For example, given the range:
172.128.0.0 - 172.191.255.255
I need to find some domain that resolves to an IP-adress within the range. Is it possible ? I'm using a Linux system.
You can do reverse lookups on each IP in the range and search through the results for the domain you're looking for. However, this will only work if the person/s responsible for that domain created a PTR record for the IP.
This is a quick and dirty working example:
#!/usr/bin/env python
"""
ipAddrRange function ripped from:
http://vinojdavis.blogspot.com/2009/02/def-ipaddrrangestartaddr-endaddr-def.html
"""
import sys
import socket
def ipAddrRange(startAddr, endAddr):
def incrAddr(addrList):
addrList[3] += 1
for i in (3,2,1):
if addrList[i] == 256:
addrList[i] = 0
addrList[i-1] += 1
def asString(addrList):
return ".".join(map(str,addrList))
startAddrList = map(int,startAddr.split("."))
endAddrList = map(int,endAddr.split("."))
curAddrList = startAddrList[:]
yield asString(curAddrList)
for i in range(4):
while curAddrList[i] < endAddrList[i]:
incrAddr(curAddrList)
yield asString(curAddrList)
if len(sys.argv) > 1 and sys.argv[1]:
domain_filter = sys.argv[1]
else:
domain_filter = ""
for addr in ipAddrRange("172.128.0.0","172.191.255.255"):
ptr = socket.gethostbyaddr(addr)[0]
if domain_filter:
if domain_filter in ptr:
print ptr
else:
print ptr
Example run:
# ./reverse_spy.py aol
AC800000.ipt.aol.com
AC800001.ipt.aol.com
You can limit output to results matching the optional argument.
Also, limit your range as your example range is 4194304 IPs long. ;) Have people looking for ya with ranges like that.
Are you trying to find any DNS name that resolves to a specific IP; or are you trying to find all DNS names that resolve to an IP. The latter is impossible. The former is easily accomplished on almost any OS with:
nslookup
set type=ptr
(reversed-ip).in-addr.arpa
The (reversed-ip) part is what it sounds like. If your IP is 1.2.3.4, then reversed would be 4.3.2.1, and the third line would be:
4.3.2.1.in-addr.arpa
According to ARIN, 172.128.0.0/10 is owned by AOL. You could try querying AOL's listed DNS servers to see if they have reverse entries for the IP you're interested in. (Go to arin.net and search their whois for that network address.)
nmap -sL -R 172.128-191.0-255.0-255
-sL
lists the hosts without scanning. -R
forces DNS resolution.