I'm conducting a penetration test, where I'm facing the following problem:
After having retrieved a set of IP addresses through tools like
whois, I cannot successfully connect to the HTTP-based websites/services using the IP address, only the hostname work. However, no DNS PTR records exists for the IP addresses.
nc or similar to connect directly to the website/service using the IP address doesn't work - it expects HTTP requests only. Furhermore, DNS zone transfer doesn't work.
This reason is that the webserver/firewall inspects the HTTP
Host header and responds with a
HTTP 404, if the
Host header contains an IP address. It may do so because of virtual hosting, or maybe the request is being filtered as a security precaution.
In this case, how can I connect to the web servers under these restrictions?