lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87hdg036az.fsf@deneb.enyo.de>
Date: Tue Jun 14 23:47:30 2005
From: fw at deneb.enyo.de (Florian Weimer)
Subject: www.whois.sc

* Jimmy Stewpot:

> I have recently seen a web page www.whois.sc. One of the features that
> they have is a "reverse ip" lookup. With that tool I can lookup the IP
> address of a server and it will return how many domains are hosted on it.
>
> What I have been trying to figure out is how does that work? I did a
> tcpdump on the server that I looked up and it didnt see any abnormal
> packets. Does anyone have any idea how that feature works?

I suppose they regularly download zone files (as published by Verisign
and others), and perform A record lookups on all listed domains.
Probably they try domains prefixed with "www" as well.

A good litmus test is the output from 217.16.28.239.  Does it include
fark.ru and newsteam.ru besides pravda.ru?  What about all the
pravda.com subdomains?  (As far as I know, the RU zone file is not
available to the general public.)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ