censys

Query Censys v2 API for internet-facing assets and TLS certificate data.

779|139|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/taracodlabs/aiden --skill censys
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: censys
Source: https://github.com/taracodlabs/aiden/tree/main/skills/censys
Command: npx skills add https://github.com/taracodlabs/aiden --skill censys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Censys lookups help security teams and researchers quickly discover internet-facing assets, services, and TLS data to assess exposure and risk.

Core Features & Use Cases

  • Look up a specific host by IP to see open ports, ASN, country, and services.
  • Search for assets using queries to enumerate hosts within an ASN or country.
  • Inspect TLS certificates to find subject and issuer details, validity, and SANs.

Quick Start

Query a host by IP or search for assets using a simple query like "location.country_code: US" to start asset discovery.

Frequently Asked Questions about censys

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover internet-facing assets and assess public exposure?

You can discover internet-facing assets and assess public exposure by looking up hosts via IP address or searching within a specific ASN and country. This process identifies open ports, running services, and TLS certificate data.

What is TLS certificate investigation for risk mapping?

TLS certificate investigation for risk mapping involves inspecting certificate details like subject, issuer, validity periods, and SANs. This helps identify expired or misconfigured certificates across exposed internet assets.

Do I need API credentials to search for exposed hosts?

Yes, you need API credentials to search for exposed hosts. You must provide a CENSYS_API_ID and CENSYS_API_SECRET for authentication with the Censys v2 API using HTTP Basic.

How do I enumerate hosts within a specific country or ASN?

To enumerate hosts within a specific country or ASN, you run asset discovery queries like "location.country_code: US". This scoped search returns matching internet-facing hosts and their services.

Can I look up open ports and services for a specific IP address?

Yes, you can look up open ports and services for a specific IP address. Querying a host by IP returns its open ports, ASN, country, and actively running services.