Search 2.0 Search Language
Censys Search Language supports full-text searching across all fields, querying individual fields, boolean logic, and regular expressions (for paid tiers). Censys Search Language is similar but not identical to Lucene’s and Elasticsearch’s search syntax.
Search Basics: How to Construct a Query
Full Text Searches
Any time you make a search that doesn’t specify a specific field, Censys will search across all text-based fields. You can search for multiple-word phrases by adding double quotes.
Query for Hosts that contain the term “Hello World”:
Querying Individual Fields
Censys lets you search structured fields whose keys are derived from application handshakes completed by our scanner. Fields reflect the nested structure of the schema using dot notation.
For example, you can find all devices that have an HTTP Server header that includes the word Apache with this search:
Important! The above search does not return results that have the exact value “Apache”. Rather, it will find hosts where the word Apache appears in the server header. For example, the value “Apache Server” would be returned as a result.
If you want to search for an exact match, use the equals operator:
You can use the asterisk symbol (*) and question mark (?) to perform wildcard searches that match zero or more characters, or exactly one character, respectively. These are helpful for finding records where you know the start of a word, but not how it will end.
For example, the search above, (services.http.response.headers.server: Apache) will return hosts with the Server header “Apache” and “Apache Server”, but it will not return hosts with the Server header “Apache-Serve” since it matches on whitespace delimited words. You can search for all hosts with the field that starts with Apache with the following query:
Warning! Censys does not support leading wildcard searches (e.g.,
“* Apache”) because we’re unable to use any indices to complete this search.
Many users want to use leading wildcards to search domain name fields. Don’t worry — when searching an FQDN field (e.g., the name on a certificate), the search “censys.io” will include results for all subdomains of censys.io. To restrict those searches to exactly the string provided, use the equals operator.
Censys allows the binary operators and, or, and not, as well as parentheses to combine search criteria.
For example, this query will return hosts located in the US or Canada:
You can search for set matches instead of constructing long or-based queries. For example, the above query can be also be expressed as:
Searching Networks, Services, and Software
Censys Search Language has several features specific to searching Internet networks, services and software.
Searching Specific Networks
You can search for (online) IPs in a specific CIDR block:
You can search for IPs in a non-standard IP range as well:
Searching Across Services
Censys’ new data model accounts for the possibility that protocols can appear on any port, which makes searches for protocol data on a specific port tricky.
You can search for open ports by checking for the existence of a service on a given port. For example, the following search will find hosts with any service on port 443.
And the following search will find any hosts running HTTP on at least one port:
Important! You cannot simply combine these two predicates to find services running HTTP(S) on port 443. The following query will return hosts with any service on port 443 and HTTP on any port.
Searching in the Same Service
You can use the same_service() operator to apply all of the search criteria to the same service.
Hosts that are running an HTTP service on port 8888:
Hosts running SSH on a non-standard port (i.e., not 22 or 2222):
Searching for Software
Censys presents software identification data using Common Platform Enumeration (CPE) v2.3. The Common Platform Enumeration format for software has several benefits, including standardization and interoperability with security applications and the built-in delineation of operating systems, hardware, and applications with the
Hosts that have a Windows OS:
Hosts that run any version of Microsoft IIS:
Hosts that run Microsoft IIS version 10.X:
You can also search the
uniform_resource_identifier field with a whole CPE-formatted string:
Search for hosts within a specified geographic area using location fields such as
Hosts in Japan: