fofa_viewer
FOFA Viewer is a JavaFX-based desktop client for querying the FOFA internet search engine. It wraps FOFA's API into a user-friendly interface with multi-tab results, Excel export, and advanced filtering features, primarily used by penetration testers and security researchers.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | wgpsec/fofa_viewer |
| Owner | wgpsec |
| Primary language | Java |
| License | MIT — OSI-approved |
| Stars | 1.8k |
| Forks | 164 |
| Open issues | 20 |
| Latest release | 1.1.16 (2025-12-26) |
| Last updated | 2025-12-26 |
| Source | https://github.com/wgpsec/fofa_viewer |
What fofa_viewer is
Desktop application written in Java using JavaFX framework that interfaces with FOFA's REST API. Supports JDK 8 and JDK 11+, includes certificate conversion utilities, deduplication logic for search results, and requires Maven for compilation via maven-assembly-plugin. Requires configuration of email and API credentials in config.properties.
Get the fofa_viewer source
Clone the repository and explore it locally.
git clone https://github.com/wgpsec/fofa_viewer.gitcd fofa_viewer# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- Verify JDK version (8, 11+, or 17+) before deployment; export functionality requires specific JVM parameters for JDK 16+ and 17+ (--add-opens flag).
- API key must be configured in config.properties; pricing and query limits depend on FOFA membership tier (free, standard, premium, enterprise).
- Results are deduplicated locally by the tool (port 80 HTTP, port 443 HTTPS logic); displayed count may differ from export count due to FOFA API limits (10,000 record export for premium members).
- Favicon resolution uses jsoup parsing; Vue.js and dynamic-render websites may not resolve favicon links; fallback requires manual URL input.
- Secondary development uses maven-assembly-plugin; ensure Maven is configured and dependencies resolve from central repository.
When to avoid it — and what to weigh
- No FOFA account or API credentials — Tool requires an active FOFA API key (free, standard, or premium tier). Without valid credentials, the application cannot function.
- Headless/serverless deployment requirement — FOFA Viewer is a desktop GUI application built on JavaFX and has no CLI or API server mode. It requires a graphical environment and interactive user session.
- Cross-platform mobile or web interface needed — Tool is Windows/Linux/macOS desktop-only. No native mobile app, web UI, or remote access capabilities are available.
- Real-time or programmatic integration at scale — Application is UI-driven and not designed for direct library/SDK integration. For automation, query FOFA API directly rather than driving the GUI.
License & commercial use
MIT License. Permits commercial and private use, modification, and distribution with attribution. No patent grant or warranty provided.
MIT License is permissive and allows commercial use without restriction. However, the tool's utility depends on FOFA's commercial API service (requires paid membership for advanced queries). Ensure your FOFA account terms permit commercial use of query results.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Adequate |
| License clarity | Clear |
| Deployment complexity | Low |
| DEV.co fit | Possible |
| Assessment confidence | High |
Tool stores FOFA API credentials in plaintext config.properties; ensure file is protected with appropriate OS-level permissions and not committed to version control. Network traffic to FOFA is not documented (assume HTTPS). No mention of certificate pinning, proxy support, or offline mode. Data deduplication and filtering logic reduce false positives but do not validate result accuracy against real targets.
Alternatives to consider
FOFA Web UI (official browser interface)
Official, no software installation required, always up-to-date. Downside: slower for bulk operations, no native Excel export, limited batch workflow support.
Shodan / Censys (alternative internet search engines)
Similar reconnaissance capabilities with different indexing and query syntax. May have different coverage, pricing, and API ecosystems. Separate account and credentials required.
Direct FOFA API integration (custom script/SDK)
Full programmatic control, no GUI overhead, integrates easily into CI/CD and automation pipelines. Requires development effort and API knowledge.
Build on fofa_viewer with DEV.co software developers
FOFA Viewer simplifies bulk asset reconnaissance if your team uses FOFA. Assess whether its desktop-only UI and deduplication logic fit your workflow, or if direct API integration would be more efficient.
Talk to DEV.coRelated open-source tools
Surfaced by semantic similarity across the DEV.co open-source index.
Related on DEV.co
Explore the category and the services that help you build with it.
fofa_viewer FAQ
Do I need a FOFA membership to use FOFA Viewer?
Why does my query show 10,000+ results in the UI but export fewer records to Excel?
Can I automate searches or integrate FOFA Viewer into scripts?
What Java versions are supported?
Custom software development services
Adopting fofa_viewer is usually one piece of a larger software development effort. As a software development agency, DEV.co provides software development services and web development expertise — pairing senior software developers and web developers with your team to design, build, and operate open-source security software in production.
Evaluate FOFA Viewer for your security team
FOFA Viewer simplifies bulk asset reconnaissance if your team uses FOFA. Assess whether its desktop-only UI and deduplication logic fit your workflow, or if direct API integration would be more efficient.