0

I'm scanning a network (whose name will not be stated). It has >1 IP addresses. When I tried scanning its subdomains, there are several subdomains that are translated to the same IP address but return different scan reports (like different ports being reported).

For example:

nmap subdomain1
nmap subdomain2
nmap i.p.v.4
# The IPv4 that both subdomains translate to

nmap subdomain1 -A -p-
nmap subdomain2 -A -p-
nmap i.p.v.4 -A -p-
# This also returns different results

Those 3 all return different port findings.

From what I know, the URL/domain name should just be translated to the IP then scan, so I think they should all return the same results.

Why are different results returned? Is it because of domain translation (something I missed?) or is it something else?

Also, if given an IP address of a domain and its subdomains with the same IP, should I just scan the IP (save time and resources) or should I also scan every subdomain?

1

There might be a Web Application Firewall with different profiles for different domains. So they might share the same ip address but every domain serves a different purpose and so different ports are allowed. A WAF is able to "unterstandt" the http packets, that way it is able to determine the domain you try to connect to.

  • From what I understand, directly spanning the IP should get me information on ALL the subdomains without having to scan them all one by one. Is that correct? – John Zhau Oct 12 at 5:49
  • In a simpler Environment You are right – Kingflomb Oct 12 at 6:58
  • but if you check only the ip some ports will not respond, but they would If you use the Domain. Thats because the content of your requests is validatet before a decision is made to respond – Kingflomb Oct 12 at 7:00
  • Is there some way to probe those ports without having to repeat the scan on all the subdomains? Does nmap i.p.v.4 -A -p- not work in that case? – John Zhau Oct 12 at 10:11
  • I am Not sure maybe one of the nmap scripts can help – Kingflomb Oct 12 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.