Discovering hostnames pointing to the same IP address

Web servers return different content depending on the hostname used in the HTTP request. By discovering new hostnames, penetration testers can access new target web applications that were inaccessible using the server's IP.

This recipe shows how to enumerate all hostnames pointing to the same IP , in order to discover new targets.

Getting ready

The script hostmap depends on external services, and the official version only supports BFK's DNS Logger. In my experience, this service works great for popular servers but not so much for the others. For this reason I created my own version of hostmap.nse that adds a new service provider: ip2hosts.com. This service uses Bing's Search API and often returns additional records not available in BFK's records.

Download hostmap.nse with Bing support at https://secwiki.org/w/Nmap/External_Script_Library.

After copying it to your local script directory, update your script database by running the following...