IP to Virtualhost Lookup
Okay, I’m just totally in love with this post by Jaimie Sirovich over at SEO Egghead. He exposed a function that I’ve been wanting for a good long while. Some way to do IP to virtual host lookup. His solution, similar to my Cname lookup, is to use a search engine. I wasn’t aware of this flag in MSN, but apparently if you query it for IP addresses it will do exactly that. Well, nearly exactly that. I also points out any domains that are 301 redirecting or meta refreshing to your site. Strange! But whatever the case, it gets you 90% of the way there with not many false positives. Those false positives can be identified and removed by simply doing another lookup on those domains and seeing if they match the IP. Pretty trick!
In this way you can accurately identify SEO spammers, and virtual hosts. This is particularly useful for penetration testing because often since they are on the machine the hardened host is the main one. The softer hosts that reside on the same machine can be compromised and therefor giving you access to the same web application (and probably even the same apache process). Very scary stuff for anyone doing lots of hosting on single IPs. Thanks, for the post, Jaimie!
August 3rd, 2006 at 9:25 am
Also, one of my readers pointed out to me this thread on full disclosure a while back discussing other ways to do this form of detection including a tool. It’s worth a read.
August 6th, 2006 at 2:42 am
There are other tools that provide IP-to-domains tools.
http://whois.webhosting.info/
http://www.domaintools.com/reverse-ip/
Both are quite good.
August 8th, 2006 at 1:45 am
[…] Even scarier, ha.ckers.org reports that the very same information can be used by hackers for penetration testing. Suppose PHP is being run as a module, not a CGI. One of the other virtual hosts on your server is running an old exploitable version of PHPbb — a notoriously insecure web application; its historical vulnerabilities are listed here. This is great information, as a hacker could compromise the PHPbb installation and gain access to your data by extension. […]