Skip to main content

Recently active topics

10
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for June 16, 2025

Four new fingerprints and two Rapid Response bulletins.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Wazuh RCE Vulnerability Exploited to Deploy Mirai Botnets Use the following queries to identify exposed Wazuh servers, but they are not necessarily vulnerable to the exploit. Platform query Legacy Search query ASM query ASM risk query This query can be used to find instances of Wazuh server that are vulnerable to the exploit. Roundcube Webmail Vulnerable to Authenticated RCE [CVE-2025-49113] Use the following queries to find Roundcube Webmail instances. Not all of these are necessarily vulnerable to the exploit described in the bulletin. Platform query Legacy Search query ASM query ASM risk query This query can be used to find instances of Roundcube Webmail that are vulnerable to the exploit. New fingerprintsAdded the following fingerprints.Type Name Description Query

30
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week June 12, 2025: Certificates with a specific name that expire in the next month

Hello again! In this week’s Cool Query of the Week, I’m highlighting a way to search for certificates containing a specific name that expire in the next month. Swap out the example domain for your domain of interest and set up a collection to get alerts when new certificates are added to this query’s results.cert.parsed.subject.common_name: "example.com" and cert.parsed.validity_period.not_after >= "now" and cert.parsed.validity_period.not_after < "now+1M"

80
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for June 10, 2025

Platform Query Assistant beta for all users, Platform Threat Hunting module release, general availability for the Platform, two Rapid Response bulletins, several new risk fingerprints, and one new software fingerprint.PlatformQuickly generate valid search Censys Query Language (CenQL) queries using natural language input with the new Query Assistant tool in the Platform web UI. Query Assistant is a beta feature available to all Platform users. Use the Platform Threat Hunting module to detect, analyze, and track threat infrastructure with speed and precision. The module enables you to explore the threat dataset with structured tools, historical context, and workflows. These capabilities help users validate threats in real time and uncover hidden clusters of malicious assets. The Threat Hunting module includes the following: The Platform threat dataset that maps malware, threat actors, and tactics to services or endpoints running on exposed hosts and web properties. Interactive Explore

210
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for June 2, 2025

The following enhancements and improvements are now available to Censys users.PlatformAdded the ability to filter by owner, filter by category, search by name or ID, and sort by creation date, last updated date, or name on the Collections page in the Platform web UI.   Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Ivanti EPMM Chained Exploits Added to CISA KEV [CVE-2025-4427-4428] Use the following queries to find exposed Ivanti EPMM instances. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query ASM risk query Samsung MagicInfo9 Path Traversal Vulnerability Added to CISA KEV [CVE-2025-4632] Use the following queries to find exposed MagicInfo9 instances. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query N

230
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week May 29, 2025: Hosts with open directories with executable files

Hello again! In this iteration of Cool Query of the Week, we’ve got a query for hosts labeled as open directories that contain executable files in their endpoints’ HTTP bodies. Narrow this down with other executable file extensions, geographic ranges, or whatever else is important to you.host.services.endpoints.http.body: {".exe", ".hta"} and host.services.labels.value: OPEN_DIRECTORYAs a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

1690
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 27, 2025

The following enhancements and improvements are now available to Censys users.PlatformAdded dark mode to the Platform web UI. To switch between light and dark mode, click your profile icon and use the Light Mode / Dark Mode toggle.   Use the new Certificate Transparency (CT) logs page in the Platform web UI to see the logs Censys monitors as well as additional certificate metadata.   This page always reflects the current state of Censys CT log monitoring. Navigate to the page via the Help menu in the top-right corner of the Platform web console. ASMAdded the ability to filter the Ports & Protocols dashboard to a specific port range.   Added a filter option for unknown protocols to the Ports & Protocols dashboard.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Synacor Zimbra Collaboration Suite XSS Vulnerability Added to CISA KEV [CVE-2024-27443] Use the following queries to find Zimbra Collabo

310
MattK_Censys
S
sudoFTPNew Participant
 Search findings, use cases, and queries
/hosts/{ip} returns data, but /hosts/search/ endpoint doesn't return anything for the same IP

​​​​​​Query https://search.censys.io/api/v2/hosts/91[.]129[.]106[.]3 returns the following:{    "code": 200,    "status": "OK",    "result": {        "ip": "91[.]129[.]106[.]3",        "services": [],        "location": {            "continent": "Europe",            "country": "Estonia",            "country_code": "EE",            "city": "Tallinn",            "postal_code": "10111",            "timezone": "Europe/Tallinn",            "province": "Harjumaa",            "coordinates": {                "latitude": 59.43696,                "longitude": 24.75353            }        },        "location_updated_at": "2025-04-24T11:09:49.829533682Z",        "autonomous_system": {            "asn": 1257,            "description": "TELE2",            "bgp_prefix": "91.129.96.0/19",            "name": "TELE2",            "country_code": "EU"        },        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",        "whois": {            "network": {                "handle": "EE-TE

1678
J
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week May 22, 2025: Possible impersonations of Facebook login pages

Hello again! In this iteration of Cool Query of the Week, we’ve got a query that can find web properties that may be attempting to impersonate Facebook login pages. This is accomplished by looking for the phrase “Facebook - log in or sign up” in HTML titles on web properties that are not accompanied by a legit facebook favicon.web.endpoints.http.html_title: "Facebook - log in or sign up" and not web.endpoints.http.favicons.hash_sha256: {88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7, 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80}As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

230
MattK_Censys
E
executifsNew Participant
 Search Q&A
302 when using the Python API

Hello!I hadn’t touched my code for a week or two, and running it again I found that it didn’t work anymore. I went back to almost one of the examples from the official repository:from censys.search import CensysHostsif __name__ == "__main__": api_id = "XXX" api_secret = "YYY" h = CensysHosts(api_id, api_secret) query = h.search("services.service_name: FTP", per_page=1, pages=2) all_hosts = query.view_all() print(all_hosts)And I’m still encountering an exception:Traceback (most recent call last): File "[...]\debug.py", line 10, in <module> all_hosts = query.view_all() ^^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 208, in view_all for hit in self.__call__(): ^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 168, in __call__ self.total = result["total"] ~~~~~~^^^^^^^^^TypeError: string indices must be integers, not 'str'While debugging, I

403
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 19, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Stack-Based Buffer Overflow Vulnerability Affecting Multiple Fortinet Products [CVE-2025-32756] Use the following queries to find Fortinet products. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints.  Type Name Description Query software Fortinet FortiVoice Application This is a Fortinet FortiVoice Application. Platform queryLegacy Search query software Fortinet FortiNDR This is a Fortinet FortiNDR Server. Platform queryLegacy Search query software Fortinet FortiCamera This is a Fortinet FortiCamera device. Platform q

260
MattK_Censys

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us