Contents x
      Working with Web Scanner query results
      • 16 Feb 2024
      • 2 Minutes to read
      • Print
      • Dark
        Light
      Contents

      Working with Web Scanner query results

      • Updated on 16 Feb 2024
      • 2 Minutes to read
      • Print
      • Dark
        Light
      Article Summary

      Results from scans run using either the Command Line or Constructor appear in a collapsible Results table.

      The default columns shown for all queries are:

      1. Domain - The final domain that a scanned URL resolved to
      2. IP - The final IP that a scanned URL resolved to
      3. Favicon Murmur 3 - Favicon Murmur 3 hash of the final domain
      4. HTML Body SSDeep - HTML Body SSDeep of the final domain
      5. HTML Title - HTML Title SSDeep of the final domain
      6. Response - The HTML repsonse code received from the webserver
      7. Scan Date - Timestamp of when a scan was performed
      8. SSL SHA1 - SHA1 fingerprint of the domain's SSL certificate
      9. SSL Subject Common Name - Common name of the domain's SSL subject (e.g. DigiCert)
      10. URL - The final URL that was scanned
      11. Origin URL - The first URL that was scanned

      Expanding on results and adding data to a query

      Individual search results can be expanded upon from within the results table, providing additional Field name data that can be added to the current query using an Operator:

      1. Execute a query and obtain a set of results

      2. Click Expand on the far right

      3. You'll now see a list of Field Names for the expanded result

      4. To add any of the expanded Field names to your current query, left click any text that's colored blue and chose the relevant Operator

      5. The chosen Field name is added to the end of your query, which can be re-run with the new parameters

      Including or excluding data from results

      Results tables can be modified to only display certain data types:

      1. Click the vertical line icon next to Basic Raw Data
        Screenshot 2024-02-02 at 12.31.20.png

      2. Use the checkboxes to include or exclude certain Field name data

      Copying, exporting, and viewing raw data

      Outputted data can be utilised in a number of ways, using the buttons on the top left of the Results table:

      Screenshot 2024-02-02 at 13.03.57.png

      1. Click Copy to copy all visible results to the clipboard, or use the checkboxes to copy selected results

      2. Click the Download icon to export visible or selected results either as a CSV or JSON

      3. Click Basic Raw Data to view the raw data behind all results, and copy the data to the clipboard

      Enriching and pivoting on domains and IPs

      Web Scanner domain and IP results can be pivoted on or enriched, with one-click from within the Results table:

      1. Wherever you see a blue domain or IP in the results table, left-click to bring up the contextual menu:

      Screenshot 2024-02-02 at 13.24.43.png

      1. Click the radial button next to a Query (forward) or Answer (reverse) lookup type and click Lookup PADNS to perform a pivot in a new tab
      2. Click the Enrich button to open an Enrichment page for your chosen domain or URL in a new tab
      Was this article helpful?
      What's Next