4

I'm using nmap to scan a given domain name example.com, which resolves to 2 ip addresses, then nmap chooses only one ip address to scan

for example:

#nmap -vv -sV scanme.nmap.org
Starting Nmap 7.01 ( https://nmap.org ) at 2016-11-01 15:52 CET
NSE: Loaded 35 scripts for scanning.
Warning: Hostname scanme.nmap.org resolves to 2 IPs. Using 45.33.32.156.
Initiating Ping Scan at 15:52
Scanning scanme.nmap.org (45.33.32.156) [4 ports]
Completed Ping Scan at 15:52, 0.17s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:52
Completed Parallel DNS resolution of 1 host. at 15:52, 0.30s elapsed
Initiating SYN Stealth Scan at 15:52
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 9929/tcp on 45.33.32.156

is there an option to force nmap to scan all 2 ip address, not just one? thanks

  • prefer to ask questions related to information security – 8zero2.ops Nov 1 '16 at 15:24
  • usually you would first scan that entire network range, then submit the IP addresses into nmap as a list – Rory Alsop Nov 1 '16 at 15:26
  • dig +short <domainname> | sudo xargs nmap -vv -sV – 8zero2.ops Nov 1 '16 at 15:26
  • i'm aware of these workarounds, thanks, but I'm asking to see if nmap have an option to support this natively – ksr Nov 1 '16 at 16:05
3

Nmap has a script to do this, resolveall. The interface isn't as nice as it could be: you have to provide the hostname via the resolveall.hosts script argument. Here's how to do that and also add any resolved addresses to the scan queue:

nmap --script resolveall --script-args newtargets,resolveall.hosts=example.com

EDIT: As mentioned in the comments, Nmap 7.40 and later does not require the resolveall.hosts script argument; you can provide targets directly on the command line or with -iL as you usually would. The newtargets argument is required to add the resolved addresses to the scan queue instead of just listing them in the script's output. Future releases of Nmap (newer than 7.60) will have non-NSE capability to do this, but the options and syntax have not been decided yet.

EDIT 2: Nmap 7.70 (released today) has this functionality built-in with the --resolve-all option. No need to use the resolveall NSE script, which will be removed in a future release, and no need to use the newtargets script argument.

  • 1
    Thanks! but what if I have a text file with a list of domain names, can I use the -iL option, or there's an alternative? – ksr Nov 2 '16 at 7:15
  • @ksr I just added this to the script last night. Thanks for pointing it out! – bonsaiviking Nov 3 '16 at 16:37
  • great! r u the author? can u give us link to the modified version? thanks! – ksr Nov 6 '16 at 15:04
  • can u provide an example command with arguments, how the new modified version will be used with nmap – ksr Nov 6 '16 at 15:23
  • 1
    @ksr download from the documentation page: nmap.org/nsedoc/scripts/resolveall.html . Example: nmap -iL targets.txt --script resolves --script-args newtargets – bonsaiviking Nov 6 '16 at 15:37
0

You can run a for loop:
for srv in $(host example.com |awk '{print $4}'); do nmap $srv; done

or if you have a list with one entry per line:
for srv in $(cat list.txt); do nmap $srv; done

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.