By default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes.
My question is, what are the benefits of getting the host name when performing a network scan?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityBy default NMAP does reverse DNS resolution for a given IP which responds to the host discovery probes.
My question is, what are the benefits of getting the host name when performing a network scan?
Where nmap is used during a security test any information revealed by the scan may be useful as part of the test.
In the case of reverse DNS lookups it can be specifically of use as some services will only respond to requests made to a host name and not an IP address.
So if your test starts with a range of IP addresses, part of the review would be to enumerate valid websites hosted in that range, for further testing, and this could help you achieve that goal.
Mostly Knowing the hostname you can know which ip the domain name or subdomain maps to. From the information of the hostnames you can check whether the site is vulnerable to different vulnerabilities like subdomain takeover vulnerability.
In case of subdomain takeover vulnerability suppose you found support.somedomain.com, now you can visit the website and check whether you can exploit the domain to point your own domain by using subdomain takeover.
There are other attacks which can be executed if we get to know the hostnames as well as ip. So yes, getting the hostnames using nmap scan is good information.