Awesome Censys Queries

一个收集各种迷人且奇特的 Censys Search 查询的集合。

Censys Search

贡献

找到了一个很棒的查询？在此提交

想以其他方式贡献？请参阅贡献指南

资源

Censys Search
CensysGPT Beta - AI 生成查询
旧版搜索查询 - 适用于旧版 Censys 搜索语法的查询

图例

🔎 → - 此图标将带您进入该查询的 Censys Search 结果页面。

#### Prismview（三星电子广告牌）[🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22Prismview%22+or+services.http.response.headers.server%3A+%22Prismview+Player%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "Prismview" or services.http.response.headers.server: "Prismview Player"

截图

加油站油泵控制器 (ATG) 🔎 →```dsl

(same_service(port: 10001 and banner: "IN-TANK INVENTORY") or services.service_name: ATG) and services.truncated: false

> **专业提示**：在查询中添加 `services.truncated: false` 以排除蜜罐（服务数超过 100 的主机）。

<details>
    <summary markdown="span">截图</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/3af28d3f35ed648c44d6dd7ce1be7c8e9db2cac51afe7ba4e0af5245dc161838.png" alt="atg" width="500px" />
</details>

#### 电动汽车充电器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28http.response.headers.server%3A+%22gSOAP%2F2.8%22+and+http.response.headers.content_length%3A+583%29&ref=awesome-censys-queries)```dsl
same_service(http.response.headers.server: "gSOAP/2.8" and http.response.headers.content_length: 583)

Carel PlantVisor 🔎 →```dsl

services.http.response.html_title: "CAREL Pl@ntVisor"

<details>
    <summary markdown="span">参考</summary>

- <https://www.carel.com/product/plantvisor>

</details>

#### C4 Max 车载GPS [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3A+%22%5B1m%5B35mWelcome+on+console%22&ref=awesome-censys-queries)```dsl
services.banner: "[1m[35mWelcome on console"

参考资料

https://wiki.neweagle.net/ProductDocumentation/Telematics/C4MAX_datasheet.pdf

GaugeTech 电力仪表 🔎 →```dsl

services.http.response.headers.server: "EIG Embedded Web Server"

<details>
    <summary markdown="span">截图</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/7646398750494dd77193893cc08e6338f39ba78b650b834a80d142fa2efabecb.png" alt="gaugetech" width="500px" />
</details>

#### XZERES 风力涡轮机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=services.http.response.html_title%3A+%22XZERES+Wind%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "XZERES Wind"

注意：此查询在包含虚拟主机时效果最佳。

截图

Nordex 风力发电场 🔎 →```dsl

services.http.response.html_title: "Nordex Control" or services.tls.certificates.leaf_data.issuer.domain_component: "NORDEX-AG"

<details>
    <summary markdown="span">参考资料</summary>

- <https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-307-01>

</details>

#### Saferoads VMS 标志 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.software%3A+%28vendor%3A+%22Saferoads%22+and+product%3A+%22VMS%22%29&ref=awesome-censys-queries)```dsl
services.software: (vendor: "Saferoads" and product: "VMS")

参考文献

https://www.saferoads.com.au/zone-vms

物联网设备

Roombas 🔎 →```dsl

services.tls.certificates.leaf_data.issuer.common_name: "Roomba CA"

#### 我的自动割草机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.headers.Www_Authenticate%3A+%60Basic+realm%3D+%22Mein+Automower+%28Robonect+Hx%2B%29%22%60&ref=awesome-censys-queries)```dsl
services.http.response.headers.Www_Authenticate: `Basic realm= "Mein Automower (Robonect Hx+)"`

WinAQMS 环境监测器 🔎 →```dsl

services.banner: "WinAQMS Data Server" and services.truncated: false

#### Emerson 现场主管 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Emerson+Site+Supervisor%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Emerson Site Supervisor"

截图

参考资料

https://www.emerson.com/en-us/site-supervisor-5385648A

Brightsign 数字标牌 🔎 →```dsl

services.http.response.html_title: "'BrightSign®"

#### Elnet 电力计量器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.headers.Server%3D%22CAL1.0%22+and+services.http.response.status_code%3A+200%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.headers.Server="CAL1.0" and services.http.response.status_code: 200)

截图

参考

http://www.elnet.cc/

Nethix 无线控制器 🔎 →```dsl

services.http.response.headers.set_cookie: "NethixSession"

<details>
    <summary markdown="span">参考资料</summary>

- <https://nethix.com/en/>

</details>

#### 被入侵的 MikroTik 路由器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.service_name%3A+MIKROTIK_BW+and+services.pptp.hostname%3A+%22HACKED%22&ref=awesome-censys-queries)```dsl
services.service_name: MIKROTIK_BW and services.pptp.hostname: "HACKED"

参考

https://thehackernews.com/2021/12/over-300000-mikrotik-devices-found.html

安全应用

Cobalt Strike 服务器 🔎 →```dsl

services.certificate: { "64257fc0fac31c01a5ccd816c73ea86e639260da1604d04db869bb603c2886e6", "87f2085c32b6a2cc709b365f55873e207a9caa10bffecf2fd16d3cf9d94d390c" } or services.tls.certificates.leaf_data.issuer.common_name: "Major Cobalt Strike" or services.tls.certificates.leaf_data.subject.common_name: "Major Cobalt Strike"

#### Metasploit 服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Metasploit%22+and+%28%0A++++services.tls.certificates.leaf_data.subject.organization%3A+%22Rapid7%22%0A++++or+services.tls.certificates.leaf_data.subject.common_name%3A+%22MetasploitSelfSignedCA%22%0A%29%0Aor+services.jarm.fingerprint%3A+%7B%0A++++%2207d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d%22%2C%0A++++%2207d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823%22%0A%7D&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Metasploit" and (
    services.tls.certificates.leaf_data.subject.organization: "Rapid7"
    or services.tls.certificates.leaf_data.subject.common_name: "MetasploitSelfSignedCA"
)
or services.jarm.fingerprint: {
    "07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d",
    "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823"
}

Nessus Scanner Servers 🔎 →```dsl

services.http.response.headers.server: "NessusWWW" or services.tls.certificates.leaf_data.subject.organizational_unit: "Nessus Server"

#### NTOP 网络分析器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Welcome+to+ntopng%22%0Aor+same_service%28%0A++++services.http.response.html_title%3A+%22Global+Traffic+Statistics%22%0A++++and+services.http.response.headers.server%3A+%22ntop%2F%2A%22%0A%29&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Welcome to ntopng"
or same_service(
    services.http.response.html_title: "Global Traffic Statistics"
    and services.http.response.headers.server: "ntop/*"
)

Merlin C2 🔎 →```dsl

services.jarm.fingerprint: "29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38"

<details>
    <summary markdown="span">参考资料</summary>

- <https://github.com/Ne0nd0g/merlin>

</details>

#### Mythic C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28port%3A+7443+and+tls.certificates.leaf_data.subject.organization%3A+%22Mythic%22%29&ref=awesome-censys-queries)```dsl
same_service(port: 7443 and tls.certificates.leaf_data.subject.organization: "Mythic")

注意: 使用 same_service 运算符时，开头的 services. 前缀是可选的。

参考资料

Deimos C2 🔎 →```dsl

services.jarm.fingerprint: "00000000000000000041d00000041d9535d5979f591ae8e547c5e5743e5b64"

<details>
    <summary markdown="span">参考</summary>

- <https://github.com/DeimosC2/DeimosC2>

</details>

#### Covenant C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++http.response.body%3A+%7B%22Blazor%22%2C+%22covenant.css%22%7D%0A++++and+tls.certificates.leaf_data.issuer.common_name%3A+%22Covenant%22%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    http.response.body: {"Blazor", "covenant.css"}
    and tls.certificates.leaf_data.issuer.common_name: "Covenant"
)

参考

https://github.com/cobbr/Covenant

PoshC2 🔎 →```dsl

same_service( services.tls.certificates.leaf_data.subject.common_name="P18055077" and services.tls.certificates.leaf_data.subject.province="Minnesota" and services.tls.certificates.leaf_data.subject.locality="Minnetonka" and services.tls.certificates.leaf_data.subject.organization="Pajfds" and services.tls.certificates.leaf_data.subject.organizational_unit="Jethpro" )

<details>
    <summary markdown="span">参考文献</summary>

- <https://github.com/nettitude/PoshC2>

</details>

#### Sliver C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++services.tls.certificates.leaf_data.pubkey_bit_size%3A+2048+and%0A++++services.tls.certificates.leaf_data.subject.organization%3A+%2F%28ACME%7CPartners%7CTech%7CCloud%7CSynergy%7CTest%7CDebug%29%3F+%3F%28co%7Cllc%7Cinc%7Ccorp%7Cltd%29%3F%2F+and%0A++++services.jarm.fingerprint%3A+3fd21b20d00000021c43d21b21b43d41226dd5dfc615dd4a96265559485910+and%0A++++services.tls.certificates.leaf_data.subject.country%3A+US+and%0A++++services.tls.certificates.leaf_data.subject.postal_code%3A+%2F%3C1001-9999%3E%2F%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    services.tls.certificates.leaf_data.pubkey_bit_size: 2048 and
    services.tls.certificates.leaf_data.subject.organization: /(ACME|Partners|Tech|Cloud|Synergy|Test|Debug)? ?(co|llc|inc|corp|ltd)?/ and
    services.jarm.fingerprint: 3fd21b20d00000021c43d21b21b43d41226dd5dfc615dd4a96265559485910 and
    services.tls.certificates.leaf_data.subject.country: US and
    services.tls.certificates.leaf_data.subject.postal_code: /<1001-9999>/
)

注意：此搜索使用正则表达式，需要付费账户。 专业提示：尝试移除 JARM 以找到更多 Sliver 实例。

参考资料

https://github.com/BishopFox/sliver

EvilGinx2 🔎 →```dsl

services.jarm.fingerprint: "20d14d20d21d20d20c20d14d20d20daddf8a68a1444c74b6dbe09910a511e6"

<details>
    <summary markdown="span">参考资料</summary>

- <https://github.com/kgretzky/evilginx2>

</details>

#### Brute Ratel C4 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.body_hash%3D%22sha1%3A1a279f5df4103743b823ec2a6a08436fdf63fe30%22&ref=awesome-censys-queries)```dsl
services.http.response.body_hash="sha1:1a279f5df4103743b823ec2a6a08436fdf63fe30"

参考资料

https://bruteratel.com

Empire C2 🔎 →```dsl

same_service( services.http.response.body_hash: {"sha1:bc517bf173440dad15b99a051389fadc366d5df2", "sha1:dcb32e6256459d3660fdc90e4c79e95a921841cc"} and services.http.response.headers.expires: 0 and services.http.response.headers.cache_control: "*" )

<details>
    <summary markdown="span">参考资料</summary>

- <https://bc-security.gitbook.io/empire-wiki/>

</details>

#### Raccoon Stealer V2 (RecordBreaker C2) [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner_hashes%3A+%22sha256%3A7987d0c39c4839572ab88c6d82da01395f74e0c31f12d94c58d0e1bed0b0c75c%22&ref=awesome-censys-queries)```dsl
services.banner_hashes: "sha256:7987d0c39c4839572ab88c6d82da01395f74e0c31f12d94c58d0e1bed0b0c75c"

参考资料

https://twitter.com/1zrr4h/status/1593377638504087553

NimPlant C2 🔎 →```dsl

services.http.response.headers.Server: "NimPlant C2 Server" or services.http.response.body_hashes: "sha256:636d68bd1bc19d763de95d0a6406f4f77953f9973389857353ac445e2b6fff87"

<details>
    <summary markdown="span">参考</summary>

- <https://github.com/chvancooten/NimPlant>
- <https://twitter.com/chvancooten/status/1629911090774589442>

</details>

#### RedGuard [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject_dn%3A+%22C%3DCN%2C+L%3DHangZhou%2C+O%3DAlibaba+%28China%29+Technology+Co.%5C%5C%2C+Ltd.%2C+CN%3D%5C%2A.aliyun.com%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject_dn: "C=CN, L=HangZhou, O=Alibaba (China) Technology Co.\\, Ltd., CN=\*.aliyun.com"

参考

AsyncRAT 🔎 →```dsl

services.tls.certificates.leaf_data.subject.common_name: "AsyncRAT Server"

<details>
    <summary markdown="span">参考资料</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### BitRAT [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22BitRAT%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "BitRAT"

参考资料

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf

OrcusRAT 🔎 →```dsl

services.tls.certificates.leaf_data.subject.common_name: {"Orcus Server", "OrcusServerCertificate"}

<details>
    <summary markdown="span">参考资料</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### QuasarRAT [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%7B%22Anony96%22%2C+%22Quasar+Server+CA%22%7D&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: {"Anony96", "Quasar Server CA"}

参考

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf

NanoCore 🔎 →```dsl

services.tls.certificates.leaf_data.subject.common_name: "unk"

<details>
    <summary markdown="span">参考资料</summary>

- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### DcRat [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject.common_name%3A+%22DcRat+Server%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject.common_name: "DcRat Server"

参考文献

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf

Deimos C2 🔎 →```dsl

same_service((services.http.response.html_title="Deimos C2" or services.tls.certificates.leaf_data.subject.organization="Acme Co") and services.port: 8443)

<details>
    <summary markdown="span">参考资料</summary>

- <https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f>
- <https://github.com/DeimosC2/DeimosC2/blob/2f368a5b151ea2da9f4fcc3627b1eb7d28b38fe5/c2/lib/certs/gen_cert.go>

</details>

#### Posh C2 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.subject_dn%3A+%22C%3DUS%2C+ST%3DMinnesota%2C+L%3DMinnetonka%2C+O%3DPajfds%2C+OU%3DJethpro%2C+CN%3DP18055077%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.subject_dn: "C=US, ST=Minnesota, L=Minnetonka, O=Pajfds, OU=Jethpro, CN=P18055077"

参考资料

IcedID 银行木马 🔎 →```dsl

services.tls.certificates.leaf_data.subject_dn: "CN=localhost, C=AU, ST=Some-State, O=Internet Widgits Pty Ltd"

<details>
    <summary markdown="span">参考资料</summary>

- <https://malware.news/t/melting-ice-tracking-icedid-servers-with-a-few-simple-steps/49525>
- <https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf>

</details>

#### Gozi 恶意软件 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.tls.certificates.leaf_data.issuer_dn%3A+%22C%3DXX%2C+ST%3D1%2C+L%3D1%2C+O%3D1%2C+OU%3D1%2C+CN%3D%5C%2A%22&ref=awesome-censys-queries)```dsl
services.tls.certificates.leaf_data.issuer_dn: "C=XX, ST=1, L=1, O=1, OU=1, CN=\*"

参考文献

https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf

Pupy RAT C2 🔎 →```dsl

same_service(services.http.response.headers.Etag=""aa3939fc357723135870d5036b12a67097b03309"" and services.http.response.headers.Server="nginx/1.13.8") or same_service(services.tls.certificates.leaf_data.issuer.organization:/[a-zA-Z]{10}/ and services.tls.certificates.leaf_data.subject.organization:/[a-zA-Z]{10}/ and services.tls.certificates.leaf_data.subject.organizational_unit="CONTROL")

> **注意**：此搜索使用正则表达式，需要付费账户。

<details>
    <summary markdown="span">参考资料</summary>

- <https://github.com/n1nj4sec/pupy>

</details>

#### Responder服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3D%22HTTP%2F1.1+401+Unauthorized%5Cr%5CnServer%3A+Microsoft-IIS%2F7.5%5Cr%5CnDate%3A++%3CREDACTED%3E%5Cr%5CnContent-Type%3A+text%2Fhtml%5Cr%5CnWWW-Authenticate%3A+NTLM%5Cr%5CnContent-Length%3A+0%5Cr%5Cn%22&ref=awesome-censys-queries)```dsl
services.banner="HTTP/1.1 401 Unauthorized\r\nServer: Microsoft-IIS/7.5\r\nDate:  <REDACTED>\r\nContent-Type: text/html\r\nWWW-Authenticate: NTLM\r\nContent-Length: 0\r\n"

参考资料

Titan Stealer C2 🔎 →```dsl

services.http.response.body: "Titan Stealer"

<details>
    <summary markdown="span">参考</summary>

- <https://twitter.com/BushidoToken/status/1633458241421320192>

</details>

#### 包含可疑文件名的开放目录列表主机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28%0A++++%28services.http.response.html_title%3A%22Index+of+%2F%22+or+services.http.response.html_title%3A%22Directory+Listing+for+%2F%22%29%0A++++and+services.http.response.body%3A+%2F.%2A%3F%28cve%7Cmetasploit%7Ccobaltstrike%7Csliver%7Ccovenant%7Cbrc4%7Cbrute-ratel%7Ccommander-runme%7Cbruteratel%7Cps2exe%7C%28badger%7Cshellcode%7Csc%7Cbeacon%7Cartifact%7Cpayload%7Cteamviewer%7Canydesk%7Cmimikatz%7Ccs%7Crclone%29%5C.%28exe%7Cps1%7Cvbs%7Cbin%7Cnupkg%29%29.%2A%2F%0A%29&ref=awesome-censys-queries)```dsl
same_service(
    (services.http.response.html_title:"Index of /" or services.http.response.html_title:"Directory Listing for /")
    and services.http.response.body: /.*?(cve|metasploit|cobaltstrike|sliver|covenant|brc4|brute-ratel|commander-runme|bruteratel|ps2exe|(badger|shellcode|sc|beacon|artifact|payload|teamviewer|anydesk|mimikatz|cs|rclone)\.(exe|ps1|vbs|bin|nupkg)).*/
)

注意：此搜索使用正则表达式，需要付费账户。

Splunk 🔎 →```dsl

services.software.product: "Splunk"

<details>
    <summary markdown="span">参考</summary>

- <https://www.splunk.com>

</details>

### 数据库

#### 暴露的 CouchDB 服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.body%3A+%27%22couchdb%22%3A+%22Welcome%22%27&ref=awesome-censys-queries)```dsl
services.http.response.body: '"couchdb": "Welcome"'

参考

https://couchdb.apache.org/

仪表盘

cAdvisor 仪表盘 🔎 →```dsl

same_service(services.http.response.html_title=cAdvisor - / and services.http.response.status_code=200 and services.http.request.uri="*/containers/")

<details>
    <summary markdown="span">参考资料</summary>

- <https://github.com/google/cadvisor>

</details>

#### HashiCorp Consul 仪表板 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=same_service%28services.http.response.html_title%3D%60Consul+by+HashiCorp%60+and+services.http.request.uri%3A+%22%2A%2Fui%2F%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title=`Consul by HashiCorp` and services.http.request.uri: "*/ui/")

参考

https://www.consul.io/

Netdata 仪表板 🔎 →```dsl

same_service(services.http.response.headers.Server="Netdata Embedded HTTP*" and services.http.response.html_title="netdata dashboard")

<details>
    <summary markdown="span">参考</summary>

- <https://www.netdata.cloud/>

</details>

#### Rancher 仪表盘 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=same_service%28services.http.response.headers.unknown.name%3A+%22X-Rancher-Version%22+and+services.http.response.html_title%3A+%22Loading%26hellip%3B%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.headers.unknown.name: "X-Rancher-Version" and services.http.response.html_title: "Loading&hellip;")

Traefik 仪表盘 🔎 →```dsl

same_service(services.http.request.uri: "*/dashboard/" and services.http.response.html_title: "Traefik")

<details>
    <summary markdown="span">参考</summary>

- <https://github.com/traefik/traefik>

</details>

#### Weave Scope [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.html_title%3A+%22Weave+Scope%22+and+services.http.response.body%3D%22%2AWEAVEWORKS_CSRF%2A%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title: "Weave Scope" and services.http.response.body="*WEAVEWORKS_CSRF*")

参考

https://www.weave.works/oss/scope/

Coolify 🔎 →```dsl

services: (port: 8000 and services.http.response.html_title: "Coolify")

<details>
    <summary markdown="span">参考文献</summary>

- <https://coolify.io/>

</details>

### 游戏服务器

#### 反恐精英游戏服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28banner%3A+%22Counter-Strike%22+and+service_name%3A+VALVE%29&ref=awesome-censys-queries)```dsl
same_service(banner: "Counter-Strike" and service_name: VALVE)

FiveM 🔎 →```dsl

services: (port: 30120 and http.response.headers: (key: "Location" and value.headers: "https://cfx.re/join/*"))

#### Minecraft 服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.service_name%3A+%22MINECRAFT%22&ref=awesome-censys-queries)```dsl
services.service_name: "MINECRAFT"

媒体服务器

Plex 媒体服务器 🔎 →```dsl

services.software.vendor: "Plex"

<details>
    <summary markdown="span">参考</summary>

- <https://plex.tv/>

</details>

#### Jellyfin 媒体服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.software.vendor%3A+%22Jellyfin%22&ref=awesome-censys-queries)```dsl
services.software.vendor: "Jellyfin"

参考

https://jellyfin.org/

MythWeb 🔎 →```dsl

services.http.request.uri: "mythweb"

<details>
    <summary markdown="span">截图</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/2c62848ce0155935c4376cbc52d52b6a8c88cb89bfa41b2536bb61ff4fc28d62.png" alt="mythweb" width="500px" />
</details>

<details>
    <summary markdown="span">参考</summary>

- <https://github.com/MythTV/mythweb>

</details>

### 随机服务

#### 发射GNSS载荷的主机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.banner%3A+%22%24GPRMC%22&ref=awesome-censys-queries)```dsl
services.banner: "$GPRMC"

目录列表 🔎 →```dsl

services.http.response.html_title: "Index of /"

#### Swagger UI [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.html_title%3A+%22Swagger+UI+-+%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "Swagger UI - "

截图

参考资料

https://swagger.io/tools/swagger-ui/

Mongo Express Admin Interface 🔎 →```dsl

services.http.response.html_title: "Home - Mongo Express"

<details>
    <summary markdown="span">参考文献</summary>

- <https://github.com/mongo-express/mongo-express>

</details>

#### shell2http [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=services.http.response.html_title%3A+%22shell2http%22&ref=awesome-censys-queries)```dsl
services.http.response.html_title: "shell2http"

Busybox 外壳 🔎 →```dsl

same_service(services.banner: "Enter 'help' for a list of built-in commands" and services.service_name: TELNET) and services.truncated: false

<details>
    <summary markdown="span">截图</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/62eda0f6198b7d4489c3841d75de5d287314e70f10f623433bfaa887095b67fa.png" alt="busybox" width="500px" />
</details>

#### 未认证的 Redis 服务器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.redis.ping_response%3A+%22PONG%22&ref=awesome-censys-queries)```dsl
services.redis.ping_response: "PONG"

配置错误的 Kubernetes 安装 🔎 →```dsl

services.kubernetes.pod_names: *

#### 配置错误的 WordPress [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.http.response.body%3A+%22The+wp-config.php+creation+script+uses+this+file%22&ref=awesome-censys-queries)```dsl
services.http.response.body: "The wp-config.php creation script uses this file"

未配置的 AdGuard 🔎 →```dsl

same_service(services.http.response.html_title: "Setup AdGuard Home" and services.http.request.uri="*/install.html")

<details>
    <summary markdown="span">参考文献</summary>

- <https://adguard.com/en/welcome.html>

</details>

#### Prometheus 节点导出器 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.http.response.html_title%3A+%22node+exporter%22+and+services.http.response.body%3A+%22%2Fmetrics%22%29&ref=awesome-censys-queries)```dsl
same_service(services.http.response.html_title: "node exporter" and services.http.response.body: "/metrics")

VictoriaMetrics Agent 🔎 →```dsl

services.http.response.body: "

vmagent

<details>
    <summary markdown="span">截图</summary>
    <img src="https://assets.kitploit.com/production/public/readmes/5584/bcd1d7facddeb395e6703caf5044ee11f4ab2c6c8c40a4e6b902db273d2580a8.png" alt="vmagent" width="500px" />
</details>

<details>
    <summary markdown="span">参考资料</summary>

- <https://docs.victoriametrics.com/vmagent.html>

</details>

#### SonarQube [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28http.response.html_title%3A+%22SonarQube%22+and+http.response.status_code%3A+200+and+http.response.protocol%3A+%22HTTP%2F1.1%22%29&ref=awesome-censys-queries)```dsl
same_service(http.response.html_title: "SonarQube" and http.response.status_code: 200 and http.response.protocol: "HTTP/1.1")

参考资料

https://www.sonarqube.org/

高级查询

IPv6 主机 🔎 →```dsl

ip:"2001::/3"

#### 蜜罐主机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=services.truncated%3A+true&ref=awesome-censys-queries)```dsl
services.truncated: true

朝鲜主机 🔎 →```dsl

location.country: "North Korea"

#### 识别为美国政府或军事的主机 [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=dns.names%3A+%2A.gov+or+dns.names%3A+%2A.mil+or+name%3A+%2A.gov+or+name%3A+%2A.mil&ref=awesome-censys-queries)```dsl
dns.names: *.gov or dns.names: *.mil or name: *.gov or name: *.mil

监听53端口但不是DNS的服务 🔎 →```dsl

same_service(services.port: 53 and not services.service_name: DNS) and services.truncated: false

> 在 `same_service` 函数内部不使用 `services.` 前缀的替代语法：
> ```dsl
same_service(port: 53 and not service_name: DNS) and services.truncated: false```

#### Non-Standard Services Listening on Common Ports [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.port%3A+%7B21%2C+22%2C+80%7D+and+not+services.service_name%3A+%7BHTTP%2C+SSH%2C+FTP%2C+UNKNOWN%7D%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
same_service(services.port: {21, 22, 80} and not services.service_name: {HTTP, SSH, FTP, UNKNOWN}) and services.truncated: false```

#### Services Listening on Port 22 that are not SSH [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=same_service%28services.port%3A+22+and+not+services.service_name%3A+%7BSSH%7D+and+not+services.banner%3A+%7B%22Connection+refused%22%2C+%22SSH-%22%2C+%22Exceeded+MaxStartups%22%2C+%22Too+many+users%22%2C+%22Connection+closed+by+server%22%7D%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
same_service(services.port: 22 and not services.service_name: {SSH} and not services.banner: {"Connection refused", "SSH-", "Exceeded MaxStartups", "Too many users", "Connection closed by server"}) and services.truncated: false```

#### Services Listening on 80 or 443 that are not HTTP or HTTPS (or UNKNOWN with TLS) [🔎 &#x2192;](https://search.censys.io/search?resource=hosts&q=not+same_service%28services.port%3A+443+and+services.name%3A+UNKNOWN+and+services.tls.certificates.leaf_data.subject_dn%3A+%2A%29+and+same_service%28services.port%3A+%7B80%2C+443%7D+and+not+services.service_name%3A+%7BKUBERNETES%2C+ANYCONNECT%2C+OPENVPN%2C+HTTP%7D+and+not+services.banner%3A+%22HTTP%2F%22%29+and+services.truncated%3A+false&ref=awesome-censys-queries)

```dsl
not same_service(services.port: 443 and services.name: UNKNOWN and services.tls.certificates.leaf_data.subject_dn: *) and same_service(services.port: {80, 443} and not services.service_name: {KUBERNETES, ANYCONNECT, OPENVPN, HTTP} and not services.banner: "HTTP/") and services.truncated: false```

## Credits

- [jakejarvis/awesome-shodan-queries](https://github.com/jakejarvis/awesome-shodan-queries)
- [woj-ciech/Kamerka-GUI](https://github.com/woj-ciech/Kamerka-GUI)
- [salesforce/jarm](https://github.com/salesforce/jarm)
- [cedowens/C2-JARM](https://github.com/cedowens/C2-JARM)
- [emilyaustin/censys-resources](https://github.com/emilyaustin/censys-resources)
- [drb-ra](https://github.com/drb-ra)
- [The State of SSL/TLS Certificate Usage in Malware C&C Communications](https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf)
- [Hunting C2 - Michael Koczwara](https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f)

## License

[![CC0](http://mirrors.creativecommons.org/presskit/buttons/88x31/svg/cc-zero.svg)](https://creativecommons.org/publicdomain/zero/1.0/)

## Star History

[![Star History Chart](https://api.star-history.com/svg?repos=thehappydinoa/awesome-censys-queries&type=Date)](https://star-history.com/#thehappydinoa/awesome-censys-queries&Date)

awesome-censys-queries

最受欢迎

Awesome Censys Queries

贡献

资源

图例

目录

工业控制系统

工业控制系统协议 🔎 →```dsl

加油站油泵控制器 (ATG) 🔎 →```dsl

Carel PlantVisor 🔎 →```dsl

GaugeTech 电力仪表 🔎 →```dsl

Nordex 风力发电场 🔎 →```dsl

物联网设备

Roombas 🔎 →```dsl

WinAQMS 环境监测器 🔎 →```dsl

Brightsign 数字标牌 🔎 →```dsl

Nethix 无线控制器 🔎 →```dsl

安全应用

Cobalt Strike 服务器 🔎 →```dsl

Nessus Scanner Servers 🔎 →```dsl

Merlin C2 🔎 →```dsl

Deimos C2 🔎 →```dsl

PoshC2 🔎 →```dsl

EvilGinx2 🔎 →```dsl

Empire C2 🔎 →```dsl

NimPlant C2 🔎 →```dsl

AsyncRAT 🔎 →```dsl

OrcusRAT 🔎 →```dsl

NanoCore 🔎 →```dsl

Deimos C2 🔎 →```dsl

IcedID 银行木马 🔎 →```dsl

Pupy RAT C2 🔎 →```dsl

Titan Stealer C2 🔎 →```dsl

Splunk 🔎 →```dsl

仪表盘

cAdvisor 仪表盘 🔎 →```dsl

Netdata 仪表板 🔎 →```dsl

Traefik 仪表盘 🔎 →```dsl

Coolify 🔎 →```dsl

FiveM 🔎 →```dsl

媒体服务器

Plex 媒体服务器 🔎 →```dsl

MythWeb 🔎 →```dsl

目录列表 🔎 →```dsl

Mongo Express Admin Interface 🔎 →```dsl

Busybox 外壳 🔎 →```dsl

配置错误的 Kubernetes 安装 🔎 →```dsl

未配置的 AdGuard 🔎 →```dsl

VictoriaMetrics Agent 🔎 →```dsl

vmagent

高级查询

IPv6 主机 🔎 →```dsl

朝鲜主机 🔎 →```dsl

监听53端口但不是DNS的服务 🔎 →```dsl