HTTP

Hypertext Transfer Protocol (HTTP) is a foundational protocol for transmitting data over the internet. It's the protocol that governs the communication between web servers and web clients.

Field	Type	Description
services.http	object
services.http.request	object
services.http.request.body	text	The body sent in the HTTP request, always empty.
services.http.request.headers	nested	The key:value header pairs included in the HTTP request, which always includes a Censys User-Agent.
services.http.request.headers.key	text
services.http.request.headers.value	object
services.http.request.headers.value.headers	text	The values provided in the corresponding header.
services.http.request.method	text	The HTTP method used for the request, always "GET".
services.http.request.uri	text	The full path used to make the request, which includes the scheme, host, port (when non-standard), and endpoint.
services.http.response	object
services.http.response.body	text	The body of the HTTP response. For hosts without a name, the first 64KB are available. For hosts with a name, only 6KB are available.
services.http.response.body_hashes	text	A hashing algorithm and the hexadecimal digest produced by applying it to services.http.response.body, separated by a colon (`:`) character. For example, '`sha256:446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f`.
services.http.response.body_size	integer	The length, in bytes, of services.http.response.body; at most, 64KB.
services.http.response.favicons	object
services.http.response.favicons.hashes	text	A hashing algorithm and the hexadecimal digest produced by applying it to favicon, separated by a colon (`:`) character. For example, `sha256:446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f`.
services.http.response.favicons.md5_hash	keyword	The hexadecimal MD5 digest of the favicon.
services.http.response.favicons.name	text	The URI used to retrieve the favicon, which most commonly use the http(s) or data schemes. URIs using the data scheme are truncated: the first 48 and last 24 characters are preserved.
services.http.response.favicons.shodan_hash	integer	A hash expressed as a signed decimal integer, provided for compatibility with Shodan search.
services.http.response.favicons.size	integer	The size of the favicon retrieved, in bytes.
services.http.response.headers	nested	The key-value header pairs included in the response.
services.http.response.headers.key	text
services.http.response.headers.value	object
services.http.response.headers.value.headers	text	The values provided in the corresponding header.
services.http.response.html_tags	text	A list of the <title> and <meta> tags from services.http.response.body.
services.http.response.html_title	text	The title of the HTML page: the inner contents of the <title> tag in services.http.response.body, if present.
services.http.response.protocol	text	The protocol field of the response, which includes the claimed HTTP version number.
services.http.response.status_code	integer	A 3-digit integer result code indicating the result of the services.http.request.
services.http.response.status_reason	text	A human-readable phrase describing the status code.
services.http.supports_http2	boolean	Whether a HTTP/2 handshake with the server succeeded.

Open Directory Listing Host with Suspicious File Names in their Contents

same_service(

(services.http.response.html_title:"Index of /" or services.http.response.html_title:"Directory Listing for /")

)

Tip

Censys Search users with a Pro and above license can run Regular Expression (Regex) queries to unlock advanced search capabilities.

Try it

Pupy RAT C2

same_service(services.http.response.headers.Etag="\"aa3939fc357723135870d5036b12a67097b03309\"" and services.http.response.headers.Server="nginx/1.13.8") or same_service(services.tls.certificates.leaf_data.issuer.organization:/[a-zA-Z]{10}/ and services.tls.certificates.leaf_data.subject.organization:/[a-zA-Z]{10}/ and services.tls.certificates.leaf_data.subject.organizational_unit="CONTROL")

Tip

Censys Search users with a Pro and above license can run Regular Expression (Regex) queries to unlock advanced search capabilities.

Try it

Other Articles In This Section

In this article

Warning

Note

Tip

Tip

Tip

Comments