Skip to main content

Ask the community

Find answers to all your Censys questions here

26 Topics
S
StepanKroupaNew Participant
asked in Search Q&A
Search API bug?

Hello, I am currently learning to use the /v2/hosts/search API endpoint with the optional "fields" parameter. I am successfully getting results but I am having issues specifically with the subfields under "services.http.response.headers", such as "services.http.response.headers.ETag", "services.http.response.headers.Server" and so on. I would expect these fields to work just like "services.port" or "services.service_name" and return a single value in the response, but they don't. If I specify any of these subfields, what I get in the response (as long as the particular service has any http headers) is a large list which seems to contain all values of the headers subfields, even subfields I didnt specify in the request. And the problem is its just a list of values (name of the field is "headers" for each value), so I dont know which value is the Server subfield, which value is the Content_Length subfield and so on (or if these subfields are present in the response at all), so this data

592
S
12 days ago
K
KatJuNew Participant
asked in Search Q&A
the field service.banner not supported?

Hello. ¿The field services.banner is not compatible with censys?. When using the API it is possible to use: Error during consultation: 422 (Entidad not procesable): unvalidated visit field 'services.banner'. campo no supportado

494
MattK_Censys
15 days ago
B
banned techNew Participant
asked in Search Q&A
bypass cloudflare

how to find real ip from cloudflare ip direct

480
B
22 days ago
Mark Thomasson
Mark ThomassonNew Participant
asked in Search Q&A
Integration of Censys with various Threat Intel Platforms

would like to know who might be in charge of technology partnerships so users can use Censys with their favorite  Threat Intel platform sadly Censys is not part of my favorite TIP - Open CTI - https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76 just sayin

1744
K
25 days ago
H
HappyNew Participant
asked in Search Q&A
API Usage

Hello.I created a censys account.It said that I can use the API for 60 days with a free account, but I can't use the API with a newly created account.Can someone help me?

592
H
1 month ago
S
SusmitaNew Participant
asked in ASM Q&A
Censys ASM scan time

What is the daily Censys scan time for ASM module of Censys?

452
MattK_Censys
1 month ago
john
johnFrequent Contributor
asked in Search Q&A
Censys Python API Scaling

Are there any recommended best practices for scaling the Censys Python API calls?I am interested in the CWMP protocol. The following query will return 10k of the 157k. If I ran this daily search to track that service, I would quickly burn through the allocated quota.query = h.search("services.service_name: CWMP", per_page=100, pages=100)Does the road map contain feasible bulk or stream API options for large data sets?

682
john
1 month ago
J
janeNew Participant
asked in Search Q&A
I need global domain name database

我需要全球域名数据库

210
J
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search Q&A
Cool Query of the Week for November 7, 2024: Find services likely running malware based on a suspicious certificate component

Howdy! This week I’m sharing a query that searches for hosts running services presenting a certificate with a particular string in the subject DN, in this case “AsyncRAT Server”, which could indicate that that host and service are running malware.services.tls.certificates.leaf_data.subject_dn=`AsyncRAT Server`This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

400
MattK_Censys
2 months ago
T
TalklessNew Participant
asked in Search Q&A
Couldn't download universal data with API

I have been set the right value for $CENSYS_API_ID and $CENSYS_API_SECRETHowever, the server sends me “error message” so I seek for help to download data with my api.curl -X "GET" "https://search.censys.io/api/v1/data/universal-internet-dataset-v2-ipv4" -H "Accept: application/json" --user "$CENSYS_API_ID:$CENSYS_API_SECRET"{"status": "error", "error": "This server could not verify that you are authorized to access the document you requested.  Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.", "error_type": "unknown"}

552
T
2 months ago
john
johnFrequent Contributor
asked in Search Q&A
IPv6 Coverage

What scanning strategy does Censys use to provide coverage over the IPv6 address space?

1134
john
2 months ago
G
GiriNew Member
asked in ASM Q&A
Doesn't find Integrations

I didn’t find a Integrations part. Kindly help me to find out

311
MattK_Censys
3 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search Q&A
Cool Query of the Week for October 2, 2024: Find exposed telnet services with a word like username in the banner

Hey all, back with CQOTW after some time off! Here is a fairly straightforward one that uses our service fields to find potentially exposed telnet services:(services=telnet) and services.banner:`username`You could make this more targeted using something like an IP address, IP range, ASN, and so on:(services=telnet) and services.banner:`username` and ip=[insert IP/range here] This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

220
MattK_Censys
3 months ago
J
Joao SoaresNew Participant
asked in ASM Q&A
Find assets that were discovered through certificates

Has anyone found a way to filter, using queries or API, for assets that were found through Certificates?The only point I see in common is the source as “Censys Scan” but I need to narrow it down further.

252
J
4 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in Search Q&A
Can I specify a historical date for my search?

We often hear this question from search users, and the response is at the moment you cannot.Searches run in the web UI and API are always for hosts and virtual hosts as they are currently known.However, on any host page, you can select Host History to see a chronology of events and go back to a historical view, but searches using history are not supported. 

551
L
4 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in ASM Q&A
How to obtain total ASM asset numbers and new ASM assets using the API

This is a question we’ve received from a few customers and I wanted to share the info here for folks to use.Total number of assets (can be broken down by type by adding query=type%3AHOST, for example):curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=%2A&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"Total number of new assets (can be broken down by asset type as described above, edit the association_date as needed:curl -X GET "https://app.in.corp.censys.io/api/inventory/v1?workspaces=<INSERT WORKSPACE_ID>&query=association_date%3A%20%5Bnow-24h%20TO%20now%5D&pageSize=100&fields=type" -H "accept: application/json" -H "Censys-Api-Key: <INSERT ASM_API_KEY>"

270
MattK_Censys
4 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search Q&A
Cool Query of the Week for August 14, 2024: HTTP sites with an executable file listed in their index file

This week I’m highlighting a query that you can use to find sites that have an executable file in their index. Hosts that are returned by this query could be worth further investigating to determine whether they are being used for malicious purposes. This query uses regex to include a number of different file extensions but you can use a simpler, regex-free version of it with wildcards or specific executable file names. services: (http.response.html_title:"index of" and http.response.body=/.*\.(js|exe|app|vb|scr).*/) If you have identified a specific executable file of interest (for example, nc.exe), you could use that for the value for the services.http.response.body field, as Matthew from Embee Research did in his excellent guide to tracking malware with Censys. This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s

1322
MattK_Censys
5 months ago
J
jowestNew Participant
asked in Search Q&A
List of towns in a county?

Hi,Is there perhaps a list of towns to check in a specific country, if there is where can I find it.Please let me know.Thanks!

764
J
5 months ago
D
DavidSH_CensysCensys Team
asked in ASM Q&A
Which Qualys APIs are used to Add and Remove IPs from Qualys VMDR?

Censys’s integration with Qualys VMDR Automatically add new hosts to your Qualys VMDR environment for vulnerability scans. With this connection, you can view and add Censys-discovered unknown hosts to Qualys asset groups.Below are sample API calls and links back to the Qualys API docs that are used in the integration. Please note that the calls differ based on Qualys User Permissions:If the user is a Unit Manager, the call to add IP to a subscription must include ag_title (Asset group title) and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in one request. If the user is a Manager, the call to add IP to a subscription does not include ag_title, and the actions of “Add IP to subscription” and “Add IP to asset group” will happen in two requests.For all requests use header Accept: application/xmlUnit Manager:Add IP to subscription and asset group:https://<USERNAME>:<PASSWORD>@qualysapi.qg2.apps.qualys.com/api/2.0/fo/asset/ip/?action=add&ag

470
D
5 months ago
Z
ZebazNew Participant
asked in Search Q&A
Searching services within history of large number of hosts

I have a use case where I want to search for historical activity of services on a large number of hosts (200k+)Currently this is my approach (using the API):Search for hosts For each host: get changed events within a time period For each changed event: check if the event potentially matches the service criteria (e.g. port or protocol) For each of these candidate events: get host details at the candidate event timestamp Extract service details from response This works, but is quite involved and consumes a lot of API credits.Did anyone find a better way  to query the service history of multiple hosts?Thanks!

1292
Z
5 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in Search Q&A
How can I find hosts in a specific country running a specific software?

This is another series of posts I’ll be making that cover basic use-cases and building blocks for Censys Search--this one is called “How can I...” We’ll start out with “How can I find hosts in a specific country running a specific software?“ Here’s an example query that returns hosts in Russia detected running gSOAP: location.country=Russia and services.software.product: gSOAP This query uses the location.country field to set a geographic boundary and the services.software.product field to identify the software in focus. Another potential starting point for this would be to start with simply the location.country=Russia query and then run a report on those results that uses services.software.product as the breakdown field. This will provide you with a window into the types of software products that have been detected on hosts in Russia, allowing you to identify software of interest and perform follow-up queries.

440
MattK_Censys
5 months ago
R
rudraNew Participant
asked in Search Q&A
XSS related question

I have been searching for XSS and other vulnerability on multiple platforms and I have found that most of them filter it. However, in login forms, if I include “<” or “>” [without quotes], the text in between was not shown in the error message. Here is what I typed in the username: Admin <script>alert('xss')</script> HelloHere is what the error message shown: Error: The username Admin Hello is not registered on this site. If you are unsure of your username, try your email address instead.I think that this is due to the input sanitizer, or it might be something else that idk.Has anyone encountered such situation before?

731
B
6 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in ASM Q&A
How can I be alerted when risky assets are detected in my attack surface?

An easy way to accomplish this is using our new Saved Query Automation functionality in tandem with a saved query. For example, you could save the following query and use Saved Query Automation to receive an alert whenever assets are added that have critical risks or are removed:risks.severity="critical"This could just function as a starting point, however, and you might decided you want to target your query a bit. To make this more targeted, you could use the following query:tags: "critical-infrastructure" and risks.severity = *This would only return assets that you have applied the “critical-infrastructure” tag to and that have any risk associated with them. You could limit the severity to critical or high to narrow it further.

150
MattK_Censys
6 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in ASM Q&A
How can I connect my cloud service providers to Censys ASM to monitor those assets?

Censys ASM has built-in integrations with AWS, GCP, and Azure called Cloud Connectors. Each of these integrations can be set up in under 15 minutes using our in-app self-service wizard. Once you connect these CSPs with ASM, their attendant assets will be updated very frequently--in some cases, every 4 hours. A walkthrough of the setup process for our AWS Cloud Connector is available in our Censys Academy online courses.

90
MattK_Censys
6 months ago
MattK_Censys
MattK_CensysCensys Community Manager
asked in ASM Q&A
What's the best way to maintain an accurate, up-to-date attack surface in Censys ASM?

Censys Attack Surface Management offers several ways to keep your monitored attack surface up-to-date. ASM users can input attack surface seed information like domains and CIDR blocks manually, utilize our programmatic seed discovery process, and connect their cloud services with ASM.The short answer to this question is to use all of the features available to you in ASM to maintain an accurate, up-to-date attack surface. Cloud Connectors and Censys seed discovery are particularly important to this end.ASM Enterprise customers can utilize automatic seed refresh in tandem with our programmatic seed discovery process. This daily search enables security teams to proactively manage changes from day-to-day adjustments in their digital footprint as well as more substantial moves like mergers and acquisitions.More info about how to seed your attack surface is available in our Knowledge Base and in our online courses on the Censys Academy.

150
MattK_Censys
6 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us