Skip to main content

Recently active topics

14
S
sudoFTPNew Participant
 Search findings, use cases, and queries
/hosts/{ip} returns data, but /hosts/search/ endpoint doesn't return anything for the same IP

​​​​​​Query https://search.censys.io/api/v2/hosts/91[.]129[.]106[.]3 returns the following:{    "code": 200,    "status": "OK",    "result": {        "ip": "91[.]129[.]106[.]3",        "services": [],        "location": {            "continent": "Europe",            "country": "Estonia",            "country_code": "EE",            "city": "Tallinn",            "postal_code": "10111",            "timezone": "Europe/Tallinn",            "province": "Harjumaa",            "coordinates": {                "latitude": 59.43696,                "longitude": 24.75353            }        },        "location_updated_at": "2025-04-24T11:09:49.829533682Z",        "autonomous_system": {            "asn": 1257,            "description": "TELE2",            "bgp_prefix": "91.129.96.0/19",            "name": "TELE2",            "country_code": "EU"        },        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",        "whois": {            "network": {                "handle": "EE-TE

1488
J
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week May 22, 2025: Possible impersonations of Facebook login pages

Hello again! In this iteration of Cool Query of the Week, we’ve got a query that can find web properties that may be attempting to impersonate Facebook login pages. This is accomplished by looking for the phrase “Facebook - log in or sign up” in HTML titles on web properties that are not accompanied by a legit facebook favicon.web.endpoints.http.html_title: "Facebook - log in or sign up" and not web.endpoints.http.favicons.hash_sha256: {88ae5454a7c32c630703440849d35c58f570d8eecc23c071dbe68d63ce6a40d7, 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80}As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

80
MattK_Censys
E
executifsNew Participant
 Search Q&A
302 when using the Python API

Hello!I hadn’t touched my code for a week or two, and running it again I found that it didn’t work anymore. I went back to almost one of the examples from the official repository:from censys.search import CensysHostsif __name__ == "__main__": api_id = "XXX" api_secret = "YYY" h = CensysHosts(api_id, api_secret) query = h.search("services.service_name: FTP", per_page=1, pages=2) all_hosts = query.view_all() print(all_hosts)And I’m still encountering an exception:Traceback (most recent call last): File "[...]\debug.py", line 10, in <module> all_hosts = query.view_all() ^^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 208, in view_all for hit in self.__call__(): ^^^^^^^^^^^^^^^ File "[...]\.venv\Lib\site-packages\censys\search\v2\api.py", line 168, in __call__ self.total = result["total"] ~~~~~~^^^^^^^^^TypeError: string indices must be integers, not 'str'While debugging, I

343
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 19, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Stack-Based Buffer Overflow Vulnerability Affecting Multiple Fortinet Products [CVE-2025-32756] Use the following queries to find Fortinet products. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints.  Type Name Description Query software Fortinet FortiVoice Application This is a Fortinet FortiVoice Application. Platform queryLegacy Search query software Fortinet FortiNDR This is a Fortinet FortiNDR Server. Platform queryLegacy Search query software Fortinet FortiCamera This is a Fortinet FortiCamera device. Platform q

180
MattK_Censys
F
fmush96New Participant
 Search findings, use cases, and queries
Body query related question

Hey!I want to understand a little bit more about how Censys scan works. I was testing the following query: “host.services.endpoints.http.body : "CNPJ: 06.626.253/0001-51" and no results are given. Otherside, on FOFA, with the following query “body="CNPJ: 06.626.253/0001-51" i can see a few hosts. So how does the body query on Censys works? Does FOFA scan deeper than Censys or just a limitation on body attribute?

151
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week May 15, 2025: Searching cert names for subdomains

Hello again! In this iteration of Cool Query of the Week, I highlight how to search for certificates that contain an eTLD+3 or greater subdomain of a given domain. In this example, I’m targeting example.com, which you should swap out for your domain-of-interest.This query also uses regular expression (regex). In the Platform, as with Legacy Search, regex in queries is only available to paying customers. However, anyone can get access to regex on the Platform by buying Censys Credits.cert.names=~`.*\..*\.example\.com$`Learn more about regex in Censys Query Language in the docs.As a reminder, you can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.

280
MattK_Censys
S
Senior ShadeVery Frequent Contributor
 Other security topics
Top up balance

Hello! I want add 100$ to my balance, but I can't pay with my CreditCard in United States, I see error "Transaction FailedVerify your account information and payment method, then try again."Please fix this or help me with top up! 

396
S
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 12, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Critical RCE Vulnerability Identified in Craft CMS (CVE-2025-32432) Use the following queries to find instances of Craft CMS. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query Unauthenticated Code Injection Vulnerability in Langflow (CVE-2025-3248) Use the following queries to find exposed Langflow servers. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints. Type Name Description Query risk Vulnerable SonicWall Gen7 Firewall [CVE-2024-53704] SonicWall Gen7 Firewalls are vulnerable to an

230
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform use cases, findings, and queries
Cool Query of the Week May 9, 2025: Web properties with sensitive exposed paths

Hey all! I’m bringing back our Cool Query of the Week series with a focus on writing queries in the new Censys Query Language for use on the Platform. You can convert any of the old queries using Censys Search Language shown in the CQOTW series using the Platform’s built-in query converter.This week I’m starting off with a query that highlights some of the web assets you can find by searching across web property endpoints.This query returns web properties with potentially sensitive exposed paths. You can combine this with other criteria like your organization’s name or known web assets to narrow its focus.web.endpoints: (path= {"/config", "/logs", "/uploads", "/backups"} and http.status_code: 200)Learn more about web properties in the docs.

750
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 5, 2025

This release includes two new rapid response bulletins and two new software fingerprints.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.SAP NetWeaver Actively Exploited Unauthenticated File Upload Vuln (CVE-2025-31324) Critical Pre-Authentication RCE Vulnerability in Commvault Software (CVE-2025-34028) Use the following queries to find internet-facing instances of Commvault software. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints. Type Name Description Query software eSSL eTimeTrackLite This is an eSSL eTimeTrackLite employee time tracking and attendance management system. Platform query   Legacy Search query software Commvault Command Center This is a Commvault Command Cente

250
MattK_Censys
Z
ZainLNew Participant
 Threat hunting
Search for CVE-2025-31324 in my Enviorment

Can anyone recommend a search that I can use to check if I have any instances of NetWeaver in my environment?

311
AidanH_Censys
MattK_Censys
MattK_CensysCensys Community Manager
 Censys Platform Q&A
Upcoming enhancements to Censys IPv6 data records

Beginning May 1, 2025, the number of IPv6 records in Censys host datasets will drop by approximately 492 million. These 492 million records represent data that is identical to data on other records and of very low utility. The records will remain in Censys historical datasets.This drop in IPv6 data records is due to a change that Censys made to our scanning infrastructure in mid-April. The Censys team made this change to ensure that our data remains accurate, representative of the global public internet, and easy to search.Censys scanners continue to scan web properties that resolve to the IPs for which duplicate records are being dropped. IPv4 records are unaffected. This change will not affect domain-based scanning behavior.If you have any questions about this change, feel free to ask in the comments on this post.

350
MattK_Censys
mchrisos_Censys
mchrisos_CensysCensys Team
 Security news
The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) in the new research team blog: https://censys.com/blog/the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices

190
mchrisos_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 28, 2025

The following enhancements and improvements are now available to Censys users.PlatformFind the information you need in the Censys Platform faster using the new web app landing page. The new landing page includes a rotating selection of example queries, data aggregations, new onboarding steps, and more.   Use the new Filter my results to display services or endpoints that match my query option on the Report Builder to limit the report results to only the services or endpoints that match your query. This option helps you build more focused reports.    The maximum number of report buckets has also been increased to 2,000.   Integrate Censys Platform functionality with your automated workflows with the new Python and Go SDKs. The Python SDK is also available on PyPI. ASMThe new Ports & Protocols Dashboard enables you to understand exactly which ports are open in your attack surface across the full 65,535-port range. This allows you to quickly determine whether there are any open

250
MattK_Censys

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us