Re: script for virtual host discovery

[Carlos Pantelides <carlos_pantelides () yahoo com>]

David:

> Your script works by trying a HEAD request for / using 
> each of the candidate hostnames. But there's no reason
> this technique should be limited to hosts running HTTP.
> What do you think about doing a simple DNS query for 
> each candidate hostname instead?

Well, this script is looking for unregistered, local names associated with virtual http hosts, it is "darknet" 
exploring. You can even run it in a host without connectivity. 

Perhaps a name for a http virtual host is not known to the hosting machine. In my original idea the script was planned 
to support ftp and smtp virtual hosts, but I thought it was worthless.

> > Also I'm thinking that this would fit in well as an add-on to the
hostmap script...

I will see with more detail and answer soon.

> Where does the hostnames.lst file come from?

I run "comparison" against wikipedia, then filtered for crm, project management and so and lastly, take the systems 
that support web interfaces.

http://en.wikipedia.org/wiki/Comparison_of_project_management_software

A better name would be virtual_names.lst.

Carlos Pantelides.



      
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/