Netlas

https://docs.netlas.io
Admin
Netlas is an internet-wide scanning and data collection platform providing comprehensive IP/domain...
Tokens:99,240
Snippets:1,207
Trust Score:8.8
Update:4 months ago
Show doc for...
Tokens:
Raw
### Get Product Response Example

Source: https://docs.netlas.io/api-reference

Example JSON response for retrieving a specific product's details.

```json
{
  "id": 115,
  "description": "Known domain names with A, MX, NS, CNAME and TXT records.",
  "datasets": [
    {
      "id": 351,
      "product_id": 115,
      "name": "fdns",
      "pretty_name": "Forward DNS (fDNS)"
}
],
  "name": "fdns",
  "pretty_name": "Forward DNS (fDNS)"

}
```

--------------------------------

### Get Dataset Link Response Example

Source: https://docs.netlas.io/api-reference

Example JSON response for the get_dataset_link endpoint, showing available download links for a product.

```json
[
  {
    "pretty_name": "Known PTR records (rDNS)",
    "name": "known_ptr_records",
    "links": [
      {
        "ext": "json",
        "link": "https://app.netlas.io/storage/known_ptr_records/known_ptr_records.json.zip"
}
]
}

]
```

--------------------------------

### Raw Strings Example 3

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of product version strings extracted from raw response.

```text
ActiveMQ ProviderVersion 6.1.6
```

--------------------------------

### AMQP Platform Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of the platform on which an AMQP broker is running, such as Erlang/OTP or Crystal.

```text
Erlang/OTP 23.2.6
```

--------------------------------

### VNC Length Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of the length in bytes of VNC banner and handshake data.

```text
12
```

```text
24
```

--------------------------------

### AMQP Product Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of the name of the AMQP message broker software, such as RabbitMQ or LavinMQ.

```text
RabbitMQ
```

--------------------------------

### Get User Profile Response Example

Source: https://docs.netlas.io/api-reference

Example JSON response for the get user profile endpoint, detailing user account information, API keys, and plan details.

```json
{
  "api_key": {
    "customer_api_key": "eXamPleAPIKey",
    "next_time_coins_will_be_updated": "2019-08-24"
},
  "email": "user@example.com",
  "first_name": "string",
  "last_name": "string",
  "account_category": "company",
  "occupation": "string",
  "occupation_details": "string",
  "is_welcome_tour_passed": true,
  "plan": { },
  "plan_active_until": "2019-08-24",
  "next_plan": { },
  "is_next_plan_paid": true,
  "next_plan_paid_period": "string",
  "referral_code": "string",
  "bonuses": 0,
  "notifications": [
    0
],
  "teams": [
    {
      "name": "netlas-team"
}
],
  "is_recurring": true,
  "is_authenticated_via_social": true,
  "referral_link_usage_amount": 0,
  "profession": "string",
  "usage_purpose": "string"

}
```

--------------------------------

### VNC Version Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of parsed VNC version numbers extracted from the banner field.

```text
3.3
```

```text
3.8
```

--------------------------------

### Query Certificates Starting After a Specific Date

Source: https://docs.netlas.io/knowledge-base/field-reference/certs

Search for certificates that become valid after a given date. This example finds certificates with a start date after January 1st, 2023.

```text
certificate.validity.start:>2023-01-01
```

--------------------------------

### Forward DNS Product Response Example

Source: https://docs.netlas.io/api-reference

Example JSON response for the Forward DNS product, detailing its ID, description, and associated datasets.

```json
[
  {
    "id": 115,
    "description": "Known domain names with A, MX, NS, CNAME and TXT records.",
    "datasets": [
      {
        "id": 351,
        "product_id": 115,
        "name": "fdns",
        "pretty_name": "Forward DNS (fDNS)"
}
],
    "name": "fdns",
    "pretty_name": "Forward DNS (fDNS)"
}

]
```

--------------------------------

### Raw Suggested Protocol Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of heuristically identified protocols from raw responses.

```text
http
```

```text
ftp
```

```text
ssh
```

```text
smtp
```

```text
imap
```

--------------------------------

### Netlas Python SDK Installation

Source: https://docs.netlas.io/api-reference

Instructions for installing the Netlas Python SDK using pip.

```APIDOC
## Netlas Python SDK Installation

### Description
Install the Netlas Python SDK for programmatic interaction with the Netlas API.

### Method
Installation command

### Endpoint
N/A

### Parameters
N/A

### Request Example
```bash
pip install netlas
```

### Response
N/A
```

--------------------------------

### Netlas CLI Tool Installation

Source: https://docs.netlas.io/api-reference

Instructions for installing the Netlas CLI tool using Homebrew or pipx.

```APIDOC
## Netlas CLI Tool Installation

### Description
Install the Netlas CLI tool for command-line interaction with the Netlas API.

### Method
Installation commands

### Endpoint
N/A

### Parameters
N/A

### Request Example
**Using Homebrew:**
```bash
brew tap netlas-io/netlas 
brew install netlas
```

**Using pipx:**
```bash
pipx install netlas
```

### Response
N/A
```

--------------------------------

### VNC Banner Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of protocol version banners sent by VNC servers.

```text
RFB 003.003

```

```text
RFB 003.008

```

--------------------------------

### Raw Strings Example 4

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of contact email and domain extracted from raw response.

```text
... support.fortinet.com ... support@fortinet.com
```

--------------------------------

### Timestamp Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of document indexing timestamps.

```text
2023-01-01T12:00:00Z
```

```text
2024-10-15T08:30:00Z
```

--------------------------------

### PostgreSQL Supported Versions Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a PostgreSQL server response advertising supported protocol versions when probed with an invalid version.

```text
FATAL: unsupported frontend protocol 0.0: server supports 1.0 to 3.0
```

```text
FATAL: フロントエンドプロトコル0.0をサポートしていません: サーバは1.0から 3.0までをサポートします
```

```text
ВАЖНО: неподдерживаемый протокол клиентского приложения 0.0; сервер поддерживает 2.0 - 3.0
```

--------------------------------

### AMQP Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a raw, unparsed banner string returned by an AMQP server. This includes product, version, and platform details.

```text
Product: RabbitMQ
Version: 3.8.14
Platform: Erlang/OTP 26.2.5.9
Capabilities:
authentication_failure_close: true
...
```

--------------------------------

### Query VNC Servers by Version

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example queries to find VNC servers running specific versions.

```kql
vnc.version:3.3

```

```kql
vnc.version:3.8

```

--------------------------------

### Raw Length Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of the raw response length in bytes.

```number
42
```

--------------------------------

### Telnet WILL Option Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of Telnet option names and their numeric values that the server offered to enable itself.

```text
Suppress Go Ahead
Status
Terminal Type
```

```text
3
5
24
```

--------------------------------

### Install Netlas Python SDK

Source: https://docs.netlas.io/api-reference

Install the Netlas Python SDK using pip for Python development.

```bash
pip install netlas
```

--------------------------------

### HTTP Description Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a page description extracted from meta tags.

```text
Joomla!
```

```text
This is a default index page for a new domain.
```

```text
Web site created using create-react-app
```

--------------------------------

### Telnet WONT Option Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of Telnet option names and their numeric values that the server refused to enable.

```text
Binary Transmission
Timing Mark
Authentication Option
```

```text
0
6
16
```

--------------------------------

### Install Netlas CLI via Homebrew

Source: https://docs.netlas.io/api-reference

Install the Netlas CLI tool using Homebrew for command-line interaction.

```bash
brew tap netlas-io/netlas 
brew install netlas
```

--------------------------------

### Telnet Banner Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of raw banner strings returned by Telnet servers, including welcome messages and login prompts.

```text
Welcome Visiting Huawei Home Gateway
Copyright by Huawei Technologies Co., Ltd.

Login:
```

```text
Ubee Interactive Corporation Telnet Server

WARNING: Access allowed by authorized users only.

Login:
```

```text


User Access Verification

Username:
```

--------------------------------

### Raw Strings Example 1

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of printable text fragments extracted from raw response.

```text
Unable to retrieve Info
```

--------------------------------

### SSH User Authentication Query Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Shows how to search for SSH servers that specifically support password authentication.

```text
ssh.userauth:"password"

```

--------------------------------

### Domains Download Response Example

Source: https://docs.netlas.io/api-reference

This is an example of a successful JSON response containing downloaded domain data, including IP addresses and domain names.

```json
[
  {
    "data": {
      "a": [
        "83.235.76.17"
],
      "domain": "idn3241.example.com"
}
},
  {
    "data": {
      "a": [
        "143.244.220.150"
],
      "domain": "skadowskyu.example.com"
}
},
  {
    "data": {
      "a": [
        "212.109.215.174",
        "212.109.215.175"
],
      "domain": "server9.example.com"
}
},
  {
    "data": {
      "a": [
        "83.235.76.17"
],
      "domain": "del1.example.com"
}
},
  {
    "data": {
      "a": [
        "212.109.215.174",
        "212.109.215.175"
],
      "domain": "n.parfionov2017.example.com"
}
}

]
```

--------------------------------

### Query for SMBv1 Support

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example query to find servers that explicitly support the SMBv1 protocol.

```kql
smb.smbv1_support:true

```

--------------------------------

### Raw Strings Example 2

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of error messages extracted from raw response.

```text
ERROR: Invalid password. Unable to add agent
```

--------------------------------

### User Profile Response Example

Source: https://docs.netlas.io/api-reference

This is an example of a successful response when retrieving user profile data. It includes details about API keys, account information, and plan status.

```json
{
  "api_key": {
    "customer_api_key": "eXamPleAPIKey",
    "next_time_coins_will_be_updated": "2019-08-24"
  },
  "email": "user@example.com",
  "first_name": "string",
  "last_name": "string",
  "account_category": "company",
  "occupation": "string",
  "occupation_details": "string",
  "is_welcome_tour_passed": true,
  "plan": { },
  "plan_active_until": "2019-08-24",
  "next_plan": { },
  "is_next_plan_paid": true,
  "next_plan_paid_period": "string",
  "referral_code": "string",
  "bonuses": 0,
  "notifications": [
    0
],
  "teams": [
    {
      "name": "netlas-team"
}
],
  "is_recurring": true,
  "is_authenticated_via_social": true,
  "referral_link_usage_amount": 0,
  "profession": "string",
  "usage_purpose": "string"
}
```

--------------------------------

### Install Netlas CLI via pipx

Source: https://docs.netlas.io/api-reference

Install the Netlas CLI tool using pipx for command-line interaction.

```bash
pipx install netlas
```

--------------------------------

### Facet Search Results Example

Source: https://docs.netlas.io/api-reference

This is an example of a successful response for a facet search, showing aggregations by domain extension.

```json
{
  "aggregations": [
    {
      "key": [
        "com"
],
      "doc_count": 382078579
},
    {
      "key": [
        "net"
],
      "doc_count": 21890693
},
    {
      "key": [
        "org"
],
      "doc_count": 17769023
},
    {
      "key": [
        "top"
],
      "doc_count": 15855678
},
    {
      "key": [
        "tk"
],
      "doc_count": 12662280
}
]

}
```

--------------------------------

### IMAP Strings Query Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of searching IMAP responses using the imap.strings field.

```text
imap.strings:*

```

```text
imap.strings:Dovecot

```

```text
imap.strings:"Error in IMAP command"

```

--------------------------------

### RDP NTLM Tree Name Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a DNS tree name reported during RDP NTLM negotiation.

```text
example.com
```

--------------------------------

### User Counters Response Example

Source: https://docs.netlas.io/api-reference

This is an example of the response when retrieving user profile counters. It details remaining requests, coin balances, and update times.

```json
{
  "requests_left": {
    "remained": -1,
    "limit": -1,
    "will_be_updated": null
},
  "coins": {
    "total_coins_spent": 432221783,
    "left": 99996653,
    "plan_coins_amount": 100000000,
    "next_time_coins_will_be_updated": "2019-08-24"
},
  "scan_coins": {
    "plan_scan_coins_amount": 327680,
    "left": 327680,
    "reserved_coins": 0
}
}
```

--------------------------------

### Software Detection: Postfix Version from Banner

Source: https://docs.netlas.io/knowledge-base/software-and-vulnerabilities

Example of detecting Postfix software by parsing its service banner.

```text
220 mail.example.com ESMTP Postfix → tag.name:postfix
```

--------------------------------

### Telnet DONT Option Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of Telnet option names and their numeric values that the server instructed the client not to enable.

```text
Linemode
Echo
Remote Flow Control
```

```text
34
1
24
```

--------------------------------

### VNC Strings Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of printable text fragments extracted from VNC greetings and handshakes, often containing the RFB protocol version.

```text
RFB 003.008
```

```text
RFB 004.001
```

```text
RFB 005.000
```

--------------------------------

### NTP Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Raw NTP banner string. This includes version, time, and synchronization details.

```text
Version: 3
Time:
wall: 804701375
ext: 63880744839
TimeResponse:
Version: 3
Mode: 4
Stratum: 3
Precision: -23
RootDelay:
Fraction: 4998

```

--------------------------------

### Query by MD5 Fingerprint

Source: https://docs.netlas.io/knowledge-base/field-reference/certs

Example of how to search for a certificate using its MD5 fingerprint.

```query
certificate.fingerprint_md5:c33979ff8bc19a94820d6804b3681881
```

--------------------------------

### IP WHOIS Facet Search Response Example

Source: https://docs.netlas.io/api-reference

Example of a successful response for IP WHOIS facet search, showing aggregations by country.

```json
{
  "aggregations": [
    {
      "key": [
        "US"
],
      "doc_count": 3811776
},
    {
      "key": [
        "IT"
],
      "doc_count": 762034
},
    {
      "key": [
        "GB"
],
      "doc_count": 732744
},
    {
      "key": [
        "JP"
],
      "doc_count": 614086
},
    {
      "key": [
        "FR"
],
      "doc_count": 574712
}
]

}
```

--------------------------------

### Query by SHA-256 Fingerprint

Source: https://docs.netlas.io/knowledge-base/field-reference/certs

Example of how to search for a certificate using its SHA-256 fingerprint.

```query
certificate.fingerprint_sha256:455943cf819425761d1f950263ebf54755d8d684c25535943976f488bc79d23b
```

--------------------------------

### Raw Banner HTTP Response Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a raw HTTP response banner, including status code and headers.

```http
HTTP/1.1 400 Bad Request
Sec-WebSocket-Version: 13

0
```

--------------------------------

### Domain Facet Search Results Example

Source: https://docs.netlas.io/api-reference

An example of the JSON response structure for a domain facet search, showing aggregations by 'zone'.

```json
{
  "aggregations": [
    {
      "key": [
        "com"
      ],
      "doc_count": 377917162
    },
    {
      "key": [
        "net"
      ],
      "doc_count": 21765983
    },
    {
      "key": [
        "org"
      ],
      "doc_count": 19341321
    },
    {
      "key": [
        "xyz"
      ],
      "doc_count": 13838761
    },
    {
      "key": [
        "de"
      ],
      "doc_count": 12480920
    }
  ]
}
```

--------------------------------

### Query for NTLM Support

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example query to find servers supporting NTLM authentication using its specific OID.

```kql
smb.negotiation_log.authentication_types:"1.3.6.1.4.1.311.2.2.10"

```

--------------------------------

### Node Count Response Example

Source: https://docs.netlas.io/api-reference

This is an example response from the node count API, showing aggregations for different search fields related to a domain, such as TXT records, NS servers, and A records.

```json
[
  {
    "aggregations": [
      {
        "search_field": "TXT records for domain",
        "count": 2,
        "preview": [
          "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9",
          "v=spf1 -all"
],
        "search_field_id": 32,
        "is_too_much_docs": false,
        "node_types": {
          "dns_txt": 3
}
},
      {
        "search_field": "NS servers for domain",
        "count": 2,
        "preview": [
          "elliott.ns.cloudflare.com",
          "hera.ns.cloudflare.com"
],
        "search_field_id": 30,
        "is_too_much_docs": false,
        "node_types": {
          "domain": 1
}
},
      {
        "search_field": "A records for domain",
        "count": 16,
        "preview": [
          "8.6.112.0",
          "8.6.112.6",
          "8.6.112.8",
          "8.6.112.10",
          "8.47.69.0"
],
        "search_field_id": 29,
        "is_too_much_docs": false,
        "node_types": {
          "ip": 0
}
}
]
},
  {
    "aggregations": [
      {
        "search_field": "Subdomains",
        "count": 92129,
        "preview": [
          "0.example.com",
          "0.vesta.example.com",
          "000.example.com",
          "0000-forbidden.example.com",
          "0000107.example.com"
],
        "search_field_id": 35,
        "is_too_much_docs": false,
        "node_types": {
          "domain": 1
}
}
]
},
  {
    "aggregations": [
      {
        "search_field": "Hosts with domain in certificate",
        "count": 72056,
        "preview": [
          "34.81.108.244",
          "178.81.31.44",
          "161.97.104.183",
          "130.162.41.25"
],
        "search_field_id": 47,
        "is_too_much_docs": false,
        "node_types": {
          "autodetect": 13
}
}
]
}

]
```

--------------------------------

### Query by SHA-1 Fingerprint

Source: https://docs.netlas.io/knowledge-base/field-reference/certs

Example of how to search for a certificate using its SHA-1 fingerprint.

```query
certificate.fingerprint_sha1:310db7af4b2bc9040c8344701aca08d0c69381e3
```

--------------------------------

### Netlas API Authentication Example

Source: https://docs.netlas.io/api-reference

This example demonstrates how to authenticate with the Netlas API using a Bearer token in the Authorization header. It shows how to export your API key as an environment variable and use it with `curl`.

```APIDOC
## GET /api/host/

### Description
This endpoint is used to retrieve host information. It requires authentication via an API key.

### Method
GET

### Endpoint
https://app.netlas.io/api/host/

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```bash
export NETLAS_API_KEY=put_your_key_here
curl -X 'GET' "https://app.netlas.io/api/host/" \
  -H "Authorization: Bearer $NETLAS_API_KEY"
```

### Response
#### Success Response (200)
Details about the response structure are not provided in the source text.

#### Response Example
No example provided in the source text.
```

--------------------------------

### Example MySQL banner

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

A raw banner string received from a MySQL server during the initial handshake.

```text
ProtocolVersion: 10
ServerVersion: 8.0.19
ConnectionID: 104
CharacterSet: 255
StatusFlags:
SERVER_STATUS_AUTOCOMMIT: true


```

--------------------------------

### Download Domains Request Payload Example

Source: https://docs.netlas.io/api-reference

Example JSON payload for the domains download endpoint. It specifies the search query, number of results, fields to include, and source type.

```json
{
  "q": "domain:*.example.com a:*",
  "size": 100,
  "fields": [
    "a",
    "domain"
],
  "source_type": "include"
}
```

--------------------------------

### NTP Time Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Human-readable server time as returned during the NTP scan.

```date
2025-04-20 11:20:39.804701+00:00
```

--------------------------------

### API Change: Indices Parameter (From v1.4)

Source: https://docs.netlas.io/changelog

This example shows the new format for the 'indices' parameter in API requests starting from version 1.4, using a date label.

```http
https://app.netlas.io/responses/?q=*&indices=2025-10-22
```

--------------------------------

### SSH Strings Query Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Demonstrates how to query SSH services for extracted text, search for specific mentions like 'dropbear', or find advertised key-exchange algorithms.

```text
ssh.strings:*

```

```text
ssh.strings:dropbear

```

```text
ssh.strings:curve25519-sha256

```

--------------------------------

### Wildcard Search within TTEXT Field

Source: https://docs.netlas.io/knowledge-base/query-language

Use wildcards within TTEXT fields to match parts of search terms, not across multiple words. This example matches titles starting with 'word'.

```text
http.title:(word* blog)
```

--------------------------------

### Memcached Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Unparsed plain-text banner returned by the Memcached service.

```text
STAT pid 1
STAT uptime 5214850
STAT time 1742480385
STAT version 1.6.34
STAT libevent 2.1.12-stable
...

```

--------------------------------

### SMB NTLM Support Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Boolean indicating if the server supports NTLM authentication. 'true' suggests legacy configuration.

```text
true
```

--------------------------------

### Raw Banner Generic Error Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a generic raw error banner.

```text
ERROR
ERROR

```

--------------------------------

### Query VNC Services by RFB Version String

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example queries to search for VNC services advertising specific RFB protocol versions.

```kql
vnc.strings:"RFB 003.008"

```

```kql
vnc.strings:"RFB 005.000"

```

--------------------------------

### Raw Banner SMTP Response Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a raw SMTP response banner.

```smtp
220 mail.example.com ESMTP \Postfix (mail)

```

--------------------------------

### HTTP Favicon MD5 Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of an MD5 hash for a favicon certificate.

```text
d41d8cd98f00b204e9800998ecf8427e
```

--------------------------------

### Query for Older SMB Dialects

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example query to find servers supporting older SMB dialects within a specified range.

```kql
smb.negotiation_log.dialect_revision:{0 TO 528}

```

--------------------------------

### SMB Version String Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Human-readable SMB version strings extracted from server responses, useful for display and simple filtering.

```text
SMB 1.0
```

```text
SMB 2.0.2
```

```text
SMB 2.1
```

--------------------------------

### Raw Contacts Email Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of an email address extracted from raw response content.

```email
admin@example.com
```

--------------------------------

### Raw Banner SHA-256 Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a SHA-256 hash for the raw banner field.

```text
a3c1e1a0b3f2396fd0248db515cb95c0d20638b182dd21919d0b234d1cda3dfb
```

--------------------------------

### SMB Negotiation Command Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

SMB2 command identifier from the server's response header. For negotiation responses, this is always 0 (SMB2_NEGOTIATE).

```text
0
```

--------------------------------

### HTTP Favicon Perceptual Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a perceptual hash for a favicon, representing its visual appearance.

```text
187e76c7c3667e18
```

--------------------------------

### HTTP Favicon SHA-256 Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a SHA-256 hash for a favicon, used for exact searching.

```text
92c09ca740b0e18bfe82382f0adcb7a9d4b037fe7cc42f17b9cb2d84a5325124
```

--------------------------------

### HTTP Favicon SHA-256 Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a SHA-256 hash for a favicon, used for exact searching.

```text
92c09ca740b0e18bfe82382f0adcb7a9d4b037fe7cc42f17b9cb2d84a5325124
```

```text
1afd891aacc433e75265e3ddc9cb4fc63b88259977811384426c535037711637
```

```text
b27e55c218d49ccc9399ae6b3302c339a445568411cadaf5d1cadd7e4c99bf74
```

--------------------------------

### SMB Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Raw banner text returned by the SMB service during initial connection. This can provide details about the SMB version and capabilities.

```text
SupportV1: false
Version:
Major: 2
Minor: 1
VerString: SMB 2.1
Capabilities:
DFSSupport: true
Leasing: true
LargeMTU: true

```

--------------------------------

### Software Detection: Apache Version from Server Header

Source: https://docs.netlas.io/knowledge-base/software-and-vulnerabilities

Example of detecting Apache software and its version by inspecting the Server HTTP header.

```text
Server: Apache/2.4.51 → tag.name:apache + tag.apache.version:2.4.51
```

--------------------------------

### S7 Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

This is an example of a full, unparsed banner from an S7 response, often containing key-value metadata.

```text
IsS7: true
System: S7-1500 station_1
Module: PLC1
PlantId: 
Copyright: Original Siemens Equipment

```

--------------------------------

### RDP NTLM Computer Name Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a DNS computer name reported during RDP NTLM negotiation.

```text
WIN-BUNS25TD77J
```

--------------------------------

### Example Domain Search Response (200 OK)

Source: https://docs.netlas.io/api-reference

This is a sample JSON response for a successful domain search query, showing the structure of returned domain data including TXT, A, NS, and AAAA records.

```json
{
  "items": [
    {
      "data": {
        "txt": [
          "_k2n1y4vw3qtb4skdx9e7dxt97qrmmq9",
          "v=spf1 -all"
],
        "a": [
          "23.192.228.80",
          "23.192.228.84",
          "23.215.0.136",
          "96.7.128.175",
          "23.215.0.138",
          "96.7.128.198"
],
        "last_updated": "2025-02-18T20:14:08.642Z",
        "@timestamp": "2025-02-18T20:14:08.642Z",
        "level": 2,
        "zone": "com",
        "ns": [
          "a.iana-servers.net",
          "b.iana-servers.net"
],
        "domain": "example.com",
        "aaaa": [
          "2600:1408:ec00:36::1736:7f24",
          "2600:1406:bc00:53::b81e:94ce",
          "2600:1406:3a00:21::173e:2e66",
          "2600:1406:bc00:53::b81e:94c8",
          "2600:1408:ec00:36::1736:7f31",
          "2600:1406:3a00:21::173e:2e65"
]
}
}
]

}
```

--------------------------------

### Query VNC Services by Length

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example query to find VNC services with handshake responses longer than 12 bytes.

```kql
vnc.length:>12

```

--------------------------------

### MongoDB Banner Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Raw banner data returned from a MongoDB server during probing. Contains build information and other server details.

```text
IsMaster:
IsMaster: true
ReadOnly: false
BuildInfo:
Version: 8.0.3
GitVersion: 89d97f2744a2b9851ddfb51bdf22f6...
```

--------------------------------

### Query Example for Organization

Source: https://docs.netlas.io/knowledge-base/field-reference/certs

An example of how to use the 'certificate.subject.organization' field in a Netlas query to find certificates issued to a specific organization.

```text
certificate.subject.organization:"Microsoft Corporation"
```

--------------------------------

### IMAP STARTTLS Response Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Server response to the STARTTLS command, indicating whether the server supports upgrading the connection to TLS encryption.

```text
a001 OK Begin TLS negotiation now.

```

```text
a001 OK go ahead with TLS handshake STARTTLS completed

```

--------------------------------

### HTTP Body SHA-256 Hash Example

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Example of a SHA-256 hash for an HTTP response body, useful for exact content matching.

```text
3a7bd3e2360a3d4d9c65a857d1d7a8dd7a9e743dd73a7a5e
```

--------------------------------

### Download Request Payload Example

Source: https://docs.netlas.io/api-reference

This snippet shows a sample JSON payload for the download endpoint. It specifies search query, number of results, fields to include, and the source type for fields.

```json
{
  "q": "net.country:VA",
  "size": 100,
  "fields": [
    "abuse",
    "asn",
    "net"
  ],
  "source_type": "include"
}
```

--------------------------------

### Search for software tags within a version range

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Use this to search for a specific software tag (e.g., Nginx) within a version range, from 1.15 up to 1.18.

```text
tag.nginx.version:[1.15 TO 1.18]
```

--------------------------------

### Find POP3 servers that do not support STARTTLS

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

This query identifies POP3 servers that do not support the STARTTLS extension for secure connections.

```text
!pop3.starttls:*
```

--------------------------------

### Response Count JSON Example

Source: https://docs.netlas.io/api-reference

This is an example of a successful JSON response when requesting the count of documents. The 'count' field indicates the number of matching documents.

```json
{
  "count": 123
}
```

--------------------------------

### Software Detection: WordPress Version from HTML Meta Tag

Source: https://docs.netlas.io/knowledge-base/software-and-vulnerabilities

Example of detecting WordPress software and its version using a meta tag within HTML content.

```text
<meta name="generator" content="WordPress 6.8" /> → tag.name:wordpress + tag.wordpress.version:6.8
```

--------------------------------

### Example Mapping Structure

Source: https://docs.netlas.io/api-reference

This example illustrates a nested JSON structure for field mapping, showing how 'leaf' fields with 'field_type' and 'parent' fields with 'children' are represented.

```json
{
  "leaf": {
    "field_type": "type"
  },
  "parent": {
    "children": [
      {
        "leaf": {
          "field_type": "type"
        }
      }
    ]
  }
}


```

--------------------------------

### T3 Banner Field Examples

Source: https://docs.netlas.io/knowledge-base/field-reference/responses

Examples of T3 handshake responses from Oracle WebLogic servers, showing different versions, patch flags, and included fields.

```text
HELO:14.1.1.0.false AS:2048 HL:19 MS:5242880 PN:DOMAIN
```

```text
HELO:12.2.1.4.false AS:2048 HL:19 MS:10000000 PN:DOMAIN
```

```text
HELO:10.3.6.0.false AS:2048 HL:19
```
Tokens:
Raw