Virtual Host and DNS Enumeration Techniques

This is a great post on techniques to performing virtual host and DNS enumerations for reconnaissance in penetration testing.

Here's the summary:

• DNS enumeration
• Banner grabbing
• SSL/TLS enumeration
• HTTP Protocol enumeration
• Active/Passive Web enumeration

Check out this site from Lonerunners. It does mention about Hostmap too.

HostMapping

Everyone perform reconnaissance during penetration testing. Here comes a handy tool to help you to perform hostmapping for information gathering.

It helps you using several techniques to enumerate all the hostnames associated with an IP address. This is similar to SpyOnWeb.

The major features are:

• DNS names and virtual hosts enumeration.
• Multiple discovery techniques, to read more see user guide.
• Results correlation, aggregation and normalization.
• Multithreaded and event based engine.
• Platform independent.

Download a copy of this handy tool here!

Spy On Web

SpyOnWeb.com takes the information from public sources, then structures it for your quick and convenient search for the websites that probably belong to the same owner. The web crawler picks out the following data: IP address, Google Adsense ID, Google Analytics ID, Yahoo Publisher Network ID, Yandex Direct ID.

This greatly helpss a pentester to disclose any websites with the same IP address and same owner during reconnaissance. Simply enter website URL, IP address, adversting or statistics code to discover the targetted internet business and use this data for your further strategy.

According to the website, they have indexed more than 72 million domains with more than:

• 8 499 550 sites with Google Analytics code.
• 3 603 150 sites with Google AdSense code.
• 20 347 sites with Yahoo Publisher Network code.
• 13 448 sites with Yandex Direct code.

Online Web Information Gathering

Here is a very useful service I’ve discovered today.

Sucuri WIGS (Web information gathering) is a simple tool to collect public information from any web site. It is very lightweight, executing just a few normal requests to your site and processing the information internally.

Enter the site URL, it will shows you:

• The web server information: banner, version.
• Related hosts and IP address: sub-sites.
• DNS lookup information.
• HTTP header information.
• Whois information.
• List of links.

Find here the online service from Sucuri web site.

Reverse Lookup with Bing

I learn this unique feature at Microsoft latest search engine, Bing.

You may perform reverse lookup with an IP address for a main site and generate a list of sub-site with Bing search engine.

For example, you enter "ip:216.34.181.45" (without the quote). This is the IP address for SlashDot main. It will results in 310,000 answers with a list of sub-site that hosting at the same public IP address.

This is a great feature as it can allow a pentester to find out how many websites are hosted at one particular IP address during reconnaissance. Cool!