Skip to main content

Use-cases, queries, and findings

Share your use-cases, queries, and unique findings with Search or ASM

17 Topics
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for September 19, 2024: CQOTW: Find hosts with a page title on an HTTP service containing the word "dashboard"

Hey all! This week I’ve got one with a couple of different uses. This will return hosts (or virtual hosts, if you include them) with a page title on an HTTP service that contains the word “dashboard.”services.http.response.html_title: "dashboard" ASM users can use a version of this in their attack surface inventory, along the following lines:host.services.http.response.html_title: "dashboard" This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
1 hour ago
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Query For Remcos RAT

 Hey allCame across another cool query to share with you. This time for Remcos C2’s, and was based on an initial post from drb_ra on X. same_service(services.banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" and services.tls.certificates.leaf_data.signature.self_signed=`true` and not services.tls.certificate.parsed.subject_dn:?* and not services.tls.certificate.parsed.issuer_dn:?* and services.tls.ja4s: t130200_1301_234ea6891581) The main part of the query is this empty certificate and JA4s value. As well as an empty service header on the same port. There’s some cool hits for Remcos with 0 VT on the C2. I haven’t been able to check all of the results yet. Although many so far are known C2’s for Remcos.  

1
MattK_Censys
19 hours ago
M
Matthew Embee ResearchNew Participant
posted in Search findings, use cases, and queries
Hunting Astaroth Malware Domains With Redirects

Hey All,  Came across a cool query to find the Astaroth domains from this twitter post. https://x.com/johnk3r/status/1833899781099524181The apex domains (ignoring subdomain) all seem to redirect to twitter, linkedin or instagram which is strange. Combined with the unusual .cfd domain, it’s unique enough to make a query.This works best if you have regexservices.http.response.headers: (key: `Location` and value.headers:/https?:\/\/(www\.)?(instagram|x|twitter|linkedin).com/) AND services.tls.certificates.leaf_data.names:"*cfd"For those without regex, you can use this and replace instagram with linkedin, twitter or x. services.http.response.headers: (key: `Location` and value.headers:`https://www.instagram.com`) AND services.tls.certificates.leaf_data.names:"*cfd" 

0
M
7 days ago
john
johnNew Participant
posted in Search findings, use cases, and queries
ChatOps for Open Port Monitoring

Ports accidentally being opened to the Internet is an age-old problem. This results in regular firewall reviews or, worse, having the port identified with a discovered vulnerability, raising the risk to the organization. Increasing complexity, continuous deployments, and chances of misconfigurations have increased the need for third-party validation.I built Lunker Zero for ChatOps to perform regular checks with Censys Search to determine when ports are open/closed based on the Autonomous System (AS) number query results.

1
MattK_Censys
13 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
CQOTW for September 5, 2024: Script edition: Monitoring new certs that could be impersonating an organization

Hey all, this week I’ve got a script that you can use with Censys Python to monitor newly-issued certificates that could be impersonating an org. Fill in the org name and date desired for your purposes:from censys.search import CensysCertsimport timeimport jsonDATE = '2023-12-30'start_time = time.time()c = CensysCerts()certs_dict = {}all_certs = []# Single page of search resultsquery = c.search(f'\"organization\" and parsed.extensions.subject_alt_name.dns_names: \"*organization*\" and added_at:[{DATE} to *]', per_page=100, pages=-1)count = 0for page in query: count += 1 print(f"page {count}") # print("--- %s seconds ---" % (time.time() - start_time)) for cert in page: all_certs.append(cert)certs_dict['data'] = all_certswith open("results.json", "w") as outfile: json.dump(certs_dict, outfile)print("--- %s seconds ---" % (time.time() - start_time)) This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use

0
MattK_Censys
13 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for August 29, 2024: Searching for typosquatted domains

This week I’ve got a hosts query to help you locate potentially typosquatted domains. This one uses regex and looks for DNS names in host records that start with “cens” and then have exactly two characters following that before a variety of TLDs, notably not including .com: dns.names: /cens.{2}\.(xyz|info|top|net|org|biz|name|io)/ This was formatted to return results that may be similar to Censys.If your Censys account doesn’t have access to regex in queries, you can use wildcards or a tool like dnstwist to identify specific domain names that you want to investigate with a targeted search.This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
20 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in ASM use cases and queries
Cool Query of the Week for August 22, 2024 ASM Edition: Hosts with accessible HTTP services that might be accidentally exposed

Hey all! This week’s query is geared toward our ASM users, but could be fairly easily modified to work in Search as well. It uses regex, so just note that if you want to port it to Search fields you will need a Search Pro or above license to use the name value string as-is.host.name: /.*(login|admin|uat|dev|test|staging|legacy).*/ and host.services.http.response.status_code: 200 This one is along the same lines of the query I shared last week to return HTTP sites with an executable file listed in their index fileThis is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
27 days ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for August 6, 2024: C2IntelFeeds and queries from drb-ra

This week I wanted to highlight some useful content from the broader community: C2IntelFeeds by drb-ra. drb-ra shares likely C2 servers on their twitter feed and many useful queries for finding likely C2 are provided in their Git repo. For example:BianLian Go Trojan: same_service(services.tls.certificates.leaf_data.subject_dn=/C=[0-9a-zA-Z]{16}, O=[0-9a-zA-Z]{16}, OU=[0-9a-zA-Z]{16}/ AND services.tls.certificates.leaf_data.issuer_dn=/C=[0-9a-zA-Z]{16}, O=[0-9a-zA-Z]{16}, OU=[0-9a-zA-Z]{16}/) Qakbot: same_service(services.jarm.fingerprint={"21d14d00021d21d21c42d43d0000007abc6200da92c2a1b69c0a56366cbe21","04d02d00004d04d04c04d02d04d04d9674c6b4e623ae36cc2d998e99e2262e"} AND services.http.response.body_hash="sha1:22e5446e82b3e46da34b5ebce6de5751664fb867") OR same_service(services.banner_hashes="sha256:5234096d7003929ad67037af6f5816933cab9e85f9b286468249ac9ab9bfb861" AND services.http.response.body_hash="sha1:22e5446e82b3e46da34b5ebce6de5751664fb867") OR (services.tls.certificates.leaf_data

0
MattK_Censys
1 month ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 31, 2024: Newly-created certificates with localhost in subject or issuer name

This week we’ve got another complex query. This one looks for certificates with localhost in the subject or issuer name that were created in the last 7 days. This could potentially point to misconfigured environments or systems exposed to the Internet. This query was shared by Emily on our research team.(parsed.subject.common_name: "localhost" or parsed.issuer.common_name: "localhost") and parsed.validity_period.not_before: [now-7d to now] This is part of a regular series of posts in which we highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!

0
MattK_Censys
1 month ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 25, 2024: Recently-issued certs on login pages

This week we’ve got a complex query that leverages our relative time variables to identify recently-issued (within the last 6 hours) certificates that are present on hosts with exposed login pages. Certs like this could be used to impersonate an organization for phishing or MITM attacks. Thanks to Morgan on our team for highlighting it.services: ((tls.certificate.ct.entries.value.added_to_ct_at: [now-6h to *]) and (labels: login-page)) Combine this query with fields like the following to look for hosts that could be used to impersonate a specific organization or service.dns.names:  [orgname][.]com services.tls.certificate.names:  [orgname][.]com services.tls.certificate.parsed.subject.organization: “Org Name” services.http.response.html_title: *[orgname]* whois.organization.name: “Org Name” whois.organization.tech_contacts.email: *@[orgname][.]comThis is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search

0
MattK_Censys
1 month ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 17, 2024!

Howdy! This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!This is a pretty simple one, but is useful to know regardless. If you know the specific SHA 256 fingerprint of a given certificate, you can use the services.tls.certificate.fingerprint_sha256 field to search for all hosts presenting it. For example:services.tls.certificate.fingerprint_sha256: "e827dd2376f59c655eb5bae5499977dd08d3f851573c4cf5688ded097205a7dd"

0
MattK_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Bookmark this page: The Censys Workshop - great resource for Search queries!

Wanted to highlight this awesome page put together by the Censys team. It has a ton of example starting points for queries. New and seasoned threat hunters alike can get some use out of it:https://workshop.censys.io/censys-search-questions/ We’ll be highlighting a lot of content from here in the Community over the months to come.

0
MattK_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Queries of the Week for July 8, 2024!

This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!This week I’m sharing something somewhat topical: queries you can use to detect issues related to the Polyfill[.]io supply chain attack. Our research team published a bunch of info about this attack here. While the attack appears to have been mostly mitigated thanks to the suspension of the malicious domain, it’s worth digging a bit into potentially-related compromised domains to remain vigilant--and ensure that any lingering references to the original Polyfill domain or its potential relatives are removed from your codebase.Censys Search query for exposed hosts referencing the malicious polyfill[.]io domain:services.http.response.body:{`https://cdn.polyfill.io`, `https://cdn.polyfill.com`}Censys Search query for exposed hosts referencing

0
MattK_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for July 1, 2024!

Hi there! This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!This week we’ve got a good starting point query for finding SSH running on nonstandard ports: services: (service_name:ssh and not port:{22, 2222}) ASM users can prepend hosts. to the query to use it on their hosts inventory to build a more complete picture of their attack surface: host.services: (service_name:ssh and not port:{22, 2222})Have you used a query like this for threat hunting? Let us know!

0
MattK_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Queries of the Week for June 24, 2024!

Howdy! This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!This week, I want to show off our recently-released relative time frame functionality.You can use these in ASM and Search queries to easily find and analyze items based on dynamic time periods that are relative to the current time. The following example queries illustrate how to use this functionality.In ASM:Assets discovered today: association_date: [now/d TO *] Risk discovered in the past 3 days: risks.discovered_at: [now-3d TO *] Domains expiring tomorrow: domain.expiration_date: [* TO now+1d]In Search:Hosts updated in the past hour: last_updated_at: [now-1h TO *] Hosts with CVEs that have a KEV added in the past 6 months: cves.kev.date_added: [now-6M TO *] Certificates that were revoked in the past 8 hours: revocation.crl.revoc

0
MattK_Censys
2 months ago
brakercensystestbraker
brakercensystestbrakerNew Participant
posted in Search findings, use cases, and queries
[search] -Find Admin Pages

Here is a nice search to find admin pages (same_service(port: 443 and banner: "admin") ) 

1
MattK_Censys
2 months ago
MattK_Censys
MattK_CensysCensys Community Manager
posted in Search findings, use cases, and queries
Cool Query of the Week for June 17, 2024!

This is part of a regular series of posts in which we’ll highlight useful, interesting, and otherwise cool queries for use with Censys Search and ASM. If you have any questions, similar queries, or custom versions of this week’s highlight, let us know!To kick things off, we’re going to start with a unique one: a query for locating gas station pump controllers (ATGs):(same_service(port: 10001 and banner: "IN-TANK INVENTORY") or services.service_name: ATG) and services.truncated: falseIncorporating services.truncated: false excludes honeypots (Hosts with over 100 services)

0
MattK_Censys
3 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings