Search 2.0 Example Host Queries

The table below provides working queries you can use to learn the Censys Search Language for querying hosts.

The first column indicates the Censys Search Language feature being showcased, the second column provides a description of the query, and the third column presents the query syntax, which is linked to the results page on search.censys.io.

Search Feature	Query Description	Query
Searching Field:Value pairs	Search for the presence of powershell.exe within the HTTP body	service.http.response.body: powershell.exe
Searching Field:Value pairs	Search for the exact SNMP location value of "Sitting on the Dock of the Bay"	service.snmp.oid_system.location= "Sitting on the Dock of the Bay"
Boolean Logic	A search for the phrase "Schneider Electric" or Dell anywhere in IPs in the range 23.20.0.0/14	("Schneider Electric" OR Dell) AND ip: 23.20.0.0/14
Boolean Logic	A search for hosts that have any of the following ports open: 22, 23, 24, 25	service.port: {22, 23, 24, 25}
Boolean Logic	A search for hosts that do not have an HTTP service running	NOT service.service_name: HTTP
Wildcards and Regular Expressions	A search for hosts presenting any certificate. The * indicates the field is populated for the hosts	service.certificate: *
Wildcards and Regular Expressions	A regular expression search for the string hello succeeded by any value	/hello.*/
Wildcards and Regular Expressions	A search for hosts presenting certificates with a name foo1, foo2, foo3...foo100 succeeded by any value	service.tls.certificates.leaf_data.names= /foo<1-100>.*/
Ranges	A search for online hosts within the specified range	ip: [1.12.0.0 to 1.15.255.255]
Automatic Protocol Detection	A search for hosts running the SSH protocol on ports other than port 22 and 2222	same_service(services.service_name: "SSH" AND NOT (service.port: {22, 2222}))
Automatic Protocol Detection	A search for hosts running elasticsearch on port 443	same_service(service.service_name: "ELASTICSEARCH" AND service.port: 443)
Multi-Perspective Scanning	A search for hosts that were last scanned by Censys Scanners within NTT ISP	service.perspective_id: "PERSPECTIVE_NTT"
Multi-Perspective Scanning	A search for hosts that have services that were last scanned by Censys Scanners within NTT and TELIA ISPs	service.perspective_id: "PERSPECTIVE_NTT" AND service.perspective_id: "PERSPECTIVE_TELIA"
Searching Web Servers	A search for hosts with a page title on the HTTP service containing the word "dashboard"	service.http.response.html_title: dashboard
Searching Web Servers	A search for hosts that have an HTTP service that responded with a 500 status code	service.http.response.status_code: 500
Searching Web Servers	A search for hosts that have specific HTTP header value pairs	service.http.response.headers.connection: close AND service.http.response.headers.content_type: text/plain
Searching TLS	A search for hosts that have RDP running and that RDP service is presenting a certificate	same_service(service.service_name: RDP AND service.certificate: *)
Searching TLS	A search for hosts running SSLv3	service.tls.version_selected: SSLv3
Searching TLS	A search for hosts presenting a TLS certificate with the string "localhost" present in the subject_dn	services.tls.certificates.leaf_data.subject_dn: localhost
Searching CPE Software, OS, Product, Manufacturer	A search for hosts running Microsoft IIS 7.5	services.software.product: IIS AND services.software.vendor: Microsoft AND services.software.version: 7.5
Searching CPE Software, OS, Product, Manufacturer	A search for hosts running Microsoft Exchange	service.software.uniform_resource_identifier: `cpe:2.3:a:microsoft:exchange_server::::::::`
Searching CPE Software, OS, Product, Manufacturer	A search for hosts presenting a specific operating system and application hardware on the same service	same_service(service.software.uniform_resource_identifier: `cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::` AND service.software.uniform_resource_identifier: `cpe:2.3:a:openbsd:openssh:7.6p1:::::::`)
Searching CPE Software, OS, Product, Manufacturer	A search for hosts running a Raspberry Pi product	service.software.product: "Raspberry Pi"
Location Searches	A search for hosts in Russia	location.country: Russia
Location Searches	A search for hosts in the Bahamas, excluding Nassau	location.country_code: BS AND NOT location.city: Nassau

Diàtaxis: reference

Other Articles In This Section

In this article:

Comments

Other Articles In This Section

In this article:

Search 2.0 Example Host Queries

Related articles