Awesome Censys Queries

A collection of fascinating and bizarre Censys Search queries.

<!-- markdownlint-disable MD033 --> <p align="center"> <img src="./images/search.censys.io.png" alt="Censys Search" width="500px" /> </p>

Contributing

Found an awesome query? Submit it here

Interested in contributing in another way? See the contributing guidelines

Resources

• Censys Search
• CensysGPT Beta - AI Generated Queries

Key

• <a>🔎 →</a> - This icon will take you to the Censys Search results page for the query.

Table of Contents

<!-- markdownlint-disable MD004 MD005 MD007 MD032 --> <!-- toc -->

• Industrial Control Systems
• Internet of Things Devices
• Security Applications
• Databases
• Dashboards
• Game Servers
• Media Servers
• Random Services
• Advanced Queries

• Credits
• License
• Star History

<!-- tocstop --> <!-- markdownlint-enable MD004 MD005 MD007 MD032 -->

Industrial Control Systems

Industrial Control System Protocols 🔎 →

services.service_name: {BACNET, CODESYS, EIP, FINS, FOX, IEC60870_5_104, S7, MODBUS}

Prismview (Samsung Electronic Billboards) 🔎 →

services.tls.certificates.leaf_data.subject.common_name: "Prismview" or services.http.response.headers.server: "Prismview Player"

<details> <summary markdown="span">Screenshot</summary> <img src="./images/prismview.png" alt="Prismview" width="300px" /> </details>

Gas Station Pump Controllers (ATGs) 🔎 →

(same_service(port: 10001 and banner: "IN-TANK INVENTORY") or services.service_name: ATG) and services.truncated: false

Pro-Tip: Add services.truncated: false to your query to exclude honeypots (Hosts with 100+ services).

<details> <summary markdown="span">Screenshot</summary> <img src="./images/atg.png" alt="ATG" width="300px" /> </details>

Electric Vehicle Chargers 🔎 →

same_service(http.response.headers.server: "gSOAP/2.8" and http.response.headers.content_length: 583)

Carel PlantVisor 🔎 →

services.http.response.html_title: "CAREL Pl@ntVisor"

<details> <summary markdown="span">References</summary>

• https://www.carel.com/product/plantvisor

</details>

C4 Max Vehicle GPS 🔎 →

services.banner: "[1m[35mWelcome on console"

<details> <summary markdown="span">References</summary>

• https://wiki.neweagle.net/ProductDocumentation/Telematics/C4MAX_datasheet.pdf

</details>

GaugeTech Electricity Meters 🔎 →

services.http.response.headers.server: "EIG Embedded Web Server"

<details> <summary markdown="span">Screenshot</summary> <img src="./images/gaugetech.png" alt="GaugeTech" width="300px" /> </details>

XZERES Wind Turbines 🔎 →

services.http.response.html_title: "XZERES Wind"

Note: This query works best with virtual hosts included.

<details> <summary markdown="span">Screenshot</summary> <img src="./images/xzeres-wind-turbine.png" alt="XZERES Wind Turbine" width="300px" /> </details>

Nordex Wind Turbine Farms 🔎 →

services.http.response.html_title: "Nordex Control" or services.tls.certificates.leaf_data.issuer.domain_component: "NORDEX-AG"

<details> <summary markdown="span">References</summary>

• https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-307-01

</details>

Saferoads VMS Signs 🔎 →

services.software: (vendor: "Saferoads" and product: "VMS")

<details> <summary markdown="span">References</summary>

• https://www.saferoads.com.au/zone-vms

</details>

Internet of Things Devices

Roombas 🔎 →

services.tls.certificates.leaf_data.issuer.common_name: "Roomba CA"

Mein Automowers 🔎 →

services.http.response.headers.Www_Authenticate: `Basic realm= "Mein Automower (Robonect Hx+)"`

WinAQMS Environmental Monitor 🔎 →

services.banner: "WinAQMS Data Server" and services.truncated: false

Emerson Site Supervisor 🔎 →

services.http.response.html_title: "Emerson Site Supervisor"

<details> <summary markdown="span">Screenshot</summary> <img src="./images/emerson-site-supervisor.png" alt="Emerson" width="500px" /> </details> <details> <summary markdown="span">References</summary>

• https://www.emerson.com/en-us/site-supervisor-5385648A

</details>

Brightsign Digital Sign 🔎 →

services.http.response.html_title: "'BrightSign®"

Elnet Power Meters 🔎 →

same_service(services.http.response.headers.Server="CAL1.0" and services.http.response.status_code: 200)

<details> <summary markdown="span">Screenshot</summary> <img src="./images/elnet.png" alt="Elnet" width="500px" /> </details> <details> <summary markdown="span">References</summary>

• http://www.elnet.cc/

</details>

Nethix Wireless Controller 🔎 →

services.http.response.headers.set_cookie: "NethixSession"

<details> <summary markdown="span">References</summary>

• https://nethix.com/en/

</details>

Compromised Mikrotik Router 🔎 →

services.service_name: MIKROTIK_BW and services.pptp.hostname: "HACKED"

<details> <summary markdown="span">References</summary>

• https://thehackernews.com/2021/12/over-300000-mikrotik-devices-found.html

</details>

Security Applications

Cobalt Strike Servers 🔎 →

services.certificate: {
    "64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6",
    "87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c"
}
or services.tls.certificates.leaf_data.issuer.common_name: "Major Cobalt Strike"
or services.tls.certificates.leaf_data.subject.common_name: "Major Cobalt Strike"

Metasploit Servers 🔎 →

services.http.response.html_title: "Metasploit" and (
    services.tls.certificates.leaf_data.subject.organization: "Rapid7"
    or services.tls.certificates.leaf_data.subject.common_name: "MetasploitSelfSignedCA"
)
or services.jarm.fingerprint: {
    "07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d",
    "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823"
}

Nessus Scanner Servers 🔎 →

services.http.response.headers.server: "NessusWWW"
or services.tls.certificates.leaf_data.subject.organizational_unit: "Nessus Server"

NTOP Network Analyzers [🔎