Finding domains on targeted host | Reverse IP lookup

" Reverse IP Lookup " is a very  useful concept for the penetration testers to find out domains which are hosted in targeted host  . Using this concept you can find out the number of domains hosted on a server lets say s4ur4v.com is a server with a server address 1.1.1.1 now when you do a reverse IP lookup on that server you will find the other domains hosted on the same server.

Whats the theory behind this  ?
All web servers are assigned with a unique IP address . If a web server is running a website the IP a address of the site will be same as that of the server. Now if there are multiple domains hosted on the same web server  they will be also having the same IP address of the server . By using this concept " Reverse IP Lookup " we instruct the lookup process to look the number of domains on the target server/host 

How to do a Reverse IP Lookup ? 

Their are a lots of ready made sites which offer you to do a reverse IP look up like yougetsignal

-Go to http://www.yougetsignal.com/
-Gype the server address / website URL
-Click on check and bingo you get the number of domains on the server you looked up

Next i will show you how to do this with a python script which will be using Bing's API to find our dinner ( You can use also DRIL which uses the same )

1. import httplib, urllib, socket, sys
2. from xml.dom.minidom import parse, parseString
5. if len(sys.argv) == 2:
6.  AppId = '1734E2C92CA63FAA596335295B09CF1D0B5C6161'
7.  domain = sys.argv[1]
8.  sites = [domain]
10.  ip = socket.gethostbyname(domain)
11.  offset = 50
12.  while offset < 300:
13.   uri = "/xml.aspx?AppId=%s&Query=ip:%s&Sources=Web&Version=2.0&Market=en-us&Adult=Moderate&Options=EnableHighlighting&Web.Count=50&Web.Offset=%s&Web.Options=DisableQueryAlterations"%(AppId, ip, offset)
15.   conn = httplib.HTTPConnection("api.bing.net")
16.   conn.request("GET", uri)
17.   res = conn.getresponse()
18.   data = res.read()
19.   conn.close()
22.   xmldoc = parseString(data)
23.   nameEls = xmldoc.getElementsByTagName('web:DisplayUrl')
24.   for el in nameEls:
25.    temp = el.childNodes[0].nodeValue
26.    temp = temp.split("/")[0]
27.    if temp.find('www.') == -1:
28.     if temp not in sites:
29.      sites.append(temp)
31.   offset += 50
33.  print "\n\n"
34.  print "Total: %d domain(s)\n\n"%len(sites)
35.  for i in sites:
36.   print i
37.  print "\n\n"
39. else:
40.  print "\n\n\n"
41.  print "=====================================\n"
42.  print "Usage: $ python reverse.py domain.com\n"
43.  print "Ex: $ python reverse.py hackersbay.in   \n"
44.  print "=====================================\n"
45.  print "\n\n\n"

Windows users please mind it you have python installed in your OS before running this script.I am going to show it using Backtrack 

- Copy the above script and paste it in a file rename it to reverse.py

- Browse through the directory you saved the file in e.g cd /dir 

- to execute the script you have to just write python reverse.py and then it will show you the how to do the rest :D 

root@bt:~# cd /pentest 

root@bt:/pentest# python reverse.py 

=====================================

Usage: $ python reverse.py domain.com

Ex: $ python reverse.py enhack.net   

=====================================

root@bt:/pentest# python reverse.py davunit8.org

Total: 103 domain(s)

davunit8.org

psplindia.com

jnvkeonjhar.com

microfinanceltd.com

puspitamishra.com

htti-cuttack.com

neemworld.com

keonjhar.net

origininfosystem.com

cippl.com

newditech.com

caravanholidaysindia.com

niateducation.com

sunrayadv.com

spanscaffold.com

suinsys.com

ihmbbs.org

mohindratourist.com

hiem-bdk.org

immunologyofdiabetessociety.com

pipilicrafts.com

dhaneswarinstitutekatak.com

indomer.com

itibalasore.org... continues 

I missed something ? feel free to comment 

Continue Reading

World IPv6 Day

World IPv6 Day is an event sponsored and organized by the Internet Society and several large content providers to test public IPv6 deployment. It will start 00:00 UTC on June 8, 2011 and end 23:59 the same day.Web giants Facebook, Yahoo, and Google, with a combined one billion visitors per day, are participating by enabling IPv6 for their main services that day. Content distributors Limelight and Akamai are also joining the party by enabling their customers to participate. But unlike during the IETF IPv6 experiment, IPv4 won't be turned off.

Yahoo, Google, and Facebook have each been working on IPv6 for some time, but have been avoiding  to simply flip the IPv6 switch and add an IPv6 address to their DNS records so everyone can reach them over IPv6. They fear becoming unreachable to users with broken IPv6 connectivity. Google did measurements in this area in 2008, which showed that at that time, 0.09 percent of their users would have to suffer delays as their computers try to connect over IPv6, and eventually fail and retry over IPv4.

So Google created the Google over IPv6 program, where network operators have to promise the search giant that they have good IPv6. In turn, Google will respond to DNS requests from those networks with IPv6 addresses for various Google properties such as google.com and youtube.com. The hoi polloi have to make do with just IPv4 or type ipv6.google.com. (Only works if you have IPv6.) Facebook has www.v6.facebook.com—with address 2620:0:1cfe:face:b00c::3 

-HOW TO TAKE PART

Interested in joining the other organizations that are taking part in this initiative? Select your type of organization below and you’ll find everything you need to participate in World IPv6 Day:


http://isoc.org/wp/worldipv6day/

-Test Your Connectivity 

http://test-ipv6.com/

Thank You 

Continue Reading

Asia runs out of IPv4 addresses

The Asia Pacific Network Information Centre (APNIC) has run out of all but a handful of IPv4 addresses that it is holding in reserve for start-up network operators.

APNIC is the first of the Internet's five regional Internet registries to deplete its free pool of IPv4 address space.
APNIC's news is another sign that CIOs and other IT executives need to begin migrating to IPv6, the long-anticipated upgrade to the Internet's main communications protocol known as IPv4.

"For anybody who hasn't figured out that it's time to do IPv6, this is another wake-up call for them," says Owen DeLong, an IPv6 evangelist at Hurricane Electric and a member of the advisory council of the American Registry for Internet Numbers (ARIN), the North American counterpart to APNIC.
Any CIO who isn't planning for IPv6 is "driving toward a brick wall and closing your eyes and hoping that it's going to disappear before you get there," DeLong says. Ignoring IPv6 "is not the best strategy."
Most IPv4 address space is expected to be handed out by the regional Internet registries by the end of 2011.

IPv4 uses 32-bit addresses and can support 4.3 billion devices connected directly to the Internet. IPv6, on the other hand, uses 128-bit addresses and supports a virtually unlimited number of devices -- 2 to the 128th power.
The Asia Pacific region has been gobbling up the most IPv4 address space in recent years. Geoff Huston, Chief Scientist at APNIC, said APNIC allocated more than 58 million IPv4 addresses in the last two months alone: 41.2 million in March and 16.8 million in April. Among the largest allocations since February 1 were 8.3 million to NTT Communications of Japan, 4.1 million addresses to China Mobile, 4.1 million addresses to KDDI of Japan. and 3.1 million to North Star Information of China. Three other carriers -- India's Bharti Airtel Ltd.,  Pakistan Telecommunications and Chinanet Hunan Province Network -- all received 2 million IPv4 addresses.
APNIC has depleted its IPv4 address space "dramatically faster than people expected," DeLong says. "My guess is that a lot of operators in the Asia Pacific region realized the time of IPv4 depletion was drawing near and they rushed to get their applications in."


APNIC is holding 16.7 million IPv4 addresses -- dubbed a /8 in network engineering terms -- in reserve to distribute in tiny allotments of around 1,000 addresses each to new and emerging IPv6-based networks so they can continue to communicate with the largely IPv4-based Internet infrastructure.
ARIN, which doles out IPv4 and IPv6 address space to companies operating in North America, predicts that it will run out of IPv4 addresses this fall.
"RIPE [the European Internet registry] is going to be the next one to run out. I wouldn't count on them making it until July," DeLong says. "I think ARIN will make it to the end of this year; maybe we'll run out in October or November."

Continue Reading

Geo location&Information Gathering

Gelocation has been a hot topic in the social engineering world for quite some time. As a social engineer it is important to be able to profile your targets efficiently. Tools like SET and Maltego make social engineering engagements easier.

Yet up until now there wasn’t a tool out there that helped a social engineer track the physical where-a-bouts of their targets. Of course you could go to their twitter, facebook, 4square and other social media accounts and gather all their messages and then find posts that have geo data in them and then take the time to gather all the details and make sense of them.

What if there was a way to retrieve information from Twitter as well as FourSquare. In addition, if you could then gather any geolocation data from flickr, twitpic.com, yfrog.com, img.ly, plixi.com, twitrpix.com, foleext.com, shozu.com, pickhur.com, moby.to, twitsnaps.com and twitgoo.com would that be impressive?

Enters Mr. Yiannis Kakavas. Yiannis approached Social-Engineer.Org with a beta of a tool he calls Cree.py…. and all I can say is creepy it is.

After a few minutes of installation it is up and running in BackTrack 4, Linux or Windows and you can track any targets gelocation from their tweets and social media.

Installation:

As I mentioned, installation in BackTrack is quite simple:
In a command console type:
Nano /etc/apt/sources.listAnd add this to the end:
deb http://people.dsv.su.se/~kakavas/creepy/ binary/Then in the console type:
apt-get updateThen to install cree.py type:
apt-get install creepyCreepy is now in the global menu under Applications-> Internet.
Or can be run by typing
CreepymapInto the console.

Running Cree.py

Once you start creepy up you are greeted by a very nice GUI interface:

Creepy Interface

In the “Search For” box you type in the full name of your target and hit “search”:

Searching with in Creepy

Once the search is done you can scroll through all your choices and double click them.  Which will place their nick into the Username field.
After that click the “Geolocate Target” button:

The Geolocation Map

That opens up the map view tab and starts to scrape through the targets tweets and other information looking for geolocation data.  When it is done searching:

Geo Data Galore

Some of the other great features of Cree.py is that you can export your targets map as a Google Earth filter and then open it up in Google Earth.

Google Earth Data

As you can see Cree.py is just that – CREEPY, but what a great tool to gather information and building profiles on targets.

source:social-engineer . org

Continue Reading