Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found several websites offer a function that allows you to list all domains hosted on the same machine, e.g you supply a.com, and it tells you b.com and c.com are both hosted on the same machine as a.com.

How did they know about it?

My first thought was to do a DNS lookup on a.com, find its IP, and a reverse IP look up on all these IPs to see if any domain matches.

In this case, that process is expected to be slow, But the website returns the result nearly immediately, so they mustn't be using this method.

share|improve this question
    
You can try reverse lookup. If webserver address is 1.2.3.4 you can try host 1.2.3.4 1.2.3.4 and that could reveal all the websites hosted on that ip, for example ispconfig by default configures reverse DNS, as well many other hosting systems as well windows active directory. –  Andrew Smith Oct 23 '12 at 18:24

2 Answers 2

up vote 2 down vote accepted

There is absolutely no way to list all domains "hosted" on a machine as you state it.

First of all, what you wanted to do will only give you the name(s) attached to a PTR record (reverse DNS to an IP). It will not give you a list of A records pointing to it.

What you must understand about DNS, is that they act as a database of associated IP addresses and hostnames. There may be several DNS servers with records pointing (with A records) to a single host. But there is no way to know which servers are effectively hosting those records, as well, as there is no type of DNS query that asks a DNS server for A records pointing to a specific IP.

You stated about websites proposing to "query" about an IP to know which sites are hosted on it. All those sites do, is storing in a database association between public websites (and hostnames) and their attached IP address(es), indexing on the IP. This only works if they can guarantee you that they crowled the entire www, world-wide, and that their informations are accurate, which they can't, as they are thousands of "websites" hosted privately (without search engines indexation and no cross-links), others moving around and changing IP, etc ...

I hope this explaination was clear enough and helped.

share|improve this answer
    
A webhost provider can add all the hostnames in the reverse DNS and make it possible to query the DNS-system for the hostnames on the same IP. This is not done mostly because it needs to be kept updated. And to some degree security by obscurity. –  Kent Oct 22 '12 at 12:54

They make a DNS lookup on each domain name and then make a list on which domain name has the same IP-address. This is saved into a database, so if you search for a "new" domain name it will only do one DNS lookup (for the A record for this domain) and then query their database for all the hosts with that IP address. The list of domain names on on host might not be complete.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.