I'm conducting a penetration test, where I'm facing the following problem:

After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based websites/services using the IP address, only the hostname work. However, no DNS PTR records exists for the IP addresses.

Using nc or similar to connect directly to the website/service using the IP address doesn't work - it expects HTTP requests only. Furhermore, DNS zone transfer doesn't work.

This reason is that the webserver/firewall inspects the HTTP Host header and responds with a HTTP 404, if the Host header contains an IP address. It may do so because of virtual hosting, or maybe the request is being filtered as a security precaution.

In this case, how can I connect to the web servers under these restrictions?

  • 1
    How were you able to start the investigation with whois without knowing something about the domains? – schroeder Mar 9 at 11:20
  • Have you tried tools that enumerate domains on IPs, like: dnslytics.com/ip/ – schroeder Mar 9 at 11:22
  • Have you seen things like: stackoverflow.com/questions/3621682/… – schroeder Mar 9 at 11:24
  • Are we assuming that this is a normal public website? If so, then there must be DNS records so that people can connect. – schroeder Mar 9 at 11:31
  • @schroeder - I know a few hostnames; using these, I've identified several blocks of IP adresses. – Shuzheng Mar 9 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.