Lion Cipher Lab
Pivot on adversary infrastructure with Censys
- Threat Intel Analyst
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Attackers rarely burn a single server. They stand up infrastructure in batches — the same deployment script, the same self-signed certificate, the same TLS stack, the same phishing kit copied across a dozen hosts — and reuse it across campaigns. That reuse is a fingerprint. Infrastructure pivoting is the tradecraft of taking ONE known-bad indicator and, from that single thread, pulling out the rest of the cluster: the other hosts that share the same certificate fingerprint, the same JARM, the same favicon hash, the same oddly specific HTTP title. Censys is purpose-built for this because it…
What you'll learn
- infrastructure pivoting
- the Censys Search language
- Hosts search vs Certificates search
- querying by service, port, software, ASN, and geo
- querying HTTP response fields (title, headers, body hash)
- querying TLS certificate fields (subject, issuer, fingerprint, self-signed)
- pivoting on a shared certificate, JARM, or favicon hash to cluster related hosts
- choosing Censys vs Shodan vs GreyNoise for the right question
- the passive-only authorization boundary for OSINT recon
Steps in this lab
- The one rule before you open Censys: read, never touch
- What Censys is — and why it is not Shodan
- Create a free account and orient: Hosts vs Certificates
- The Censys Search language: your basic building blocks
- Pick a SAFE starting indicator (the demo, not a live target)
- The pivot: from one indicator to a cluster of related hosts
- Know the limits: free tier, staleness, and the API as the pro path
- Why pivoting is the habit worth keeping