Command-line interface to the Censys internet asset search engine for discovering exposed devices, certificates, and services across the global internet.
censys {search} {flags} 📎 search 📎 flags censys {search} {flags}Sandbox: execFile · Timeout: 60s
security.intel.osint security.recon.passive network.discovery.host security.fingerprint.service network.discovery.certificate | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
search | string | No | - | Search query for hosts, certificates, or services | search |
flag-i | string | No | - | Query by IP address | -i, --ip |
flag-a | boolean | No | - | Query by Autonomous System Number | -a, --asn |
flag-d | string | No | - | Query by domain name | -d, --domain |
flag-c | string | No | - | Query by certificate SHA-256 fingerprint | -c, --certificate |
flag-O | string | No | - | Output file for results | -O, --output |
flag-j | boolean | No | - | Output in JSON format | -j, --json |
flag-h | boolean | No | - | Show help message | -h, --help |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.intel.search.query | Censys search results | application/json | - | verified |
security.intel.shodan.host | Censys host information | application/json | - | verified |
Inputs
security.intel.search.query Censys search query
network.target.ip IP address to query
Outputs
security.intel.search.query Search result data
network.scan.json Host and port information
network_trafficnetwork_traffic Produces
security.intel.search.querynetwork.scan.jsonConsumes
security.intel.search.querynetwork.target.ip| Resource | Value |
|---|---|
| CPU | low |
| Memory | 64 MB |
| Network | medium |
| Disk I/O | low |
Search for exposed SSH servers
censys search "services.service_name: SSH"Lookup IP address information
censys view 8.8.8.8Search for certificates for a domain
censys search "names: example.com" --index certificatesExport results as JSON
censys search "services.port: 443" --output results.jsonCensys provides a command-line interface to query the Censys internet intelligence platform for discovering exposed devices, open ports, services, and TLS certificates across the public internet. It can be used for attack surface management, asset discovery, and reconnaissance.
| Pattern | Description |
|---|---|
services.service_name: SSH |
Find SSH servers |
services.port: 443 |
Find HTTPS services |
names: example.com |
Search by domain |
location.country: Japan |
Filter by country |
labels: {cdn,cloud} |
Filter by infrastructure |
# Search for exposed databases
censys search "services.service_name: MongoDB"
# Search for all services on a specific IP
censys view 198.51.100.1
# Search for certificates by organization
censys search "organization: Example" --index certificates
# Search with geographic filter
censys search "services.service_name: RDP AND location.country: US"
# Output as JSON
censys search "services.port: 22" --json
# Batch query multiple IPs
cat ips.txt | xargs -I{} censys view {} > results.json