Work with Web Scanner query results

  • Updated on Jul 10, 2024
  • Published on Feb 8, 2024
  • 2 minute(s) read

Results from scans run using either the Command Line or Constructor appear in a collapsible Results table.

The default columns shown for all queries are:

  1. Domain - The final domain that a scanned URL resolved to
  2. IP - The final IP that a scanned URL resolved to
  3. Favicon Murmur 3 - Favicon Murmur 3 hash of the final domain
  4. HTML Body SSDeep - HTML Body SSDeep of the final domain
  5. HTML Title - HTML Title SSDeep of the final domain
  6. Response - The HTML repsonse code received from the webserver
  7. Scan Date - Timestamp of when a scan was performed
  8. SSL SHA1 - SHA1 fingerprint of the domain's SSL certificate
  9. SSL Subject Common Name - Common name of the domain's SSL subject (e.g. DigiCert)
  10. URL - The final URL that was scanned
  11. Origin URL - The first URL that was scanned

Expanding on results and adding data to a query

Individual search results can be expanded upon from within the results table, providing additional Field name data that can be added to the current query using an Operator:

  1. Execute a query and obtain a set of results

  2. Click Expand on the far right

  3. You'll now see a list of Field Names for the expanded result

  4. To add any of the expanded Field names to your current query, left click any text that's colored blue and chose the relevant Operator

  5. The chosen Field name is added to the end of your query, which can be re-run with the new parameters

Including or excluding data from results

Results tables can be modified to only display certain data types:

  1. Click the vertical line icon next to Basic Raw Data
    Screenshot 2024-02-02 at 12.31.20.png

  2. Use the checkboxes to include or exclude certain Field name data

Copying, exporting, and viewing raw data

Outputted data can be utilised in a number of ways, using the buttons on the top left of the Results table:

Screenshot 2024-02-02 at 13.03.57.png

  1. Click Copy to copy all visible results to the clipboard, or use the checkboxes to copy selected results

  2. Click the Download icon to export visible or selected results either as a CSV or JSON

  3. Click Basic Raw Data to view the raw data behind all results, and copy the data to the clipboard

Enriching and pivoting on domains and IPs

Web Scanner domain and IP results can be pivoted on or enriched, with one-click from within the Results table:

  1. Wherever you see a blue domain or IP in the results table, left-click to bring up the contextual menu:

Screenshot 2024-02-02 at 13.24.43.png

  1. Click the radial button next to a Query (forward) or Answer (reverse) lookup type and click Lookup PADNS to perform a pivot in a new tab
  2. Click the Enrich button to open an Enrichment page for your chosen domain or URL in a new tab

Adding results to a feed

Web Scanner results can be added to a feed or collection, or used to create a new feed.

  1. Left-click your chosen domain or IP from the results set
  2. Select `Add to Feed/Collection'
  3. Select Existing or New