Search Q&A

I have read all the documentation but nothing is clear, how do I and what is the right thing to use for the request, one page says need API ID and Secret, another page says Token and Organization ID, I need to submit a request to Censys Search and I have 500 credits, but how do I do submit the request?

Hello!I hadn’t touched my code for a week or two, and running it again I found that it didn’t work anymore. I went back to almost one of the examples from the official repository:from censys.search import CensysHostsif __name__ == "__main__": api_id = "XXX" api_secret = "YYY" h = CensysHosts(api_id, api_secret) query = h.search("services.service_name: FTP", per_page=1, pages=2) all_hosts = query.view_all() print(all_hosts)And I’m still encountering an exception:Traceback (most recent call last): File "[...]\debug.py", line 10, in <module> all_hosts = query.view_all() ^^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 208, in view_all for hit in self.__call__(): ^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 168, in __call__ self.total = result["total"] ~~~~~~^^^^^^^^^TypeError: string indices must be integers, not 'str'While debugging, I

I just started using Censys Search and want to export search results which I understand requires using the Censys CLI. So I’ve installed https://github.com/censys/censys-python and created a PAT at https://accounts.censys.io/settings/personal-access-tokens?org=xxx-xxxxxx but when attempting to authenticate I get a “failed to authenticate” error. Your documentation at https://docs.censys.com/reference/get-started is unclear in what the "Censys API ID” is, it sounds like it’s the Organization ID, which I tried to use. I’ve also tried the token name, and my email address. None seem to work. Here is the output: ❯ censys configCensys API ID: xxx-xxxxxxCensys API Secret: censys_9xxxxxxx7R_JbsxxxxxxxxxxxGSDo you want color output? [y/n]: yFailed to authenticate So I’m asking for clarity on what the Censys API ID is supposed to be. And if it is the Org ID, than any other ideas on why it’s failing to authenticate? I already checked RBAC and my user does have “API Access” enabled.

Anyone else faced the following issue? We have tried to cancel our Teams plan in several ways, but failed:By updating “Payment Settings” through My Account. The given “contact support” blue-button does not work; For Teams plan, no support is provided. So the ticket system auto-denied the request. By contacting self-service@censys.com. No response. Calling the listed US phone-numbers, no contact. Was able to leave voice message though, but no follow-up unfortunately.Is there any other way to change payment setting or cancel this subscription? What is the best way to resolve this?

When I tried to search with Censys Platform API, I encountered 403 error.Search / Query Request:curl --request POST \     --url 'https://api.platform.censys.io/v3/global/search/query?org=zzzz \     --header 'accept: application/vnd.censys.api.v3.search.v1+json' \     --header 'authorization: Bearer censys_xxxxxxxxx_xxxxxxxxxxxxxxxxx' \     --header 'content-type: application/json' \     --data '{"query":"8.8.8.8"}' Response:{  "title": "Forbidden",  "status": 403,  "detail": "Forbidden"}

Is it possible to mutiple query into one line via API and get the result into CSV? Like IP, open port, soft name, service, EOL etc.

I don’t think Censys Search Solo or Teams plans include support via tickets or email. In this case, how should I proceed if I need to update my credit card information or discuss cancellation? I’ve tried reaching out via email, but I haven’t received a response. Also, I can’t disclose my credit card information here. Could you please advise on the best way to resolve this?

would like to know who might be in charge of technology partnerships so users can use Censys with their favorite  Threat Intel platform sadly Censys is not part of my favorite TIP - Open CTI - https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76 just sayin

Hello, I am currently learning to use the /v2/hosts/search API endpoint with the optional "fields" parameter. I am successfully getting results but I am having issues specifically with the subfields under "services.http.response.headers", such as "services.http.response.headers.ETag", "services.http.response.headers.Server" and so on. I would expect these fields to work just like "services.port" or "services.service_name" and return a single value in the response, but they don't. If I specify any of these subfields, what I get in the response (as long as the particular service has any http headers) is a large list which seems to contain all values of the headers subfields, even subfields I didnt specify in the request. And the problem is its just a list of values (name of the field is "headers" for each value), so I dont know which value is the Server subfield, which value is the Content_Length subfield and so on (or if these subfields are present in the response at all), so this data

Hello. ¿The field services.banner is not compatible with censys?. When using the API it is possible to use: Error during consultation: 422 (Entidad not procesable): unvalidated visit field 'services.banner'. campo no supportado

how to find real ip from cloudflare ip direct

Hello.I created a censys account.It said that I can use the API for 60 days with a free account, but I can't use the API with a newly created account.Can someone help me?

Are there any recommended best practices for scaling the Censys Python API calls?I am interested in the CWMP protocol. The following query will return 10k of the 157k. If I ran this daily search to track that service, I would quickly burn through the allocated quota.query = h.search("services.service_name: CWMP", per_page=100, pages=100)Does the road map contain feasible bulk or stream API options for large data sets?

我需要全球域名数据库

Howdy! This week I’m sharing a query that searches for hosts running services presenting a certificate with a particular string in the subject DN, in this case “AsyncRAT Server”, which could indicate that that host and service are running malware.services.tls.certificates.leaf_data.subject_dn=`AsyncRAT Server`This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

I have been set the right value for $CENSYS_API_ID and $CENSYS_API_SECRETHowever, the server sends me “error message” so I seek for help to download data with my api.curl -X "GET" "https://search.censys.io/api/v1/data/universal-internet-dataset-v2-ipv4" -H "Accept: application/json" --user "$CENSYS_API_ID:$CENSYS_API_SECRET"{"status": "error", "error": "This server could not verify that you are authorized to access the document you requested.  Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.", "error_type": "unknown"}

What scanning strategy does Censys use to provide coverage over the IPv6 address space?

Hey all, back with CQOTW after some time off! Here is a fairly straightforward one that uses our service fields to find potentially exposed telnet services:(services=telnet) and services.banner:`username`You could make this more targeted using something like an IP address, IP range, ASN, and so on:(services=telnet) and services.banner:`username` and ip=[insert IP/range here] This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

We often hear this question from search users, and the response is at the moment you cannot.Searches run in the web UI and API are always for hosts and virtual hosts as they are currently known.However, on any host page, you can select Host History to see a chronology of events and go back to a historical view, but searches using history are not supported. 

This week I’m highlighting a query that you can use to find sites that have an executable file in their index. Hosts that are returned by this query could be worth further investigating to determine whether they are being used for malicious purposes. This query uses regex to include a number of different file extensions but you can use a simpler, regex-free version of it with wildcards or specific executable file names. services: (http.response.html_title:"index of" and http.response.body=/.*\.(js|exe|app|vb|scr).*/) If you have identified a specific executable file of interest (for example, nc.exe), you could use that for the value for the services.http.response.body field, as Matthew from Embee Research did in his excellent guide to tracking malware with Censys. This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s

Hi,Is there perhaps a list of towns to check in a specific country, if there is where can I find it.Please let me know.Thanks!

I have a use case where I want to search for historical activity of services on a large number of hosts (200k+)Currently this is my approach (using the API):Search for hosts For each host: get changed events within a time period For each changed event: check if the event potentially matches the service criteria (e.g. port or protocol) For each of these candidate events: get host details at the candidate event timestamp Extract service details from response This works, but is quite involved and consumes a lot of API credits.Did anyone find a better way  to query the service history of multiple hosts?Thanks!

This is another series of posts I’ll be making that cover basic use-cases and building blocks for Censys Search--this one is called “How can I...” We’ll start out with “How can I find hosts in a specific country running a specific software?“ Here’s an example query that returns hosts in Russia detected running gSOAP: location.country=Russia and services.software.product: gSOAP This query uses the location.country field to set a geographic boundary and the services.software.product field to identify the software in focus. Another potential starting point for this would be to start with simply the location.country=Russia query and then run a report on those results that uses services.software.product as the breakdown field. This will provide you with a window into the types of software products that have been detected on hosts in Russia, allowing you to identify software of interest and perform follow-up queries.

I have been searching for XSS and other vulnerability on multiple platforms and I have found that most of them filter it. However, in login forms, if I include “<” or “>” [without quotes], the text in between was not shown in the error message. Here is what I typed in the username: Admin <script>alert('xss')</script> HelloHere is what the error message shown: Error: The username Admin Hello is not registered on this site. If you are unsure of your username, try your email address instead.I think that this is due to the input sanitizer, or it might be something else that idk.Has anyone encountered such situation before?

When introducing users to the Censys Search Language, this is a question we often hear.The equals sign means that the value provided as search criteria for a field must be an exact match in totality to the value stored in Censys for the host to be considered a hit. The colon is a “fuzzy” match operator.To illustrate this, note the differences between results when searching forservices.http.response.html_title="200 Success" services.http.response.html_title:"200 Success"The first query returned 0 results at the time of this posting as it was looking for exact matches to “200 Success” in the HTML title. The second returned 3 results and included services with responses “200 - Success”.