Skip to main content

Recently active topics

18 Topics
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for May 5, 2025

This release includes two new rapid response bulletins and two new software fingerprints.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.SAP NetWeaver Actively Exploited Unauthenticated File Upload Vuln (CVE-2025-31324) Critical Pre-Authentication RCE Vulnerability in Commvault Software (CVE-2025-34028) Use the following queries to find internet-facing instances of Commvault software. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints. Type Name Description Query software eSSL eTimeTrackLite This is an eSSL eTimeTrackLite employee time tracking and attendance management system. Platform query   Legacy Search query software Commvault Command Center This is a Commvault Command Cente

00
MattK_Censys
S
sudoFTPNew Participant
asked in Search findings, use cases, and queries
/hosts/{ip} returns data, but /hosts/search/ endpoint doesn't return anything for the same IP

​​​​​​Query https://search.censys.io/api/v2/hosts/91[.]129[.]106[.]3 returns the following:{    "code": 200,    "status": "OK",    "result": {        "ip": "91[.]129[.]106[.]3",        "services": [],        "location": {            "continent": "Europe",            "country": "Estonia",            "country_code": "EE",            "city": "Tallinn",            "postal_code": "10111",            "timezone": "Europe/Tallinn",            "province": "Harjumaa",            "coordinates": {                "latitude": 59.43696,                "longitude": 24.75353            }        },        "location_updated_at": "2025-04-24T11:09:49.829533682Z",        "autonomous_system": {            "asn": 1257,            "description": "TELE2",            "bgp_prefix": "91.129.96.0/19",            "name": "TELE2",            "country_code": "EU"        },        "autonomous_system_updated_at": "2025-04-24T11:09:49.829533682Z",        "whois": {            "network": {                "handle": "EE-TE

886
S
Z
ZainLNew Participant
asked in Threat hunting
Search for CVE-2025-31324 in my Enviorment

Can anyone recommend a search that I can use to check if I have any instances of NetWeaver in my environment?

181
AidanH_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Censys Platform Q&A
Upcoming enhancements to Censys IPv6 data records

Beginning May 1, 2025, the number of IPv6 records in Censys host datasets will drop by approximately 492 million. These 492 million records represent data that is identical to data on other records and of very low utility. The records will remain in Censys historical datasets.This drop in IPv6 data records is due to a change that Censys made to our scanning infrastructure in mid-April. The Censys team made this change to ensure that our data remains accurate, representative of the global public internet, and easy to search.Censys scanners continue to scan web properties that resolve to the IPs for which duplicate records are being dropped. IPv4 records are unaffected. This change will not affect domain-based scanning behavior.If you have any questions about this change, feel free to ask in the comments on this post.

180
MattK_Censys
mchrisos_Censys
mchrisos_CensysCensys Team
posted in Security news
The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

If you think Salt Typhoon has moved on—you might want to double-check your attack surface. We’re still seeing critical telecom infrastructure exposed to active targeting. Find out what we uncovered (and what you should be looking for) in the new research team blog: https://censys.com/blog/the-persistent-threat-of-salt-typhoon-tracking-exposures-of-potentially-targeted-devices

110
mchrisos_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 28, 2025

The following enhancements and improvements are now available to Censys users.PlatformFind the information you need in the Censys Platform faster using the new web app landing page. The new landing page includes a rotating selection of example queries, data aggregations, new onboarding steps, and more.   Use the new Filter my results to display services or endpoints that match my query option on the Report Builder to limit the report results to only the services or endpoints that match your query. This option helps you build more focused reports.    The maximum number of report buckets has also been increased to 2,000.   Integrate Censys Platform functionality with your automated workflows with the new Python and Go SDKs. The Python SDK is also available on PyPI. ASMThe new Ports & Protocols Dashboard enables you to understand exactly which ports are open in your attack surface across the full 65,535-port range. This allows you to quickly determine whether there are any open

200
MattK_Censys
S
Senior ShadeFrequent Contributor
asked in Search Q&A
API Request

I have read all the documentation but nothing is clear, how do I and what is the right thing to use for the request, one page says need API ID and Secret, another page says Token and Organization ID, I need to submit a request to Censys Search and I have 500 credits, but how do I do submit the request?

607
MattK_Censys
A
atwNew Participant
asked in Search Q&A
What is the API ID?

I just started using Censys Search and want to export search results which I understand requires using the Censys CLI. So I’ve installed https://github.com/censys/censys-python and created a PAT at https://accounts.censys.io/settings/personal-access-tokens?org=xxx-xxxxxx but when attempting to authenticate I get a “failed to authenticate” error. Your documentation at https://docs.censys.com/reference/get-started is unclear in what the "Censys API ID” is, it sounds like it’s the Organization ID, which I tried to use. I’ve also tried the token name, and my email address. None seem to work. Here is the output: ❯ censys configCensys API ID: xxx-xxxxxxCensys API Secret: censys_9xxxxxxx7R_JbsxxxxxxxxxxxGSDo you want color output? [y/n]: yFailed to authenticate So I’m asking for clarity on what the Censys API ID is supposed to be. And if it is the Org ID, than any other ideas on why it’s failing to authenticate? I already checked RBAC and my user does have “API Access” enabled.

796
A
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 21, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Unauthenticated RCE in Erlang/OTP (CVE-2025-32433) Use the following queries to identify exposed Erlang SSH servers. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query New fingerprintsAdded the following fingerprints. Type Name Description Query software Microsoft Power Apps A modern low/no-code solution developed by Microsoft. Platform query   Legacy Search query software Erlang SSH This is an Erlang SSH Server. Platform query   Legacy Search query software AQUILA Radiology Imaging Software by IMEXHS AQUILA is a radiology imaging software platform that provides digital

230
MattK_Censys
T
tzh00203New Participant
asked in Censys Platform Q&A
Error downloading Universal Internet Dataset using the API

I've requested research access for my account. And I have been set the right value for $CENSYS_API_ID and $CENSYS_API_SECRETHowever, the server sends me “error message” so I seek for help to download data with my api.curl -X "GET" "https://search.censys.io/api/v1/data/universal-internet-dataset-v2-ipv4" -H "Accept: application/json" --user "$CENSYS_API_ID:$CENSYS_API_SECRET"{"status": "error", "error": "This server could not verify that you are authorized to access the document you requested.  Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.", "error_type": "unknown"}

453
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 14, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Vulnerability in FortiSwitch Allows Unauthenticated Attackers to Change Admin Passwords (CVE-2024-48887) Use the following queries to find Fortinet FortiSwitch instances. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query Actively Exploited Deserialization Vulnerability in Gladinet CentreStack Secure File Sharing Software (CVE-2025-30406) The queries below can be used to identify exposed instances of Gladinet CentreStack, but they are not necessarily vulnerable to the exploit. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of Gladinet CentreStack that are vulnerable to the exploit. New fingerprintsAdded the follow

240
MattK_Censys
R
RittickFrequent Contributor
asked in Censys Platform Q&A
Support for "host.whois.network.cidrs"/ "whois.network.cidrs" in Report Builder

Hi Censys Team,I'm trying to generate a report in the Report Builder using the host.whois.network.cidrs/whois.network.cidrs (in legacy censys) field to analyze CIDR blocks associated with WHOIS records, but it seems this field is not currently supported. When attempting to build the report, I get the following error in the legacy one:Error 422. Invalid field: Term aggregations are not supported. If you believe this is an error on our part, please contact us. and here's a screenshot for the same in new platform:It appears that term aggregations for host.whois.network.cidrs / whois.network.cidrs are either disabled or not yet implemented in the Report Builder. This field would be extremely useful for understanding IP space distribution across organizations or registrants at a CIDR level.Could you please confirm if this field will be supported in future updates? If not currently on the roadmap, I’d love to request this as a feature enhancement.Thanks in advance!

211
MattK_Censys
L
luca.malatestaNew Participant
asked in Other security topics
Hystorical data retention for ip scan

Hello, I need to do a historical search of the open ports of one of our public IPs, I wanted to know if by buying Censys credits I can do this historical search and how far back I can go.Thanks

321
MattK_Censys
M
mmollemaNew Participant
asked in Search Q&A
Cancellation for Teams Plans failed

Anyone else faced the following issue? We have tried to cancel our Teams plan in several ways, but failed:By updating “Payment Settings” through My Account. The given “contact support” blue-button does not work; For Teams plan, no support is provided. So the ticket system auto-denied the request. By contacting self-service@censys.com. No response. Calling the listed US phone-numbers, no contact. Was able to leave voice message though, but no follow-up unfortunately.Is there any other way to change payment setting or cancel this subscription? What is the best way to resolve this?

221
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
posted in Announcements
New Threat Hunting Module - Join Censys & Silas Cutler for a Private Briefing

Join Censys and renowned malware analyst Silas Cutler for an exclusive briefing on the BeaverTail malware, ongoing campaigns by North Korean threat actors, and monitoring C2 infrastructure with Censys.Be the first to see Censys' new Threat Hunting ModuleSee how Censys is helping security teams hunt faster, accelerate investigations, and eliminate threats before they attack. Learn how to perform on-demand scanning, historical analysis, and advanced pivoting to uncover and track adversary infrastructure in real-time with Censys. WHEREHistoric Lounge, Ferry Building1 Ferry Building, The EmbarcaderoSan Francisco, CA 94111United States of America WHENMonday, April 28, 20253:00 - 6:00 PMNetworking and refreshments with presentation from 4:00 PM - 5:00 PM Why Attend?Exclusive Intelligence – Get the latest insights on new and evolving malware infrastructure out in the wild First Look at Innovation – Experience how Censys' Threat Hunting Module delivers real-time threat visibility and actionabl

290
MattK_Censys
C
Censys_PowerNew Participant
asked in Censys Platform Q&A
Issue with API Query Results - Only First Page Saved in JSON

I recently upgraded my account to use the API after the recent platform update.I am using Windows CMD to run queries and successfully download the results as a JSON file.However I noticed that the JSON file only contains the first page of results, while the full query results are available when I run the same query on the website I would like to download the entire set of results as a JSON file. Could you please guide me on how to achieve this uising the API? curl -X "POST" "https://api.platform.censys.io/v3/global/search/query?organization_id=secret" --header "X-Organization-ID: secret" --header "Accept: application/json" --header "Authorization: secret" --header "Content-Type: application/json" -d "{\"query\":\"1.1.0.0\"}" > 1.1.json  

666
MattK_Censys
MattK_Censys
MattK_CensysCensys Community Manager
Censys Release Notes for April 7, 2025

The following enhancements and improvements are now available to Censys users.Rapid ResponseThe Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.Unauthenticated Auth Bypass Vulnerability in CrushFTP [CVE-2025-31161] Use the following queries to find CrushFTP services. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of CrushFTP that are vulnerable to the exploit. Unauthenticated RCE Vulnerability in Ivanti Connect & Policy Secure and ZTA Gateway [CVE-2025-22457] Use the following queries to find Ivanti Connect Secure services. Not all of these are necessarily vulnerable, as specific version information may not be available. Platform query Legacy Search query ASM query ASM risk query This query can be used to identify exposed instances of Ivanti C

530
MattK_Censys
D
DenTNew Participant
asked in Search findings, use cases, and queries
The * symbol is not working

Good afternoon, the “*” symbol worked fine on the old platform, for example, I want to find cameras by a specific domain and make a request: “camera*.keenetic.*” at the same time, I get several hundred results (including cameravilla.keenetic.pro; camerahome.keenetic.link and many others), but when on a new platform I enter the same query “camera*.keenetic.*” I only get one response, for example: viagesu-camera.keenetic.link.The "*" sign is simply ignored in any combinations.At first, I thought these were temporary difficulties when switching to a new platform, but today I still could not adequately create a query so that the “*” symbol would work as indicated in the manual. 

758
R

Badge winners

Show all badges
Terms & ConditionsCookie settings
Censys logo

censys.com | Knowledge Base | Censys Search | Contact Us