Skip to main content

Censys Platform use cases, findings, and queries

Share useful Censys Platform queries, interesting things you've found, and more.

  • 10 Topics
  • 4 Replies
10 Topics
MattK_Censys
MattK_CensysCensys Community Manager
published in Censys Platform use cases, findings, and queries
Video: See what attackers see with web screenshots on the Censys Platform
Video: See what attackers see with web screenshots on the Censys Platform

Security teams rely on the Censys Platform for unparalleled internet visibility, scanning coverage, and contextual data. With web screenshots, available to all Censys Platform Enterprise customers, they can see what exposed web services actually look like, from exposed control systems to unauthorized remote desktop portals.Screenshots for industrial control system (ICS) and remote desktop sharing and control services are captured every time they are hit by a regular Censys scan. Note that ICS services are only visible to organizations with access to ICS protocols.Screenshots are captured for HTTP and HTTPS services whenever they are targeted by Live Rescan or Live Discovery. Screenshots obtained from on-demand scans are visible to all users on Enterprise plans.Screenshots are displayed on host service cards and web property endpoint cards.Recurring screenshots are captured for the following protocols and services during regular Censys scans. New screenshots for them are also obtained w

20
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
published in Censys Platform use cases, findings, and queries
Explore open directory data in the Censys Platform
Explore open directory data in the Censys Platform

The internet's open directories are often overlooked, yet they frequently serve as unsecured staging grounds for adversaries, exposing everything from malware to reconnaissance logs. In the past, identifying these hidden caches of malicious intent has been a manual, regex-heavy challenge. The Threat Hunting module in the Censys Platform solves this problem by providing contextual metadata about assets with open directories. This information can be explored in an intuitive interactive UI, raw data in the Platform web console, and retrieved via API.Open directories that meet certain criteria are tagged as Suspicious Directory threats. The Suspicious Directory threat highlights assets that contain web-accessible directories containing security tools, penetration testing utilities, webshells, or other potentially malicious files. These directories often expose sensitive tools and scripts that could be used for unauthorized access or malicious activities. You can use this threat information

120
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
published in Censys Platform use cases, findings, and queries
Use the Censys Browser Extension for quick investigations
Use the Censys Browser Extension for quick investigations

Security investigations demand speed and efficiency. Every second spent pivoting between tools or copying and pasting data can impact your team's ability to identify and respond to threats. That's why we built the Censys Chrome Extension to put internet intelligence at your fingertips, directly within your browser.Use the extension to perform lookups on IP addresses and quickly run full-text searches in the Censys Platform. You can run up to 50 lookups per day.Check out the video below to see it in action:Learn more about how to use the extension in our docs.

180
MattK_Censys
V
vitutusNew Participant
asked in Censys Platform use cases, findings, and queries
services.extended_service_name not available on the censys platform

I’m attempting to convert my queries to the new query syntax. There is one field that I use frequently that will not convert: services.extended_service_name. The error I get back is that it is not available on the censys platform.Is this a known issue? Was this field migrated but not mapped for the query converter tool?Thanks

363
MattK_Censys
T
tarNew Participant
asked in Censys Platform use cases, findings, and queries
Aggregate API Query Result Limit

I was wondering if it was possible to get more than 2000 results using the aggregate API endpoint.

361
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week June 12, 2025: Certificates with a specific name that expire in the next month

Hello again! In this week’s Cool Query of the Week, I’m highlighting a way to search for certificates containing a specific name that expire in the next month. Swap out the example domain for your domain of interest and set up a collection to get alerts when new certificates are added to this query’s results.cert.parsed.subject.common_name: "example.com" and cert.parsed.validity_period.not_after >= "now" and cert.parsed.validity_period.not_after < "now+1M"

370
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
asked in Censys Platform use cases, findings, and queries
Cool Query of the Week May 29, 2025: Hosts with open directories with executable files

Hello again! In this iteration of Cool Query of the Week, we’ve got a query for hosts labeled as open directories that contain executable files in their endpoints’ HTTP bodies. Narrow this down with other executable file extensions, geographic ranges, or whatever else is important to you.host.services.endpoints.http.body: {".exe", ".hta"} and host.services.labels.value: OPEN_DIRECTORYAs a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

2020
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 22, 2025: Possible impersonations of Facebook login pages

Hello again! In this iteration of Cool Query of the Week, we’ve got a query that can find web properties that may be attempting to impersonate Facebook login pages. This is accomplished by looking for the phrase “Facebook - log in or sign up” in HTML titles on web properties that are not accompanied by a legit facebook favicon.web.endpoints.http.html_title: "Facebook - log in or sign up" and not web.endpoints.http.favicons.hash_sha256: {88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7, 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80}As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

390
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 15, 2025: Searching cert names for subdomains

Hello again! In this iteration of Cool Query of the Week, I highlight how to search for certificates that contain an eTLD+3 or greater subdomain of a given domain. In this example, I’m targeting example.com, which you should swap out for your domain-of-interest.This query also uses regular expression (regex). In the Platform, as with Legacy Search, regex in queries is only available to paying customers. However, anyone can get access to regex on the Platform by buying Censys Credits.cert.names=~`.*\..*\.example\.com$`Learn more about regex in Censys Query Language in the docs.As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

600
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform use cases, findings, and queries
Cool Query of the Week May 9, 2025: Web properties with sensitive exposed paths

Hey all! I’m bringing back our Cool Query of the Week series with a focus on writing queries in the new Censys Query Language for use on the Platform. You can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.This week I’m starting off with a query that highlights some of the web assets you can find by searching across web property endpoints.This query returns web properties with potentially sensitive exposed paths. You can combine this with other criteria like your organization’s name or known web assets to narrow its focus.web.endpoints: (path= {"/config", "/logs", "/uploads", "/backups"} and http.status_code: 200)Learn more about web properties in the docs.

920
MattK_Censys

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us