0

Let's say an IP address hosts multiple domains, (example.com, example.net, example.org, etc.). How do I port scan a specific domain?

1

1 Answer 1

2

... i wanted to scan it port

Port scanning essentially checks if a port is open on a specific IP address or not. For this port scanning it does not matter if there are multiple hostnames for the same IP address: the scan result will not change since the hostname is not relevant for the scanning in the first place but only the IP address.

The situation is different if one wants to get application level information though, like the contents of a website on a specific domain, the certificate returned etc. Here the hostname can make a difference, depending on the protocol. Notably for HTTP the hostname is given in the HTTP Host header, for TLS it can be given as SNI in the TLS handshake and for HTTPS both TLS and HTTP information are relevant.

For scanning at this level one first needs to know the relevant hostnames for this domain, i.e. there is no automatic mapping from IP address to all available hostnames. And the choice of tool then depends on what one want to extract as information - there is no generic tool to extract everything. A simple wget or curl is sufficient to get the contents of a website and openssl s_client can be used to get the certificate for example.

But again, all of this is not about port scanning anymore since if a port is open or closed does not depend on the actual hostname, only on the IP address and port.

1
  • There are certain cases where a different port could appear open depending on the domain. For instance, if the server is using packet filtering and perhaps checks for the value of a specific header. Let's say the header is "DNS-Original" which refers to the original hostname that was queried before it was converted to an IP address. If the packet filter allows certain packets through to certain ports only based on this header then in theory you can get different results on which ports are open for certain port scans.
    – Logan
    Aug 12, 2023 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .