Search 2.0 Example Host Queries

The table below provides working queries you can use to learn the Censys Search Language for querying hosts.

The first column indicates the Censys Search Language feature being showcased, the second column provides a description of the query, and the third column presents the query syntax, which is linked to the results page on search.censys.io.

Search Feature	Query Description	Query
Field:Value pairs	Search for hosts with an HTTP service whose body contains the word "powershell.exe"	service.http.response.body: powershell.exe
Field:Value pairs, Exact Operator	Search for hosts with an SNMP service whose reported location is exactly this phrase: "Sitting on the Dock of the Bay"	service.snmp.oid_system.location="Sitting on the Dock of the Bay"
Boolean Logic	Search for hosts in the 23.20.0.0/14 range whose services contain either the phrase "Schneider Electric" or "Dell"	("Schneider Electric" or Dell) and ip: 23.20.0.0/14
Set Operator	Search for hosts that have any of the following ports open: 22, 23, 24, 25	services.port: {22, 23, 24, 25}
Boolean Logic	Search for hosts that do not have an HTTP service running	not services.service_name: HTTP
Wildcards	Search for hosts with any service presenting a certificate	services.certificate: *
Full Text Searches and Wildcards	Search for hosts whose parsed data contains the word "hello"	hello
Wildcards and Regular Expressions	Search for hosts presenting certificates with a name foo1, foo2, foo3...foo100 followed by any value	service.tls.certificates.leaf_data.names= /foo<1-100>.*/
Ranges	Search for hosts whose IP address falls within the specified range	ip: [1.12.0.0 to 1.15.255.255]
Same Service Operator	Search for hosts running the SSH protocol on ports other than 22 and 2222	same_service(services.service_name: SSH and not (service.port: {22, 2222}))
Same Service Operator	Search for hosts running Elasticsearch on port 443	same_service(service.service_name: ELASTICSEARCH and service.port: 443)
Multi-Perspective Scanning	Search for hosts with a service that was last observed by Censys Scanners within NTT ISP	service.perspective_id: "PERSPECTIVE_NTT"
Multi-Perspective Scanning	Search for hosts with services that were last observed by Censys Scanners within NTT and TELIA ISPs	service.perspective_id: "PERSPECTIVE_NTT" and service.perspective_id: "PERSPECTIVE_TELIA"
Searching Web Servers	Search for hosts with a page title on the HTTP service containing the word "dashboard"	service.http.response.html_title: dashboard
Searching Web Servers	Search for hosts that have an HTTP service that responded with a 500 status code	service.http.response.status_code: 500
Searching Web Servers	Search for hosts that have specific HTTP header value pairs	service.http.response.headers.connection: close and service.http.response.headers.content_type: text/plain
Searching TLS	Search for hosts that have an RDP service that is presenting a certificate	same_service(services.service_name: RDP and services.certificate: *)
Searching TLS	Search for hosts with a service using TLSv1.0 encryption	services.tls.version_selected=`TLSv1_0`
Searching TLS	Search for hosts presenting a certificate with the string "localhost" in the subject_dn	services.tls.certificates.leaf_data.subject_dn: localhost
Searching Software	Search for hosts running Microsoft IIS 7.5	same_service(services.software.vendor: Microsoft and services.software.product: IIS and services.software.version: 7.5)
Searching Software with CPE URIs	Search for hosts running Microsoft Exchange	service.software.uniform_resource_identifier: `cpe:2.3:a:microsoft:exchange_server::::::::`
Searching CPE Software, OS, Product, Manufacturer	Search for hosts with a service running OpenSSH version 7.6p1 software on Linux version 18.04.	same_service(services.software.uniform_resource_identifier: `cpe:2.3:o:canonical:ubuntu_linux:18.04:::::::` and services.software.uniform_resource_identifier: `cpe:2.3:a:openbsd:openssh:7.6:p1:::::::`)
Searching CPE Software, OS, Product, Manufacturer	Search for hosts running a Raspberry Pi product	service.software.product: "Raspberry Pi"
Searching Location	Search for hosts in Russia	location.country: Russia
Search Location	Search for hosts in the Bahamas, excluding Nassau	location.country_code: BS and not location.city: Nassau

Need more examples? Check out community resources like this!

Diàtaxis: reference

Other Articles In This Section

In this article:

Comments

Other Articles In This Section

In this article:

Search 2.0 Example Host Queries

Related articles