Search 2.0 Search Language
Censys Search Language supports full-text searching across all fields, querying individual fields, boolean logic, and regular expressions. Censys Search Language is similar but not identical to Lucene’s and Elasticsearch’s search syntax.
Full Text Searches
Any time you make a search that doesn’t specify a specific field, Censys will search across all text-based fields. You can search for multiple-word phrases by adding double quotes.
Query for Hosts that contain the term “Hello World”:
Querying Individual Fields
Censys lets you search structured fields derived from application handshakes completed by our scanner. Fields reflect the nested structure of the schema using dot notation.
For example, you can find all devices that have an HTTP Server header that includes the word Apache with this search:
Important! The above search does not return results that have the exact value “Apache”. Rather, it will find hosts where the word Apache appears in the server header. For example, the value “Apache Server” would be returned.
If you want to search for an exact match, you can query the associated
.raw field, which will return results where the value is exactly Apache:
You can use * and ? to perform wildcard searches that match zero or more characters, or exactly one character, respectively. These are helpful for finding records where you know the start of a word, but not how it will end.
For example, the search above, (services.http.response.headers.server: Apache) will return hosts with the Server header “Apache” and “Apache Server”, but it will not return hosts with the Server header “Apache-Serve” since it matches on whitespace delimited words. You can search for all hosts with the field that starts with Apache with the following query:
Important! Censys does not support leading wildcard searches (e.g., “* Apache” because we’re unable to use any indices to complete this search. We know that many users want to use leading wildcards to search domain name fields. Don’t worry — when searching an FQDN field (e.g., the name on a certificate), the search “censys.io” will also include all subdomains of censys.io. You can use the associated
.raw field for the FQDN field to find records for only censys.io.
Censys allows the binary operators and, or, and not, as well as parentheses. For example:
You can search for set matches instead of constructing long or-based statements. For example, the above query can be also be expressed as:
Searching Networks, Services, and Software
Censys Search Language has several features specific to searching Internet networks, services and software.
Searching Specific Networks
You can search for IPs in a specific CIDR block:
You can search for IPs in a non-standard IP range as well:
Searching Across Services
Censys’ new data model accounts for the possibility that protocols can appear on any port, which makes searches for protocol data on a specific port tricky.
You can search for open ports by checking for the existence of a service on a given port. For example, the following search will find hosts with any service on port 443.
And the following search will find any hosts running HTTP on at least one port:
Important! You cannot simply combine these two predicates to find services running HTTP(S) on port 443. The following query will return hosts with any service on port 443 and HTTP on any port.
Searching In the Same Service
You can use the operator same_service() to force the engine to apply all of the search criteria to the same service.
Hosts that are running an HTTP service on port 8888:
Hosts running SSH on a non-standard port (i.e., not 22 or 2222):
Searching for Software
We present software identification data using Common Platform Enumeration (CPE) v2.3. The Common Platform Enumeration format for software has several benefits, including standardization and interoperability with security applications and the built-in delineation of operating systems, hardware, and applications with the `part` field.
Hosts that have a Windows OS:
Hosts that run any version of Microsoft IIS:
Hosts that run Microsoft IIS version 10.X:
You can also search the `uniform_resource_identifier` field with a whole CPE-formatted string:
Search for hosts within a specified geographic area using location fields such as `location.country_code`, `location.province`.
Hosts in Japan: