2

Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s).

I can scan the IP(s) with nmap and possibly conclude on which ports a webserver is running, but not which URL(s) may be served there.

I could also simply access the IP in the browser with the identified ports and see if there's are default redirect in place.

Is there a reasonable way to conclude from IP to hosted URL(s)?

edit: I'm not talking about directories of one hosted URL (e.g. example.com/uploads, example.com/images, ...). I'm talking about the scenario, when multiple different URLs are hosted via one IP address (e.g. IP 127.0.0.1 hosts example.com and somethingelse.com).

I do know about reverse DNS searches, but are there any other techniques?

Improve this question
  • 1
    Is it private IP or a public IP? Have you tried interrogating the DNS records? A simple nslookup or whois search should do the trick. You may need set them to do a reverse lookup but most tools will do that for you automatically. – TheJulyPlot Dec 16 '16 at 14:23
  • 1
    Try a reverse DNS lookup? You can use something like mxtoolbox.com/ReverseLookup.aspx – iainpb Dec 16 '16 at 14:31
  • Reverse DNS lookup is the only thing I'm aware of - I was wondering if there are other techniques. Thank you for your input. – SaAtomic Dec 19 '16 at 8:20
2

Crawlers can find these over different ways:

  1. Read sitemap files or the robot.txt

  2. Use statuscodes like 403 or 404 to guess whether there is a file or not

Improve this answer
  • This would help find directories of one hosted URL (e.g. example.com/uploads, example.com/images), rather then different URLs (e.g. IP 127.0.0.1` hosts example.com and somethingelse.com). I might have not been clear enough in the question. – SaAtomic Dec 19 '16 at 8:20
-1

Good idea to put the address in a browser window, using the open ports revealed by nmap.
Even better, use PuTTY and set it up as a telnet client to explore those ports.

But that won't necessarily tell you much.

Try mine and you will see: The address is 50.87.249.67, and the site http://www.calttc.net/default.html is on the shared server.

Knowing just the IP address will definitely not lead you to my root site at http://calttc.net nor to the subsites which do not start with www. It also will not point you to my proof-of-concept where I try out PHP for the first time, at: http://www.calttc.net/login.htm (Nothing is saved if you try this out - it just echoes the username field back)

Here are several research tools that might help figure out what an IP adddress points towards:

http://itools.com/tool/arin-whois-domain-search

https://www.ultratools.com/tools/ipWhoisLookup

https://mxtoolbox.com/ReverseLookup.aspx

---- EDIT: @Schroeder found another one that went the furthest towards finding my hosting service: http://www.tcpiputils.com/browse/ip-address/50.87.249.67 Kudos for that one.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.