msf > use auxiliary/gather/censys_search
msf > set CENSYS_UID XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
msf >set CENSYS_SECRET XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
msf >set CENSYS_DORK rapid7
Certificates Search
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
CENSYS_DORK => rapid7
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE certificates
CENSYS_SEARCHTYPE => certificates
...
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.237.41 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 64.125.235.5 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.237.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.237.40 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.227.12 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.237.38 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 23.48.13.195 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.227.14 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.252.134 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.63 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.242 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.187 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.64 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.181 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.17 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.183 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 54.230.249.186 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=MetasploitSelfSignedCA
[+] 208.118.237.41 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 64.125.235.5 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.237.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.237.40 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.227.12 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.237.38 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 23.48.13.195 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.227.14 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.252.134 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.63 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.242 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.187 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.64 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.181 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.17 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.183 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 54.230.249.186 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 199.15.214.152 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 31.214.157.19 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 31.220.7.39 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 168.253.216.190 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 52.88.1.225 - C=US, ST=TX, L=Austin, O=Rapid7, CN=localhost
[+] 208.118.237.41 - CN=NeXpose Security Console, O=Rapid7
...
IPv4 Search
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
CENSYS_DORK => rapid7
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE ipv4
CENSYS_SEARCHTYPE => ipv4
[*] 197.117.5.36 - 443/https
[*] 208.118.237.81 - 443/https
[*] 206.19.237.19 - 443/https
[*] 54.214.49.70 - 80/http,443/https
[*] 208.118.237.241 - 443/https
[*] 162.220.246.141 - 443/https,22/ssh,80/http
[*] 31.214.157.19 - 443/https,22/ssh
[*] 52.88.1.225 - 443/https,22/ssh
[*] 208.118.227.12 - 25/smtp
[*] 38.107.201.41 - 443/https
[*] 52.44.56.126 - 80/http,443/https
[*] 52.54.227.6 - 443/https,80/http
[*] 23.217.253.242 - 443/https,80/http
[*] 96.6.3.45 - 80/http,443/https
[*] 23.6.73.47 - 443/https,80/http
[*] 23.78.99.243 - 80/http,443/https
[*] 23.53.51.170 - 80/http,443/https
[*] 23.62.201.47 - 443/https,80/http
[*] 2.23.50.157 - 443/https,80/http
[*] 118.215.191.13 - 80/http,443/https
[*] 2.19.185.28 - 80/http,443/https
[*] 2.18.195.99 - 443/https,80/http
[*] 23.197.196.25 - 443/https,80/http
[*] 95.100.104.181 - 443/https,80/http
[*] 2.20.37.130 - 80/http,443/https
[*] 23.194.237.34 - 443/https,80/http
[*] 2.17.140.86 - 443/https,80/http
[*] 64.125.235.5 - 25/smtp
[*] 208.118.227.32 - 80/http
[*] 2.21.129.149 - 80/http,443/https
[*] 2.20.167.33 - 80/http,443/https
[*] 95.100.139.218 - 80/http,443/https
[*] 23.38.88.202 - 443/https,80/http
[*] 2.17.184.80 - 443/https,80/http
[*] 23.59.119.23 - 80/http,443/https
[*] 2.16.14.225 - 443/https,80/http
[*] 104.113.122.33 - 443/https,80/http
[*] 23.223.44.164 - 80/http,443/https
[*] 88.221.120.214 - 443/https,80/http
[*] 23.47.36.145 - 443/https,80/http
[*] 2.23.21.254 - 80/http,443/https
[*] 208.118.237.39 - 443/https
[*] 208.118.237.40 - 443/https
[*] 208.118.237.41 - 443/https
[*] 23.54.217.47 - 80/http,443/https
[*] 96.17.254.188 - 443/https,80/http
[*] 184.25.129.65 - 443/https,80/http
[*] 104.121.167.123 - 443/https,80/http
[*] 104.94.110.63 - 443/https,80/http
[*] 104.91.11.216 - 80/http,443/https
[*] 23.38.233.47 - 80/http,443/https
[*] 52.86.110.89 - 80/http,443/https
[*] 69.192.73.47 - 443/https,80/http
[*] 184.86.57.47 - 443/https,80/http
[*] 104.86.45.180 - 443/https,80/http
[*] 184.87.72.153 - 80/http,443/https
[*] 23.66.25.47 - 80/http,443/https
[*] 23.56.162.76 - 80/http,443/https
[*] 184.87.133.242 - 443/https,80/http
[*] 23.55.74.28 - 80/http,443/https
[*] 23.6.225.84 - 80/http,443/https
[*] 23.46.133.153 - 443/https,80/http
[*] 23.10.121.47 - 443/https,80/http
[*] 104.109.35.169 - 80/http,443/https
[*] 172.227.101.182 - 80/http,443/https
[*] 184.27.23.104 - 80/http,443/https
[*] 23.49.185.47 - 80/http,443/https
[*] 23.67.172.177 - 80/http,443/https
[*] 23.62.170.161 - 443/https,80/http
[*] 23.219.71.35 - 443/https,80/http
[*] 104.82.94.233 - 443/https,80/http
[*] 184.26.73.47 - 80/http,443/https
[*] 104.68.108.237 - 80/http,443/https
[*] 23.60.39.77 - 80/http,443/https
[*] 23.66.100.92 - 80/http,443/https
[*] 23.61.28.182 - 443/https,80/http
[*] 23.42.116.233 - 80/http,443/https
[*] 104.105.14.197 - 80/http,443/https
[*] 104.103.203.240 - 80/http,443/https
[*] 104.65.57.235 - 80/http,443/https
[*] 23.41.83.224 - 80/http,443/https
[*] 184.51.185.47 - 80/http,443/https
[*] 23.67.231.142 - 80/http,443/https
[*] 208.118.237.38 - 443/https
[*] 104.76.25.28 - 80/http,443/https
[*] 23.196.125.176 - 443/https,80/http
[*] 23.40.154.224 - 80/http,443/https
[*] 23.77.33.204 - 443/https,80/http
[*] 104.88.21.48 - 80/http,443/https
[*] 173.223.134.47 - 80/http,443/https
[*] 23.4.98.72 - 80/http,443/https
[*] 23.44.97.3 - 80/http,443/https
[*] 23.203.66.142 - 443/https,80/http
[*] 23.42.216.251 - 443/https,80/http
[*] 23.42.85.25 - 80/http,443/https
[*] 173.255.195.131 - 80/http,23/telnet,25/smtp,110/pop3,53/dns,443/https,22/ssh
[*] 104.83.219.182 - 443/https,80/http
[*] 184.86.41.47 - 443/https,80/http
[*] 104.97.72.196 - 443/https,80/http
[*] 69.192.169.48 - 443/https,80/http
msf auxiliary(censys_search) > services
Services
========
host port proto name state info
2.16.14.225 80 tcp http open
2.16.14.225 443 tcp https open
2.17.140.86 443 tcp https open
2.17.140.86 80 tcp http open
2.17.184.80 443 tcp https open
2.17.184.80 80 tcp http open
2.18.195.99 80 tcp http open
2.18.195.99 443 tcp https open
2.19.185.28 443 tcp https open
2.19.185.28 80 tcp http open
2.20.37.130 443 tcp https open
2.20.37.130 80 tcp http open
2.20.167.33 80 tcp http open
2.20.167.33 443 tcp https open
2.21.129.149 80 tcp http open
2.21.129.149 443 tcp https open
2.23.21.254 80 tcp http open
2.23.21.254 443 tcp https open
2.23.50.157 443 tcp https open
2.23.50.157 80 tcp http open
23.4.98.72 80 tcp http open
23.4.98.72 443 tcp https open
23.6.73.47 443 tcp https open
23.6.73.47 80 tcp http open
23.6.225.84 443 tcp https open
23.6.225.84 80 tcp http open
23.10.121.47 443 tcp https open
23.10.121.47 80 tcp http open
23.38.88.202 443 tcp https open
23.38.88.202 80 tcp http open
23.38.233.47 443 tcp https open
23.38.233.47 80 tcp http open
23.40.154.224 443 tcp https open
23.40.154.224 80 tcp http open
23.41.83.224 80 tcp http open
23.41.83.224 443 tcp https open
23.42.85.25 443 tcp https open
23.42.85.25 80 tcp http open
23.42.116.233 443 tcp https open
23.42.116.233 80 tcp http open
23.42.216.251 443 tcp https open
23.42.216.251 80 tcp http open
23.44.97.3 80 tcp http open
23.44.97.3 443 tcp https open
23.45.101.35 80 tcp http open
23.45.101.35 443 tcp https open
23.46.133.153 443 tcp https open
23.46.133.153 80 tcp http open
23.47.36.145 443 tcp https open
23.47.36.145 80 tcp http open
23.53.51.170 80 tcp http open
23.53.51.170 443 tcp https open
23.54.217.47 80 tcp http open
23.54.217.47 443 tcp https open
23.55.74.28 443 tcp https open
23.55.74.28 80 tcp http open
23.56.162.76 80 tcp http open
23.56.162.76 443 tcp https open
23.59.119.23 443 tcp https open
23.59.119.23 80 tcp http open
23.61.28.182 443 tcp https open
23.61.28.182 80 tcp http open
23.62.201.47 443 tcp https open
23.62.201.47 80 tcp http open
23.63.237.184 80 tcp http open
23.63.237.184 443 tcp https open
23.66.25.47 80 tcp http open
23.66.25.47 443 tcp https open
23.66.100.92 80 tcp http open
23.66.100.92 443 tcp https open
23.67.172.177 80 tcp http open
23.67.172.177 443 tcp https open
23.67.231.142 443 tcp https open
23.67.231.142 80 tcp http open
23.75.116.108 80 tcp http open
23.75.116.108 443 tcp https open
23.77.33.204 80 tcp http open
23.77.33.204 443 tcp https open
23.78.99.243 80 tcp http open
23.78.99.243 443 tcp https open
23.194.237.34 80 tcp http open
23.194.237.34 443 tcp https open
23.196.125.176 80 tcp http open
23.196.125.176 443 tcp https open
23.197.196.25 80 tcp http open
23.197.196.25 443 tcp https open
23.197.229.245 443 tcp https open
23.197.229.245 80 tcp http open
23.201.104.51 443 tcp https open
23.201.104.51 80 tcp http open
23.203.66.142 443 tcp https open
23.203.66.142 80 tcp http open
23.217.253.242 80 tcp http open
23.217.253.242 443 tcp https open
23.219.71.35 80 tcp http open
23.219.71.35 443 tcp https open
23.223.44.164 80 tcp http open
23.223.44.164 443 tcp https open
31.214.157.19 22 tcp ssh open
31.214.157.19 443 tcp https open
38.107.201.41 443 tcp https open
52.86.110.89 80 tcp http open
52.86.110.89 443 tcp https open
52.88.1.225 22 tcp ssh open
52.88.1.225 443 tcp https open
54.214.49.70 80 tcp http open
54.214.49.70 443 tcp https open
64.125.235.5 25 tcp smtp open
69.192.73.47 443 tcp https open
69.192.73.47 80 tcp http open
72.246.186.130 80 tcp http open
72.246.186.130 443 tcp https open
88.221.120.214 443 tcp https open
88.221.120.214 80 tcp http open
95.100.104.181 443 tcp https open
95.100.104.181 80 tcp http open
95.100.139.218 80 tcp http open
95.100.139.218 443 tcp https open
96.6.3.45 443 tcp https open
96.6.3.45 80 tcp http open
96.17.254.188 80 tcp http open
96.17.254.188 443 tcp https open
104.65.57.235 443 tcp https open
104.65.57.235 80 tcp http open
104.74.51.159 443 tcp https open
104.74.51.159 80 tcp http open
104.76.25.28 80 tcp http open
104.76.25.28 443 tcp https open
104.79.44.30 443 tcp https open
104.79.44.30 80 tcp http open
104.86.45.180 80 tcp http open
104.86.45.180 443 tcp https open
104.88.21.48 80 tcp http open
104.88.21.48 443 tcp https open
104.90.11.123 80 tcp http open
104.90.11.123 443 tcp https open
104.91.11.216 80 tcp http open
104.91.11.216 443 tcp https open
104.94.110.63 80 tcp http open
104.94.110.63 443 tcp https open
104.103.203.240 80 tcp http open
104.103.203.240 443 tcp https open
104.105.14.197 80 tcp http open
104.105.14.197 443 tcp https open
104.107.28.79 443 tcp https open
104.107.28.79 80 tcp http open
104.109.35.169 80 tcp http open
104.109.35.169 443 tcp https open
104.113.122.33 443 tcp https open
104.113.122.33 80 tcp http open
104.121.167.123 80 tcp http open
104.121.167.123 443 tcp https open
118.214.102.101 443 tcp https open
118.214.102.101 80 tcp http open
118.215.191.13 80 tcp http open
118.215.191.13 443 tcp https open
162.220.246.141 22 tcp ssh open
162.220.246.141 80 tcp http open
162.220.246.141 443 tcp https open
173.223.134.47 443 tcp https open
173.223.134.47 80 tcp http open
184.25.81.132 80 tcp http open
184.25.81.132 443 tcp https open
184.25.129.65 80 tcp http open
184.25.129.65 443 tcp https open
184.26.73.47 443 tcp https open
184.26.73.47 80 tcp http open
184.27.23.104 443 tcp https open
184.27.23.104 80 tcp http open
184.27.134.182 80 tcp http open
184.27.134.182 443 tcp https open
184.51.185.47 80 tcp http open
184.51.185.47 443 tcp https open
184.86.57.47 80 tcp http open
184.86.57.47 443 tcp https open
184.87.72.153 80 tcp http open
184.87.72.153 443 tcp https open
184.87.133.242 443 tcp https open
184.87.133.242 80 tcp http open
197.117.5.36 443 tcp https open
206.19.237.19 443 tcp https open
208.118.227.12 25 tcp smtp open
208.118.227.32 80 tcp http open
208.118.237.38 443 tcp https open
208.118.237.39 443 tcp https open
208.118.237.40 443 tcp https open
208.118.237.41 443 tcp https open
208.118.237.81 443 tcp https open
208.118.237.241 443 tcp https open
Websites Search
msf auxiliary(censys_search) > set CENSYS_DORK rapid7
CENSYS_DORK => rapid7
msf auxiliary(censys_search) > set CENSYS_SEARCHTYPE websites
CENSYS_SEARCHTYPE => websites
msf auxiliary(censys_search) > run
[+] rapid7.com - [37743]
[+] logentries.com - [45346]
[+] venturefizz.com - [106102]
[+] gild.com - [116853]
[+] sectools.org - [122125]
[+] ericzhang.me - [155622]
[+] metasploit.com - [156435]
[+] datapipe.com - [209756]
[+] routerpwn.com - [317896]
[+] proxy-base.com - [507954]
[+] config.fr - [542346]
[+] winterwyman.com - [629471]
[+] gogrid.com - [741009]
[+] wesecure.nl - [997423]
[*] Auxiliary module execution completed
References
https://censys.io/api
