Censys Community | Censys Community

Recent activity
Help others
Categories

MattK_CensysCensys Community Manager

Learn how to discover OT and IOT devices in our new ebook

Our team just released a fresh ebook - Unleash the Power of Censys Search: A Hassle-Free Handbook for Cyber Heroes.There’s a lot of great content in here but one of the things I find most helpful was the example covering how to discover operational technology (OT) and internet of things (IOT) assets in Search.You can start by inputting protocols and names/manufacturers of interest in plaintext. The example in the ebook starts with:BACnet and siemensWhich you could then combine with a key-value pair like a service port:BACNet and siemens and services.port= 80 Which can return potential HMIs accessible by the outside world. Find more info about this example as well as other great queries in the ebook!

8 hours ago

MattK_CensysCensys Community Manager

Search findings, use cases, and queries

Cool Query of the Week for October 16, 2024: Tracking recently-added certificates on spoofed domains

Howdy! This week I’m sharing a query that targets certificates. Use this to find certs that were added to the Censys dataset within the past week that are being used on spoofed domains that could indicate suspicious behavior. Combine this with known malicious domains to stay ahead of potential risks.In this example, I used dnstwister to find suspect domains that might be impersonating censys.com. You could use regex instead to match patterns.(densys.com or xensys.com or ce.nsys.com) and added_at:[now-1w to now]This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

1 day ago

GiriNew Member

ASM Q&A

Doesn't find Integrations

I didn’t find a Integrations part. Kindly help me to find out

2 days ago

MattK_CensysCensys Community Manager

Censys Release Notes for October 14, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Censys ASMAdded a “Resources” dropdown menu to the top navigation bar in the ASM web interface. Some links, like API Documentation and Censys Academy, were moved from the user profile menu to the Resources menu. The Resources menu now features a link to the Censys Community. Added an “accepted” status to risks that are sent to Splunk via our integration. This enables you to filter out risks that have been accepted, as well as track exclusions in one place instead of two. Additionally, default dashboards and searches have been updated to include web entity risks. Fixed an issue that allowed users with the Member role to access Integrations in the ASM web interface. Now, only users with the Manager role can see Integrations.New FingerprintsAdded the following fingerprints: Type Name Description Query software Mana Ouma Botnet This is

120

3 days ago

AidanH_CensysCensys Team

Threat hunting

Join Censys and Greynoise for an in-person threat hunting workshop in Washington, DC!

Hey everyone! On October 29, 2024 we are holding an in-person threat hunting workshop in Washington, D.C. I want to extend an invite to the folks here in the Censys Community. The workshop will provide an opportunity to learn from industry experts and other Censys users through hands-on exercises and discussions, offering insights and strategies to get the most from your security technology. I will be leading the workshop alongside Andrew Morris from Greynoise. We will cover… Malicious Infrastructure Discovery and Fingerprinting Deceptive Services/Honeypot Detection If you work in the threat intel and response world, are a security engineer, or are more broadly in the cybersecurity analyst industry, this workshop will be perfect for you.You can request an invite to the event here. Hope to see you there!

6 days ago

HimajaM_CensysCensys Team

Other security topics

New: Censys Internet of Healthcare Things (IoHT) Research

Hi folks, We just published a report examining the most commonly exposed types of assets belonging to the Internet of Healthcare Things (IoHT) 🏥 in Censys data.Ransomware and data breaches in healthcare continue to rise, and effective exposure management in this sector is more critical than ever. Healthcare organizations often have sprawling, decentralized infrastructure and under-resourced IT departments, which create significant challenges.We examined the global external attack surface of publicly accessible medical devices and IoHT applications and found legacy protocols, unauthenticated medical image databases, and data platforms with histories of exploited vulnerabilities.You can read the full report here: https://censys.com/state-of-internet-of-healthcare-things/

6 days ago

MattK_CensysCensys Community Manager

Search findings, use cases, and queries

Cool Query of the Week for October 10, 2024: Using the new suspicious open directory label

Hey hey folks, this week I’ve got a query that leverages our new suspicious open directory label. While simply running labels: suspicious-open-dir can be a good starting point in general, combining it with other information of interest can get you really moving in an investigation. Try the following with hosts:labels: suspicious-open-dir and services.http.response.body: "cve"This will return hosts with the suspicious open directory label and “cve” in the service response body. Sub a different indicator of interest in there and take it away!This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

7 days ago

MattK_CensysCensys Community Manager

Censys Release Notes for October 7, 2024

The following enhancements and improvements are now available to Censys ASM and Search customers.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities:14 Bugs in DrayTek Vigor Routers Disclosed: Admin Interfaces Widely Exposed Across Major ISPs [CVE-2024-41592] Censys Search query: services: (http.response.status_code=200 and http.request.uri:"/weblogin.htm" and (http.response.html_title:"Vigor" or http.response.favicons.md5_hash="208b1c5af9e2cc7d46e3ec5bf4d12001"))= Censys ASM query: host.services: (http.response.status_code=200 and http.request.uri:"/weblogin.htm" and (http.response.html_title:"Vigor" or http.response.favicons.md5_hash="208b1c5af9e2cc7d46e3ec5bf4d12001")) or web_entity.instances: (http.response.status_code=200 and http.request.uri:"/weblogin.htm" and (http.response.html_title:"Vigor" or http.response.favicons.md5_hash="208b1c5af9e2cc7d46e3ec5bf4d12001")) Censys ASM risk query: risks.name="E

180

10 days ago

FawnaT_CensysCensys Team

ASM use cases and queries

CQOTW Script Edition : Pulling Domains/Subdomains in ASM

Hello!Coming at you today with a script that you can use that leverages Censys Python to grab all of your domains/subdomains from your ASM platform into a cvs file. Huge s/o to @DanielW_Censys for creating and sharing! import requestsimport jsonimport csvurl = "https://app.censys.io/api/v1/assets/subdomains"headers = { "accept": "application/json", "Censys-Api-Key": "<API KEY HERE>"}# Initialize an empty list to store all the resultsall_results = []page_number = 1total_pages = 1000 # You can update this based on the total number of pages you havewhile page_number <= total_pages: params = {"pageNumber": page_number, "pageSize": 500} response = requests.get(url, headers=headers, params=params) data = response.json() # Check if the response contains the expected key for subdomain data if "subdomains" in data: all_results.extend(data["subdomains"]) else: print("Error: Subdomain data not found in response.") print("Response JSON:", data

13 days ago

T3chn3New Member

Search findings, use cases, and queries

Open for Business: How Open Directories Expose Bulletproof Hosting Operations

Hi everyone,I just published a new blog post, and I'd love for the Censys community to check it out! In my research, I dive into how open directories can reveal the inner workings of bulletproof hosting operations. If you're interested in cybersecurity and the risks associated with exposed open directories, I think you'll find it insightful.You can read it here: Open for Business: How Open Directories Expose Bulletproof Hosting Operations.Looking forward to your thoughts and feedback!

13 days ago

GiriNew Member

ASM Q&A

Doesn't find Integrations

I didn’t find a Integrations part. Kindly help me to find out

2 days ago

MrTiTiNew Participant

Threat hunting

Ogre Routing - Hunting for Nodes of Ogre Nodes

Hello! We are trying to map IPs in our address space to OGRE router nodes and TOR nodes. Do you know of any way to investigate this through Censys or do you know of any sources of information related to this?Here are some links on the subject of Ogre Routing, with some similarities to TOR Routing:-https://github.com/NthMetal/ogre-router/blob/master/README.md-https://github.com/NthMetal/ogre-router-server Thanks!

1 month ago

MattK_CensysCensys Community Manager

Search Q&A

Can I specify a historical date for my search?

We often hear this question from search users, and the response is at the moment you cannot.Searches run in the web UI and API are always for hosts and virtual hosts as they are currently known.However, on any host page, you can select Host History to see a chronology of events and go back to a historical view, but searches using history are not supported.

1 month ago

MattK_CensysCensys Community Manager

ASM Q&A

How to obtain total ASM asset numbers and new ASM assets using the API

This is a question we’ve received from a few customers and I wanted to share the info here for folks to use.Total number of assets (can be broken down by type by adding query=type%3AHOST, for example):curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=%2A&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"Total number of new assets (can be broken down by asset type as described above, edit the association_date as needed:curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=association_date%3A%20%5Bnow-24h%20TO%20now%5D&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"

1 month ago

jowestNew Participant

Search Q&A

List of towns in a county?

Hi,Is there perhaps a list of towns to check in a specific country, if there is where can I find it.Please let me know.Thanks!

2 months ago

DavidSH_CensysCensys Team

ASM Q&A

Which Qualys APIs are used to Add and Remove IPs from Qualys VMDR?

Censys’s integration with Qualys VMDR Automatically add new hosts to your Qualys VMDR environment for vulnerability scans. With this connection, you can view and add Censys-discovered unknown hosts to Qualys asset groups.Below are sample API calls and links back to the Qualys API docs that are used in the integration. Please note that the calls differ based on Qualys User Permissions:If the user is a Unit Manager, the call to add IP to a subscription must include ag_title (Asset group title) and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in one request. If the user is a Manager, the call to add IP to a subscription does not include ag_title, and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in two requests.For all requests use header Accept: application/xmlUnit Manager:Add IP to subscription and asset group:https://<USERNAME>:<PASSWORD>@qualysapi.qg2.apps.qualys.com/api/2.0/fo/asset/ip/?action=add&ag

2 months ago

ZebazNew Participant

Search Q&A

Searching services within history of large number of hosts

I have a use case where I want to search for historical activity of services on a large number of hosts (200k+)Currently this is my approach (using the API):Search for hosts For each host: get changed events within a time period For each changed event: check if the event potentially matches the service criteria (e.g. port or protocol) For each of these candidate events: get host details at the candidate event timestamp Extract service details from response This works, but is quite involved and consumes a lot of API credits.Did anyone find a better way to query the service history of multiple hosts?Thanks!

2 months ago

Mark ThomassonNew Participant

Search Q&A

Integration of Censys with various Threat Intel Platforms

would like to know who might be in charge of technology partnerships so users can use Censys with their favorite Threat Intel platform sadly Censys is not part of my favorite TIP - Open CTI - https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76 just sayin

2 months ago

MattK_CensysCensys Community Manager

Search Q&A

How can I find hosts in a specific country running a specific software?

This is another series of posts I’ll be making that cover basic use-cases and building blocks for Censys Search--this one is called “How can I...” We’ll start out with “How can I find hosts in a specific country running a specific software?“ Here’s an example query that returns hosts in Russia detected running gSOAP: location.country=Russia and services.software.product: gSOAP This query uses the location.country field to set a geographic boundary and the services.software.product field to identify the software in focus. Another potential starting point for this would be to start with simply the location.country=Russia query and then run a report on those results that uses services.software.product as the breakdown field. This will provide you with a window into the types of software products that have been detected on hosts in Russia, allowing you to identify software of interest and perform follow-up queries.

2 months ago

rudraNew Participant

Search Q&A

XSS related question

I have been searching for XSS and other vulnerability on multiple platforms and I have found that most of them filter it. However, in login forms, if I include “<” or “>” [without quotes], the text in between was not shown in the error message. Here is what I typed in the username: Admin <script>alert('xss')</script> HelloHere is what the error message shown: Error: The username Admin Hello is not registered on this site. If you are unsure of your username, try your email address instead.I think that this is due to the input sanitizer, or it might be something else that idk.Has anyone encountered such situation before?

3 months ago

Welcome

Everything you need to know about the Censys Community

Getting started in the Community

5 topics
0 Replies

Announcements

3 topics
0 Replies

Introductions

6 topics
4 Replies

General security topics

Talk about general security topics, using Censys and other tools to discover and investigate potential threats, and more

Security news

3 topics
3 Replies

Threat hunting

8 topics
7 Replies

Censys Rapid Response

6 topics
0 Replies

Ask the community

Find answers to all your Censys questions here

Search Q&A

9 topics
13 Replies

ASM Q&A

7 topics
3 Replies

Use-cases, queries, and findings

Share your use-cases, queries, and unique findings with Search or ASM

Search findings, use cases, and queries

20 topics
4 Replies

ASM use cases and queries

2 topics
0 Replies

Welcome to the Censys Community!

Community Forum

Knowledge Base

Censys Academy

Product Updates

Events

Groups

Featured topics

The latest & greatest from the community

Welcome

Getting started in the Community

Announcements

Introductions

General security topics

Security news

Threat hunting

Censys Rapid Response

Other security topics

Ask the community

Search Q&A

ASM Q&A

Use-cases, queries, and findings

Search findings, use cases, and queries

ASM use cases and queries

Events Calendar

Welcome to the Censys Community!

Featured topics

The latest & greatest from the community

Events Calendar

Sign up

Log in to the Censys Community

Scanning file for viruses.

This file cannot be downloaded