Hello again! In this iteration of Cool Query of the Week, we’ve got a query for hosts labeled as open directories that contain executable files in their endpoints’ HTTP bodies. Narrow this down with other executable file extensions, geographic ranges, or whatever else is important to you.
host.services.endpoints.http.body: {".exe", ".hta"} and host.services.labels.value: OPEN_DIRECTORY
As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.
