Scanning a domain name

Question

When we scan a domain name such as www.nmap.org,

Question 1: We are actually scanning the server that the website is hosted on, right?

Question 2: If there is another domain hosted on the same server, would the results of the scan be the same?

Answer 1

One caveat: you may be scanning a load balancer. Thus, your probes may reach different machines. There is a Sans paper on that: Identifying Load Balancers in Penetration Testing

In fact there are many more caveats and you could say scanning is more art than science.

First of all, you are going to provide a host name, so nmap is going to resolve it. But it could resolve to multiple IP addresses. Indeed it is not rare to for an Internet facing machine to have multiple instances. So what will happen ? The answer is in the manual (emphasis is mine):

When a hostname is given as a target, it is resolved via the Domain Name System (DNS) to determine the IP address to scan. If the name resolves to more than one IP address, only the first one will be scanned. To make Nmap scan all the resolved addresses instead of only the first one, use the --resolve-all option.

And if I'm not wrong nmap will resolve to IPv4 addresses by default, but what is the host is also on IPv6 ? The attack surface may be even higher (think for example that iptables could be running on the host but not its counterpart ip6tables).

So you should also add the IPv6 addresses to the list of targets to scan. My advice is to perform the resolution yourself and build your own list of IP addresses.

Answer 2

Question 1: We are actually scanning the server that the website is hosted on, right?

Yes.

Question 1: We are actually scanning the server that the website is hosted on, right?

If this is a pure transport level scan (i.e. detect open ports) then yes. If there are application level scans (like get version of server) which might involve the domain name (like in HTTP requests or SSL handshakes) then the response might be different since the server might make use of the provided domain name when generating the response.

Answer 3

Answer to question 1: We are actually scanning the server that the website is hosted on, right?

We are scanning the open ports on that host, that host can have multiple Vhosts, but in the end all of them are being served via port 80 (HTTP) or 443 (HTTPS).

Answer to question 2: If there is another domain hosted on the same server, the results of the scan would be same?

Yes, they would be the same, take this example as a reference:

The IP for this demonstration would be:

151.101.65.195

That IP address is used by many domains, as you can verify by using a ping command:

galoget@hackem:~$ ping -c 4 cncworks.co.nz
PING cncworks.co.nz (151.101.65.195) 56(84) bytes of data.
64 bytes from 151.101.65.195 (151.101.65.195): icmp_seq=1 ttl=39 time=10.5 ms
64 bytes from 151.101.65.195 (151.101.65.195): icmp_seq=2 ttl=39 time=10.6 ms
64 bytes from 151.101.65.195 (151.101.65.195): icmp_seq=3 ttl=39 time=10.7 ms
64 bytes from 151.101.65.195 (151.101.65.195): icmp_seq=4 ttl=39 time=10.8 ms

--- cncworks.co.nz ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 10.518/10.650/10.814/0.106 ms


galoget@hackem:~$ ping -c 4 vivaanprojects.com
PING vivaanprojects.com (151.101.1.195) 56(84) bytes of data.
64 bytes from 151.101.1.195 (151.101.1.195): icmp_seq=1 ttl=39 time=10.7 ms
64 bytes from 151.101.1.195 (151.101.1.195): icmp_seq=2 ttl=39 time=10.7 ms
64 bytes from 151.101.1.195 (151.101.1.195): icmp_seq=3 ttl=39 time=10.7 ms
64 bytes from 151.101.1.195 (151.101.1.195): icmp_seq=4 ttl=39 time=10.7 ms

--- vivaanprojects.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 10.682/10.695/10.704/0.008 ms

If you run a nmap scan to all ports, the results are the same:

galoget@hackem:~$ nmap -p- cncworks.co.nz
Starting Nmap 7.80 ( https://nmap.org ) at 2021-07-11 19:10 UTC
Nmap scan report for cncworks.co.nz (151.101.1.195)
Host is up (0.011s latency).
Other addresses for cncworks.co.nz (not scanned): 151.101.65.195
Not shown: 65533 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https


galoget@hackem:~$ nmap -p- vivaanprojects.com
Starting Nmap 7.80 ( https://nmap.org ) at 2021-07-11 19:14 UTC
Nmap scan report for vivaanprojects.com (151.101.65.195)
Host is up (0.011s latency).
Other addresses for vivaanprojects.com (not scanned): 151.101.1.195
Not shown: 65533 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 104.45 seconds