Ultimate Censys Cheat Sheet

Samir KC
September 08, 2026


Ultimate Censys Cheat Sheet

Internet-wide scanning and enumeration. Discover hosts, services, certificates, and vulnerabilities at scale.

1. Setup & Configuration

Install and configure Censys tools for reconnaissance.

Install Censys Python Library

pip install censys

Install Censys CLI

pip install censys-cli

Configure API Credentials

censys config

Enter your API ID and Secret when prompted.

Set Environment Variables

export CENSYS_API_ID="your-api-id" export CENSYS_API_SECRET="your-api-secret"

Test Connection

censys account

Configuration Files

  • ~/.censys/censys.cfg : Config file
  • ~/.censys/credentials : API keys
  • ~/.censys/query_history : History

Account Commands

  • censys account : Account info
  • censys config : Configure
  • censys search : Search
  • censys view : View host

3. CLI Usage

Search Hosts

censys search "apache" --pages 5

View Specific Host

censys view 8.8.8.8

Search with Output

censys search "nginx" --output results.json

Search with Fields

censys search "apache" --fields ip,services.port,location.country

Search with Limit

censys search "ssh" --limit 100

Report Generation

censys report "services.port: 443" --field location.country
CommandDescriptionOptions
censys searchSearch index--pages, --limit, --fields
censys viewView host--output, --format
censys reportGenerate report--field, --limit
censys accountAccount info--json
censys configConfiguration--api-id, --api-secret

4. Python Library

Basic Search

#!/usr/bin/env python3 from censys.search import CensysHosts # Initialize client client = CensysHosts() # Search for Apache servers results = client.search("apache", per_page=25) print(f"Total results: {results.total}") for host in results: print(f"IP: {host['ip']}") print(f"Location: {host.get('location', {}).get('country', 'N/A')}") print("---")

Host Lookup

#!/usr/bin/env python3 from censys.search import CensysHosts client = CensysHosts() # Lookup specific host host = client.view("8.8.8.8") print(f"IP: {host['ip']}") print(f"AS: {host.get('autonomous_system', {}).get('name', 'N/A')}") for service in host.get('services', []): print(f"Port: {service['port']}") print(f"Service: {service.get('service_name', 'N/A')}") print(f"Banner: {service.get('banner', 'N/A')}") print("---")

Certificate Search

#!/usr/bin/env python3 from censys.search import CensysCertificates client = CensysCertificates() # Search for certificates results = client.search("parsed.subject.common_name: example.com") print(f"Certificates: {results.total}") for cert in results: print(f"Fingerprint: {cert['fingerprint_sha256']}") print(f"Subject: {cert.get('parsed', {}).get('subject', {})}") print("---")

Bulk Search

#!/usr/bin/env python3 from censys.search import CensysHosts import json client = CensysHosts() # Search with multiple conditions query = "services.port: 443 AND location.country: United States" results = client.search(query, per_page=50) # Export results hosts = [] for host in results: hosts.append({ 'ip': host['ip'], 'ports': [s['port'] for s in host.get('services', [])], 'country': host.get('location', {}).get('country', 'N/A') }) with open('results.json', 'w') as f: json.dump(hosts, f, indent=2)
Pro Tip: API Rate Limits
Free tier: 250 queries/month
Paid tiers: Higher limits
Use per_page parameter to control results
Cache results to avoid repeated queries

5. Certificate Search

Search by Domain

censys search "parsed.subject.common_name: example.com" --index certificates

Search by Organization

censys search "parsed.subject.organization: Example Corp" --index certificates

Search by Issuer

censys search "parsed.issuer.organization: Let's Encrypt" --index certificates

Search Expired Certificates

censys search "parsed.validity.end: [* TO 2024-01-01]" --index certificates

Search by Wildcard

censys search "parsed.subject.common_name: *.example.com" --index certificates

Certificate Fields

  • parsed.subject.common_name
  • parsed.subject.organization
  • parsed.issuer.organization
  • parsed.validity.start
  • parsed.validity.end

Certificate Uses

  • Subdomain enumeration
  • Organization mapping
  • Infrastructure discovery
  • Certificate monitoring
  • Brand protection

6. Automation Scripts

Subdomain Enumeration

#!/bin/bash # subdomain-enum.sh - Find subdomains via certificates DOMAIN=$1 echo "[+] Searching certificates for $DOMAIN..." censys search "parsed.subject.common_name: *.$DOMAIN" --index certificates --fields parsed.subject.common_name | grep "$DOMAIN" | sort -u > subdomains.txt echo "[+] Found $(wc -l < subdomains.txt) subdomains" cat subdomains.txt

Network Range Scanner

#!/bin/bash # network-scan.sh - Scan IP range CIDR=$1 echo "[+] Scanning $CIDR..." censys search "ip: $CIDR" --fields ip,services.port,services.service_name,location.country > network-results.json echo "[+] Results saved to network-results.json" cat network-results.json | jq .

Vulnerability Finder

#!/usr/bin/env python3 # vuln-finder.py - Find vulnerable services from censys.search import CensysHosts client = CensysHosts() vulnerable_software = [ ("Apache", "2.4.49"), ("Apache", "2.4.50"), ("nginx", "1.20.0"), ("OpenSSH", "8.0") ] for vendor, version in vulnerable_software: query = f"services.software.vendor: {vendor} AND services.software.version: {version}" results = client.search(query) print(f"[+] {vendor} {version}: {results.total} hosts") for host in results: print(f" - {host['ip']}")

Certificate Monitor

#!/bin/bash # cert-monitor.sh - Monitor for new certificates DOMAIN=$1 PREVIOUS="certs-previous.txt" CURRENT="certs-current.txt" while true; do censys search "parsed.subject.common_name: *.$DOMAIN" --index certificates --fields parsed.subject.common_name | sort -u > "$CURRENT" if [ -f "$PREVIOUS" ]; then echo "[+] New certificates:" diff "$PREVIOUS" "$CURRENT" | grep "^>" | sed 's/^> //' fi mv "$CURRENT" "$PREVIOUS" sleep 86400 done

Bulk Host Lookup

#!/bin/bash # bulk-lookup.sh - Look up multiple hosts while read -r ip; do echo "[+] Looking up $ip..." censys view "$ip" --output "host-${ip}.json" echo "---" done < ips.txt
Pro Tip: Automation Best Practices

1. Use --fields to limit output size
2. Cache results to avoid API limits
3. Use jq for JSON processing
4. Schedule with cron for monitoring
5. Combine with other tools for complete recon

⇧