-chain incident response. When a CDN or third-party script is compromised, find every site that loads it.
Vulnerability research. Measure how many sites ship a vulnerable library or plugin before you disclose.
Bug bounty recon. Discover related sites through shared tracking IDs, scripts and code.
Attack surface management. Find forgotten microsites and acquired properties your inventory missed.
Threat hunting. Pivot from one skimmer or injected script to every site carrying it.
Results come out one host per line, so they drop straight into httpx, Nuclei and the rest of the Project Discovery toolchain.
In June 2024, the polyfill.io domain was taken over and used to inject malware into the websites that loaded it. More than two years later, 12,138 websites still reference it in their page source, including 28 publicly traded companies, 6 government sites and 8 domains in public bug bounty programs.
One command lists them:
uncover -nerdydata 'polyfill.io' -l 15000 -f host -silentPipe the list into httpx to keep only live hosts, ready for your usual scans on assets you're authorized to test:
uncover -nerdydata 'polyfill.io' -l 15000 -f host -silent \
| httpx -silentUncover is Project Discovery's open-source command line tool for querying internet search engines such as Shodan, Censys, FOFA and ZoomEye through one interface. It handles API keys, pagination and rate limits, and outputs a list of hosts ready for tools like httpx and Nuclei.
Yes. Since Uncover v1.2.1, NerdyData is a built-in source. Use -nerdydata (or -nd) to query NerdyData only, or -e nerdydata -q to add it alongside other engines such as Shodan and Censys.
Export NERDYDATA_API_KEY in your shell or CI environment, or add your key under a nerdydata entry in $HOME/.config/uncover/provider-config.yaml. If you list more than one key, Uncover picks one at random per run.
Shodan and Censys index what a server answers on the network: open ports, service banners, TLS certificates and HTTP titles. NerdyData indexes what a website loads in the browser: page source, script URLs, cookies, response header keys and JavaScript globals. That finds vulnerable JavaScript libraries, CMS plugins, third-party scripts and skimmers, even on sites behind a CDN.
Yes. A plain string is sent as a single code search. Pass a NerdyData search JSON object with all (AND), any (OR) and none (NOT) arrays, and Uncover forwards it unchanged.
Yes. Searching reads data NerdyData has already crawled and never sends traffic to the matching sites. Piping results into httpx, Nuclei or any other active scanner is not passive, so only scan assets you own, assets in a bug bounty program scope, or systems you have written permission to test.