Contents x
      Data sources
      • 25 Mar 2024
      • 1 Minute to read
      • Print
      • Dark
        Light
      Contents

      Data sources

      • Updated on 25 Mar 2024
      • 1 Minute to read
      • Print
      • Dark
        Light
      Article Summary

      Scanned data is grouped into 6 separate repositories, known as a data source.

      The datasource field name is used to target different data sources in Web Scanner queries.

      Each data source has a set of field names that you can use to search within it.

      Click here to see a list of field names available per data source.

      Available data sources

      Field nameContents
      webscanWeb data on the public IPv4 and IPv6 ranges
      torscanData from .onion sites
      servicesNon-http services, e.g. SSH/DNS, includes TLS/SSL certificate data
      opendirectoryData gathered from open directories
      webscanhistoryLog of successfull scanning attempts
      webscanfailureLog of failed scanning attempts

      Web Scanner query examples

      When using data sources in Web Scanner command line or constructor queries, the data source is treated as a standard input field.

      Example 1

      domain = crypto* AND datasource = torscan

      This query searches the torscan data source for any .onion domains that include the string "crypto"

      Example 2

      ssl.expire = true AND datasource = services

      This query returns all expired SSL certificates scanned on the public IPv4 range

      Querying multiple data sources

      Some field names are applicable towards more than one data source (e.g. the domain field).

      You can search across multiple data sources within the same query by specifying the data sources in square brackets, separated by a comma. This works as a de facto OR separator.

      Example

      domain = "payments* AND datasource = [webscan, torscan]

      Was this article helpful?
      What's Next