Search 2.0 Example Host Queries

The table below provides working queries you can use to learn the Censys Search Language for querying hosts.

The first column indicates the Censys Search Language feature being showcased, the second column provides a description of the query, and the third column presents the query syntax, which is linked to the results page on search.censys.io.

Search Feature	Query Description	Query
Field:Value pairs	Search for hosts with an HTTP service whose HTML title indicates it is exposing a directory	services.http.response.html_title: "Index of /"
Exact Match Operator	Search for hosts with an HTTP service whose hashed body content indicates that it is a Brute Ratel C4 server	services.http.response.body_hash="sha1:1a279f5df4103743b823ec2a6a08436fdf63fe30"
Boolean Logic	Search for hosts in the 23.20.0.0/14 range with any reference to either the phrase "Schneider Electric" or "Dell"	("Schneider Electric" or Dell) and ip: 23.20.0.0/14
Set Operator	Search for hosts that have any of the following ports open: 22, 23, 24, 25	services.port: {22, 23, 24, 25}
Boolean Logic	Search for hosts that have no HTTP services	not services.service_name: HTTP
Boolean Logic	Search for hosts that have at least one non-HTTP service	same_service(not services.service_name: HTTP)
Wildcards	Search for hosts with at least one service presenting a certificate during a TLS handshake	services.certificate: *
Full Text Search	Search for hosts whose parsed data contains the word "hello"	hello
Regular Expressions (Paid users only)	Search for hosts presenting certificates with a name foo1, foo2, foo3...foo100 followed by any value	service.tls.certificates.leaf_data.names= /foo<1-100>.*/
Ranges	Search for hosts whose IP address falls within the specified range	ip: [1.12.0.0 to 1.15.255.255]
Same Service Operator	Search for hosts running the SSH protocol on ports other than 22 and 2222	same_service(service_name: SSH and not (port: {22, 2222}))
Same Service Operator	Search for hosts running Elasticsearch on port 443	same_service(service.service_name: ELASTICSEARCH and service.port: 443)
Same Service Operator	Search for hosts with a an HTTP service with an open directory list and suspicious file names in their contents	same_service((services.http.response.html_title:"Index of /" or services.http.response.html_title:"Directory Listing for /") and services.http.response.body: /.?(metasploit\|cobaltstrike\|sliver\|covenant\|brc4\|brute-ratel\|commander-runme\|bruteratel\|ps2exe\|(badger\|shellcode\|sc\|beacon\|artifact\|payload\|teamviewer\|anydesk\|mimikatz\|cs)\.(exe\|ps1\|vbs\|bin\|nupkg))./ )
Multi-Perspective Scanning	Search for hosts with services that were last observed by Censys Scanners within NTT and TELIA ISPs	service.perspective_id: "PERSPECTIVE_NTT" and service.perspective_id: "PERSPECTIVE_TELIA"
Searching Web Servers	Search for hosts with a page title on the HTTP service containing the word "dashboard"	services.http.response.html_title: dashboard
Searching Web Servers	Search for hosts that have an HTTP service that responded with a 500 status code	services.http.response.status_code: 500
Searching Web Servers	Search for hosts that have specific HTTP header value pairs	services.http.response.headers.connection: close and services.http.response.headers.content_type: text/plain
Searching TLS	Search for hosts that have an RDP service that is presenting a certificate	same_service(services.service_name: RDP and services.certificate: *)
Searching TLS	Search for hosts with a service using TLSv1.0 encryption	services.tls.version_selected=`TLSv1_0`
Searching TLS	Search for hosts presenting a certificate with the string "localhost" in the subject_dn	services.tls.certificates.leaf_data.subject_dn: localhost
Searching Software	Search for hosts running Microsoft IIS 7.5	same_service(services.software.vendor: Microsoft and services.software.product: IIS and services.software.version: 7.5)
Searching Software with CPE URIs	Search for hosts running Microsoft Exchange	service.software.uniform_resource_identifier: `cpe:2.3:a:microsoft:exchange_server::::::::`
Searching CPE Software, OS, Product, Manufacturer	Search for hosts with a service running OpenSSH version 7.6p1 software on Linux version 18.04.	same_service(services.software.uniform_resource_identifier: `cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::` and services.software.uniform_resource_identifier: `cpe:2.3:a:openbsd:openssh:7.6:p1:::::::`)
Searching CPE Software, OS, Product, Manufacturer	Search for hosts running a Raspberry Pi product	services.software.product: "Raspberry Pi"
Searching Location	Search for hosts in Russia	location.country: Russia
Search Location	Search for hosts in the Bahamas, excluding Nassau	location.country_code: BS and not location.city: Nassau

Some of these examples were gathered from community resources like this!

Diàtaxis: reference

Other Articles In This Section

In this article:

Comments

Other Articles In This Section

In this article:

Search 2.0 Example Host Queries

Related articles