Skip to main content

URLScan

URLScan is a comprehensive website scanning and analysis platform that provides detailed security intelligence, threat detection, and web infrastructure reconnaissance capabilities. It functions as an automated website scanner and threat intelligence service that captures, analyzes, and archives web pages to identify malicious content, phishing attempts, suspicious behavior, and security threats.

CategoryThreat intelligence
DirectionQuery source
Sign-inAPI Key
Query languagesSQLite
Tables16
Query templates29
Websiteurlscan.io

Before you start​

Huntbase signs in to URLScan with API Key. Create the credential in URLScan first, then keep it to hand for the Connect step.

  1. Create a user account on urlscan.io through the sign-up page, then log in.
  2. Go to Settings & API and click New API key.
  3. Copy the new API key.
Watch out for
  • Without an API key, requests are subject to the quotas for unauthenticated users.

For the vendor's own instructions, see urlscan.io quickstart guide.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect URLScan​

  1. Go to Connections and click New connection, or click New connection on the URLScan product page.
  2. On Product, pick URLScan and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials​

The only Method is API Key. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
API KeyYesSecret — not shown again after you save it.

Query it​

Once connected, URLScan can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
SQLiteSQL over the 16 tables listed below, alongside every other connected source.

Example: SQLite​

List detected apps — Explore which applications have been detected by analyzing the results of a specific scan.

select
  *
from
  urlscan_app
where
  scan = {{scan_id}};

URLScan ships with 29 query templates. Find them in Library › Queries — see Query templates.

Tables​

URLScan adds 16 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 16 tables
TableContains
urlscan_appApps used by the page.
urlscan_asnAutonomous System Numbers (ASNs) used by requests during the scan.
urlscan_certificateCertificates returned by requests for the page.
urlscan_consoleConsole messages returned while executing the page.
urlscan_cookieCookies set by the page for the scan.
urlscan_document_typeDocument types returned for the page.
urlscan_domainDomains used by requests during the scan.
urlscan_globalGlobal variables set in Javascript for the page.
urlscan_ipIPs used by requests during the scan.
urlscan_linkLinks in the HTML of the page.
urlscan_protocolProtocols used by requests during the scan.
urlscan_requestRequests configured for the account.
urlscan_search
urlscan_serverServers used by requests during the scan.
urlscan_taskDetails of the task that ran the scan.
urlscan_tlsTransport Layer Security (TLS) status for requests during the scan.

Next steps​