PLA Forums

Other Stuff That Has Little To Do With PLA => Techinical Shit => Phreaking, Hacking, Social Engineering, Lock Picking => Topic started by: Robert_ on July 31, 2008, 09:47:23 PM

Title: Domain Scanning
Post by: Robert_ on July 31, 2008, 09:47:23 PM
Does anyone here know of a domain scanner that will scan for aliases on that domain; such as domain pointers and sub domains.

Thnx!
Title: Re: Domain Scanning
Post by: mr_doc on August 01, 2008, 12:20:29 AM
If you type the domain name in google it will give you any cached pages from the subdomains
Title: Re: Domain Scanning
Post by: Robert_ on August 01, 2008, 01:06:47 AM
I mean other domains hosted with that domain on the same host. Say their is a primary domain and other domains hosted under it on the same host.
Title: Re: Domain Scanning
Post by: MattGSX on August 01, 2008, 05:07:33 PM
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?
Title: Re: Domain Scanning
Post by: Copyright on August 01, 2008, 05:19:37 PM
http://websiteoutlook.com will give other websites hosted on it.

As far as subdomains, you can try Acunetix, but it only scans for widely used ones(mail.web, smtp.web), write a perl script to brute it :D.
Title: Re: Domain Scanning
Post by: Robert_ on August 01, 2008, 06:26:28 PM
What I'm doing is I got this main companies website and wanting to know what other websites are hosted on their server.
Title: Re: Domain Scanning
Post by: trevelyn on August 03, 2008, 07:12:28 PM
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

LOLLL $20?? LOOOLLLL use simple UNIX tools to enumerate that information:

wget "whatever.com" && cat index.html | grep "href=" | cut -d "/" -f 3 (should be good)
 
or try the (FREE) listurls python script in Back|Track 3
or search google like this "site:<victim>.com"
Do "whois <victim>.com from the command line of the (FREE) backtrack CD

The Whois result will usually include the whole network range which belongs to the organization.

type "nslookup" from the cmd line and then at the ">" prompt test different services/types like
"type=mx" (mail servers) or "type=ns" etc
you could also write a bash script that reads a file line by line, (full of words), and stick that variable like so:
$variable.<victim>.com and it could simply do wget and stream edit the output with "grep, sed awk" to show you only live subdomains. etc.
try using the host command to enumerate data about the DNS servers used as well.

hope that helps.
<3 Trev.
Title: Re: Domain Scanning
Post by: MattGSX on August 04, 2008, 04:52:14 PM
You think I'd ever pay the $20? I just pulled a Google Commando and did a search for what the OP was looking for. That was one of the top results. I took a look, verified that it worked, and posted it.
Title: Re: Domain Scanning
Post by: jx on August 04, 2008, 05:33:12 PM
http://www.netcraft.com
Title: Re: Domain Scanning
Post by: z3wb on August 04, 2008, 05:46:46 PM
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

I once dox'd someone with that. He was ran a website a few years back, and I asked my friend who has a paid membership to give me one of the archived whois records, and what do you know, his full information was right there, including home address and phone number. Even though he cancelled the domain, his information was, and still is available on all kinds of websites. Hopefully, one day, they won't require a paid membership to view their archived whois records, and we'll have free access to all the dox we can handle.
Title: Re: Domain Scanning
Post by: Zazen on August 05, 2008, 12:17:36 AM
write a perl script to brute it :D.

Surely someone out there has already written a nice tool for this? Is there none?
Title: Re: Domain Scanning
Post by: Chartreuse on August 21, 2008, 09:17:06 PM
I have written a perl script that will brute-force any part of a web address.
It takes a url in this form: http://*.somesite.com/ where the asterisk can be put in any part of the web address.
It requires a word list with one word on each line.

If anyone wants the script or help work on it I can post it here.

Chartreuse.
Title: Re: Domain Scanning
Post by: Woofcat on August 22, 2008, 07:27:48 PM
If their name servers are poorly configured you can do host -l domain nameserver

might get a list. care to disclose target?
Title: Re: Domain Scanning
Post by: Tachyon on August 22, 2008, 08:10:53 PM
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

I once dox'd someone with that. He was ran a website a few years back, and I asked my friend who has a paid membership to give me one of the archived whois records, and what do you know, his full information was right there, including home address and phone number. Even though he cancelled the domain, his information was, and still is available on all kinds of websites. Hopefully, one day, they won't require a paid membership to view their archived whois records, and we'll have free access to all the dox we can handle.

Was that information valid? I've run websites registered with bullshit names before.
Title: Re: Domain Scanning
Post by: MattGSX on August 25, 2008, 02:41:30 PM
the ones I tried were, but mine were businesses, so there is some amount of motivation to not use fictitious information. I'm pretty sure the site gets the information from the domain registrar (if the domain was independently registered), as well as the web hosting company. When I WhoIs'ed myself, I got a set of "personal" information from when I registered my domain, as well as the company info from when I registered a hosting acct with another company. If this information is bullshit for both, then the information that comes back will be bullshit, unless your hosting/domain providers give out information like the IP used to register, or anything like that.
Title: Re: Domain Scanning
Post by: siteweb on December 23, 2013, 09:44:24 PM
I mean other domains hosted with that domain on the same host. Say their is a primary domain and other domains hosted under it on the same host.

Well, you can get the IP of the respective website and if you submit it in  WhoisXY.com (http://www.whoisxy.com/ip-to-domain.aspx)  you can get the other websites hosted with it...I tried it for Google and it worked...