By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes.
My question is, what are the benefits of getting the host name when performing a network scan?
-
4Hostnames are often more meaningful than IP address, "mail.example.com" seems to be a mail server, "proxy.example.com" a proxy server, "fw.example.com" a firewall, etc. Its more meaningful than things like "192.168.7.32", so it may provide supplementary and useful information. – WhiteWinterWolf Jul 25 '15 at 14:13
Where nmap is used during a security test any information revealed by the scan may be useful as part of the test.
In the case of reverse DNS lookups it can be specifically of use as some services will only respond to requests made to a host name and not an IP address.
So if your test starts with a range of IP addresses, part of the review would be to enumerate valid websites hosted in that range, for further testing, and this could help you achieve that goal.
answered Jul 28 '15 at 12:43
Mostly Knowing the hostname you can know which ip the domain name or subdomain maps to. From the information of the hostnames you can check whether the site is vulnerable to different vulnerabilities like subdomain takeover vulnerability.
In case of subdomain takeover vulnerability suppose you found support.somedomain.com, now you can visit the website and check whether you can exploit the domain to point your own domain by using subdomain takeover.
There are other attacks which can be executed if we get to know the hostnames as well as ip. So yes, getting the hostnames using nmap scan is good information.
