Investigate data sources

Prev Next

Scanned data is grouped into 6 separate repositories, known as a data source.:::(Info) (your title goes here)
your content goes here
:::

The datasource field name is used to target different data sources in Web Scanner queries.

Each data source has a set of field names that you can use to search within it.

Click here to see a list of field names available per data source.

Available data sources

Field name

Contents

webscan

Web data on the public IPv4 and IPv6 ranges

torscan

Data from .onion sites

services

Non-http services, e.g. SSH/DNS, includes TLS/SSL certificate data

opendirectory

Data gathered from open directories

webscanhistory

Log of successfull scanning attempts

webscanfailure

Log of failed scanning attempts

Web Scanner query examples

When using data sources in Web Scanner command line or constructor queries, the data source is treated as a standard input field.

Example 1

domain = crypto* AND datasource = torscan

This query searches the torscan data source for any .onion domains that include the string "crypto"

Example 2

ssl.expire = true AND datasource = services

This query returns all expired SSL certificates scanned on the public IPv4 range

Querying multiple data sources

Some field names are applicable towards more than one data source (e.g. the domain field).

You can search across multiple data sources within the same query by specifying the data sources in square brackets, separated by a comma. This works as a de facto OR separator.

Example

domain = "payments* AND datasource = [webscan, torscan]