When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same IP Why does this happen? And how can I find all the websites on a particular IP?
-
Does this answer your question? How do I find all domains hosted on a single host?, Finding web application on webserver having only IP– Steffen UllrichAug 29, 2020 at 10:46
-
Or, superuser.com/questions/1543395/…– mti2935Aug 29, 2020 at 13:16
Add a comment
|
1 Answer
Reverse IP Lookup usually returns the domains under the primary Top Level Domains hosted on a given IP address (since that is what is usually placed in the PTR record), not a complete list of websites hosted at the IP. This typically does not include sub-domains since the subdomains are not directly under the primary top level domains.
And how can I find all the websites on a particular IP?
If you want to enumerate all websites including sub-domains, you can try using a reverse IP lookup to find the domains hosted on that IP and then enumerate sub-domains for all of them.
-
Is there a command line in windows for reverse IP lookup? Example @nobody– alexAug 29, 2020 at 11:32
-
-
I still get the same problem when I use nslookup I get only one website hosted on IP but when I use this service pentest-tools.com/information-gathering/… I get many website hosted on the same IP– alexAug 29, 2020 at 11:51
-
@alex That site does sub-domain enumeration. Reverse IP lookup and subdomain enumeration are separate things. Reverse IP uses DNS PTR records, while subdomain enumeration uses many different techniques– nobodyAug 29, 2020 at 11:57