Skip to main content

Censys Platform use cases, findings, and queries

Share useful Censys Platform queries, interesting things you've found, and more.

  • 5 Topics
  • 0 Replies
5 Topics
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week June 12, 2025: Certificates with a specific name that expire in the next month

Hello again! In this week’s Cool Query of the Week, I’m highlighting a way to search for certificates containing a specific name that expire in the next month. Swap out the example domain for your domain of interest and set up a collection to get alerts when new certificates are added to this query’s results.cert.parsed.subject.common_name: "example.com" and cert.parsed.validity_period.not_after >= "now" and cert.parsed.validity_period.not_after < "now+1M"

310
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
asked in Censys Platform use cases, findings, and queries
Cool Query of the Week May 29, 2025: Hosts with open directories with executable files

Hello again! In this iteration of Cool Query of the Week, we’ve got a query for hosts labeled as open directories that contain executable files in their endpoints’ HTTP bodies. Narrow this down with other executable file extensions, geographic ranges, or whatever else is important to you.host.services.endpoints.http.body: {".exe", ".hta"} and host.services.labels.value: OPEN_DIRECTORYAs a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

1930
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 22, 2025: Possible impersonations of Facebook login pages

Hello again! In this iteration of Cool Query of the Week, we’ve got a query that can find web properties that may be attempting to impersonate Facebook login pages. This is accomplished by looking for the phrase “Facebook - log in or sign up” in HTML titles on web properties that are not accompanied by a legit facebook favicon.web.endpoints.http.html_title: "Facebook - log in or sign up" and not web.endpoints.http.favicons.hash_sha256: {88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7, 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80}As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

350
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 15, 2025: Searching cert names for subdomains

Hello again! In this iteration of Cool Query of the Week, I highlight how to search for certificates that contain an eTLD+3 or greater subdomain of a given domain. In this example, I’m targeting example.com, which you should swap out for your domain-of-interest.This query also uses regular expression (regex). In the Platform, as with Legacy Search, regex in queries is only available to paying customers. However, anyone can get access to regex on the Platform by buying Censys Credits.cert.names=~`.*\..*\.example\.com$`Learn more about regex in Censys Query Language in the docs.As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

510
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 9, 2025: Web properties with sensitive exposed paths

Hey all! I’m bringing back our Cool Query of the Week series with a focus on writing queries in the new Censys Query Language for use on the Platform. You can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.This week I’m starting off with a query that highlights some of the web assets you can find by searching across web property endpoints.This query returns web properties with potentially sensitive exposed paths. You can combine this with other criteria like your organization’s name or known web assets to narrow its focus.web.endpoints: (path= {"/config", "/logs", "/uploads", "/backups"} and http.status_code: 200)Learn more about web properties in the docs.

910
MattK_Censys

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us