Pentest & Bug Bounty Resources and Techniques
  • Pentest & Bug Bounty Resources and Techniques
    • Introduction
    • Tests Checklist
    • OSINT
    • Communications Security
      • SSL/TLS
    • Networking
      • Subdomains Discovery
        • DNS & OSINT
        • DNS Brute force
          • Second DNS Brute-Force Round
      • Subdomain Takeover
      • Network Host Scan/Discovery
        • External/Internal
        • Internal only
      • Network Vulnerability Scanning
      • Network Hacking
      • Parsing
      • Reporting
    • Brute Force
      • Wordlists
      • Databases
      • SSH
    • Web
      • Endpoint Discovery
      • Infrastructure & Configuration
        • Headers
        • WAF Detection/ Evasion
      • Injection
        • GraphQL
        • Cross-Site Scripting (XSS)
        • SQL Injection
        • Payloads
      • SSRF & XXE
        • Labs & Resources
        • Tools
        • SVG SSRF Cheatsheet
        • XXE - XEE - XML External Entity
      • JWT Vulnerabilities (Json Web Tokens)
      • HTTP/S DoS
    • Mobile
      • Both
        • SAST
          • MobSF
        • DAST
          • Installing Frida and Objection
      • Android
        • Create a Lab
          • Rooting Android Emulator
          • Rooting Android Emulator Cheat Sheet
        • APK Certificates
        • SAST
          • APKs
            • Get Information from APK
            • GDA (GJoy Dex Analysizer)
            • Scanning APK for URIs, endpoints & secrets
            • Google Maps API Scanner
        • DAST
          • Rooting the Android Studio AVDs
          • non-Rooted devices
            • Bypass SSL Pinning - non-rooted devices
              • Method 1: apk-mitm
              • Instrumentation with Frida and Objection
                • Bypass SSL Pinning - Method 2: With Objection Explore
                • Bypass SSL Pinning - Method 3: With root_bypass.js
          • Rooted Devices
            • Run frida-server in the emulator or device
            • Inject Frida
            • Bypass SSL Pinning - rooted devices
              • Install Burp CA as a system-level CA on the device
      • iOS
        • SAST
          • Building a reverse iOS engineering environment for free
          • Test Vulnerabilities
  • Lets Practice
    • Virtual Machines
    • Vulnerable App
    • Guided Labs
    • CTFs
  • Group 1
    • AI
Powered by GitBook
On this page
  1. Pentest & Bug Bounty Resources and Techniques
  2. Networking

Network Host Scan/Discovery

Resolve Hostnames to IPs (Linux example)

You can use tools like nslookup, dig, or host to resolve hostnames into IP addresses.

Automating the Process with a Script:

If you have many hostnames, you can write a simple script to resolve them into IP addresses and output a clean list. It ensures that output is in IPv4 format filtering for valid IPv4 addresses from the nslookup result, ensuring only IPv4 addresses are written to the output file.

Here’s a bash script to do that:

resolve_ips.sh
#!/bin/bash

# Check if both input and output files were provided
if [ $# -ne 2 ]; then
    echo "Usage: $0 <hostname_file> <output_file>"
    exit 1
fi

input_file="$1"
output_file="$2"

# Empty the output file if it already exists
> "$output_file"

# Read each line from the input file
while IFS= read -r line; do
    # Skip empty lines
    if [[ -z "$line" ]]; then
        continue
    fi

    # Check if the line is already a valid IPv4 address
    if [[ $line =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        echo "$line" >> "$output_file"
    else
        # Resolve the hostname to an IPv4 address using nslookup
        ip=$(nslookup "$line" | grep 'Address:' | grep -oE '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)' | tail -n 1)
        
        # Check if we got a valid IPv4 address
        if [[ -n $ip ]]; then
            echo "$ip" >> "$output_file"
        else
            echo "Failed to resolve $line to an IPv4 address" >&2
        fi
    fi
done < "$input_file"

echo "Resolved IPs saved to $output_file"

How to Use the Script:

  1. Save the script as resolve_ips.sh:

    nano resolve_ips.sh
  2. Make it executable:

    chmod +x resolve_ips.sh
  3. Run the script with your hostname list file as a parameter:

    ./resolve_ips.sh hostnames.txt resolved_ips.txt
  • This script now takes the file hostnames.txt (or any other file you provide as a parameter) and resolves the hostnames into IPs.

  • The output will be saved to resolved_ips.txt.

PreviousSubdomain TakeoverNextExternal/Internal

Last updated 8 months ago

Page cover image