SPONSORED LINKS:

Domain Scanning



REA D NE W PO STS


-Sponsors-



-Other Forums-

  Facebook Group
  Madhouse Radio new
  BinRev new
  Defcon Forums new
  KDK Pranks
  Ownage Pranks new
  Jerky Boys
  Underground News new
  Jackulator 9000 new


-phonelosers.org-

  Main Site
  Prank Calls
  Shoutcast Stream
  Podcasts
  PLA Wiki
  PLA YouTube
  PLA Twitter
  PLA Tumblr


REA D NE W PO STS



Support PLA by doing your Amazon searching here:

Also, visit PLAs Amazon Store

Author Topic: Domain Scanning  (Read 2608 times)

Offline Robert_

  • Local Operator
  • *****
  • Posts: 124
  • 1337 13V3L: +10/-12
Domain Scanning
« on: July 31, 2008, 09:47:23 PM »
Does anyone here know of a domain scanner that will scan for aliases on that domain; such as domain pointers and sub domains.

Thnx!

Offline mr_doc

  • Supergluer of coins
  • PLA Junkie
  • *****
  • Posts: 801
  • 1337 13V3L: +71/-24
    • PLA LotGD
Re: Domain Scanning
« Reply #1 on: August 01, 2008, 12:20:29 AM »
If you type the domain name in google it will give you any cached pages from the subdomains
PLAlotgd  -If you play, I will hate you a little less.
Unnamed Forums

Offline Robert_

  • Local Operator
  • *****
  • Posts: 124
  • 1337 13V3L: +10/-12
Re: Domain Scanning
« Reply #2 on: August 01, 2008, 01:06:47 AM »
I mean other domains hosted with that domain on the same host. Say their is a primary domain and other domains hosted under it on the same host.

Offline MattGSX

  • Whiny Music Nerd
  • Senior PLA Junkie
  • *****
  • Posts: 1195
  • 1337 13V3L: +59/-97
  • Douchenozzle
    • Matt GSX Has Better Taste In Music Than You
Re: Domain Scanning
« Reply #3 on: August 01, 2008, 05:07:33 PM »
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

Offline Copyright

  • Full-time Posting Prostitute
  • *****
  • Posts: 166
  • 1337 13V3L: +10/-12
Re: Domain Scanning
« Reply #4 on: August 01, 2008, 05:19:37 PM »
http://websiteoutlook.com will give other websites hosted on it.

As far as subdomains, you can try Acunetix, but it only scans for widely used ones(mail.web, smtp.web), write a perl script to brute it :D.

Offline Robert_

  • Local Operator
  • *****
  • Posts: 124
  • 1337 13V3L: +10/-12
Re: Domain Scanning
« Reply #5 on: August 01, 2008, 06:26:28 PM »
What I'm doing is I got this main companies website and wanting to know what other websites are hosted on their server.

Offline trevelyn

  • Administrator
  • Elite Cactus Squad
  • Ninja Phone Loser
  • *****
  • Posts: 1687
  • 1337 13V3L: +183/-22
  • He likes cans and taking pictures in cans!
    • WeakNet Labs
Re: Domain Scanning
« Reply #6 on: August 03, 2008, 07:12:28 PM »
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

LOLLL $20?? LOOOLLLL use simple UNIX tools to enumerate that information:

wget "whatever.com" && cat index.html | grep "href=" | cut -d "/" -f 3 (should be good)
 
or try the (FREE) listurls python script in Back|Track 3
or search google like this "site:<victim>.com"
Do "whois <victim>.com from the command line of the (FREE) backtrack CD

The Whois result will usually include the whole network range which belongs to the organization.

type "nslookup" from the cmd line and then at the ">" prompt test different services/types like
"type=mx" (mail servers) or "type=ns" etc
you could also write a bash script that reads a file line by line, (full of words), and stick that variable like so:
$variable.<victim>.com and it could simply do wget and stream edit the output with "grep, sed awk" to show you only live subdomains. etc.
try using the host command to enumerate data about the DNS servers used as well.

hope that helps.
<3 Trev.

Offline MattGSX

  • Whiny Music Nerd
  • Senior PLA Junkie
  • *****
  • Posts: 1195
  • 1337 13V3L: +59/-97
  • Douchenozzle
    • Matt GSX Has Better Taste In Music Than You
Re: Domain Scanning
« Reply #7 on: August 04, 2008, 04:52:14 PM »
You think I'd ever pay the $20? I just pulled a Google Commando and did a search for what the OP was looking for. That was one of the top results. I took a look, verified that it worked, and posted it.

Offline jx

  • PLA Army
  • *****
  • Posts: 559
  • 1337 13V3L: +62/-22
  • When the fone green I pink up the fone&say yellow
Re: Domain Scanning
« Reply #8 on: August 04, 2008, 05:33:12 PM »

Offline z3wb

  • PLA Guru
  • *****
  • Posts: 202
  • 1337 13V3L: +37/-36
Re: Domain Scanning
« Reply #9 on: August 04, 2008, 05:46:46 PM »
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

I once dox'd someone with that. He was ran a website a few years back, and I asked my friend who has a paid membership to give me one of the archived whois records, and what do you know, his full information was right there, including home address and phone number. Even though he cancelled the domain, his information was, and still is available on all kinds of websites. Hopefully, one day, they won't require a paid membership to view their archived whois records, and we'll have free access to all the dox we can handle.
Huh?

Offline Zazen

  • Cactus Zombie
  • *****
  • Posts: 380
  • 1337 13V3L: +34/-14
Re: Domain Scanning
« Reply #10 on: August 05, 2008, 12:17:36 AM »
write a perl script to brute it :D.

Surely someone out there has already written a nice tool for this? Is there none?

Offline Chartreuse

  • Junior Phone Loser
  • **
  • Posts: 22
  • 1337 13V3L: +8/-5
Re: Domain Scanning
« Reply #11 on: August 21, 2008, 09:17:06 PM »
I have written a perl script that will brute-force any part of a web address.
It takes a url in this form: http://*.somesite.com/ where the asterisk can be put in any part of the web address.
It requires a word list with one word on each line.

If anyone wants the script or help work on it I can post it here.

Chartreuse.
Hi?

Offline Woofcat

  • Junior Phone Loser
  • **
  • Posts: 27
  • 1337 13V3L: +1/-2
Re: Domain Scanning
« Reply #12 on: August 22, 2008, 07:27:48 PM »
If their name servers are poorly configured you can do host -l domain nameserver

might get a list. care to disclose target?

Offline Tachyon

  • Minister of Defence
  • OMG Mod
  • Ninja Phone Loser
  • *****
  • Posts: 1875
  • 1337 13V3L: +125/-62
Re: Domain Scanning
« Reply #13 on: August 22, 2008, 08:10:53 PM »
domaintools.com . Run a domain WhoIs on the site to give you the host an owner. Running a standard WhoIs on the parent company should give you all listed domains. For an additional $20, you can also get all domains hosted by the host.

Is this what you're looking for?

I once dox'd someone with that. He was ran a website a few years back, and I asked my friend who has a paid membership to give me one of the archived whois records, and what do you know, his full information was right there, including home address and phone number. Even though he cancelled the domain, his information was, and still is available on all kinds of websites. Hopefully, one day, they won't require a paid membership to view their archived whois records, and we'll have free access to all the dox we can handle.

Was that information valid? I've run websites registered with bullshit names before.
Do you speak two languages?

"Detective Don Gombo: IM AFRAID THE ONLY ONE "F" IS "U" MY FRIEND. WELCOME TO THE CRIMINAL JUSTICE WEB!"

Offline MattGSX

  • Whiny Music Nerd
  • Senior PLA Junkie
  • *****
  • Posts: 1195
  • 1337 13V3L: +59/-97
  • Douchenozzle
    • Matt GSX Has Better Taste In Music Than You
Re: Domain Scanning
« Reply #14 on: August 25, 2008, 02:41:30 PM »
the ones I tried were, but mine were businesses, so there is some amount of motivation to not use fictitious information. I'm pretty sure the site gets the information from the domain registrar (if the domain was independently registered), as well as the web hosting company. When I WhoIs'ed myself, I got a set of "personal" information from when I registered my domain, as well as the company info from when I registered a hosting acct with another company. If this information is bullshit for both, then the information that comes back will be bullshit, unless your hosting/domain providers give out information like the IP used to register, or anything like that.

 

SPONSORED LINKS: