Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s).
I can scan the IP(s) with nmap
and possibly conclude on which ports a webserver is running, but not which URL(s) may be served there.
I could also simply access the IP in the browser with the identified ports and see if there's are default redirect in place.
Is there a reasonable way to conclude from IP to hosted URL(s)?
edit: I'm not talking about directories of one hosted URL (e.g. example.com/uploads
, example.com/images
, ...).
I'm talking about the scenario, when multiple different URLs are hosted via one IP address (e.g. IP 127.0.0.1
hosts example.com
and somethingelse.com
).
I do know about reverse DNS searches, but are there any other techniques?