rIP - Reverse IP

Printable View

February 7th, 2008, 05:48 AM
HTRegz

rIP - Reverse IP

This is another tool I wrote about a while ago, rIP - Reverse IP is rather cool.

It's developed by a group called Crush, and they maintain a database (currently .com, .org and .net mapping every domain by IP, so they can query an IP and find all associated domains).... This is VERY handy for pen-testers and social engineers.

Example query (antionline.com):

Quote:

Showing records 1 - 3 out of 3 for antionline.com. (63.146.109.212).

antionline.com antionline.org
antionline.net

An interesting query to run is google.com, you can see how many people have redirected their domains to Google (who knows why)... there are quite a few.

Either way... it's a very interesting tool. The database is available (single purchase, no updates for $20) and you can purchase a new database monthly.... so, if you have a use for it and don't want to use it online but would rather direct access to the database you're looking at $240/year.
February 7th, 2008, 06:59 AM
ArPaNET

Interesting tool, but for $240/year USD... I think I will stick to Netcraft.

http://news.netcraft.com/
February 7th, 2008, 07:30 AM
phishphreek

Quote:

Originally Posted by ArPaNET

Interesting tool, but for $240/year USD... I think I will stick to Netcraft.

http://news.netcraft.com/

My thoughts exactly. There are far too many tools out there that are free to pay for free information.
February 7th, 2008, 07:49 AM
HTRegz

Quote:

Originally Posted by ArPaNET

Interesting tool, but for $240/year USD... I think I will stick to Netcraft.

http://news.netcraft.com/

Nobody said you had to pay for it... the $240/year USD would be for a vendor of some sort that may want to purchase the database for inclusion with a product... Searching the database through the web interface is free...

Out of curiosity... where's the netcraft tool that performs this? I haven't seen one before.
February 8th, 2008, 06:43 PM
disfigure

Hello-

Thanks HTRegz for plugging the site. And like you said, the results are free and even available as a gz file! (useful for large result sets)

I will be adding .us and .info in the near future and I will also be attempting to resolve common subdomains (www, mail, etc.)

The primary reason I sell the database is to pay for my costs. I have to rent VMs to perform the mass lookup. I think $20 is a reasonable cost for the ENTIRE database, and of course it is not required that a person buy it every month. If there is interest in the future for "subscriptions" to the build I will certainly create a discounted price model.

Anyway, I hope you guys like the site.

-d-
February 8th, 2008, 06:53 PM
MrLinus

Quote:

Originally Posted by HTRegz

Nobody said you had to pay for it... the $240/year USD would be for a vendor of some sort that may want to purchase the database for inclusion with a product... Searching the database through the web interface is free...

Out of curiosity... where's the netcraft tool that performs this? I haven't seen one before.

See here: http://news.netcraft.com/

Netcraft is more than an IP reversal. It often also indicates a best guess as to OS and Webserver (it used to have version info as well but I'm not sure if it still includes that). :)
February 8th, 2008, 07:14 PM
disfigure

Quote:

Originally Posted by MsMittens

See here: http://news.netcraft.com/

Netcraft is more than an IP reversal. It often also indicates a best guess as to OS and Webserver (it used to have version info as well but I'm not sure if it still includes that). :)

Reverse IP != Reverse DNS

Reverse IP is a generic term that has been used to indicate looking up all vhosts on a particular IP address. You can not get this information with a reverse DNS lookup, as it will only return the records from the authoritative zone.

AFAIK, Netcraft does not offer a reverse IP tool, i.e. a tool used to search by IP for all vhosts on a system. All I can see is a query which returns domains matched by the input string. If they *do* provide a true reverse ip tool, I would certainly like to see it. I like to test my results against similar services.

-d-
February 8th, 2008, 07:16 PM
MrLinus

Ah.. I see what you're referring to and true.
February 8th, 2008, 10:01 PM
ArPaNET

Quote:

Originally Posted by HTRegz

Nobody said you had to pay for it...

I didn't get that out of your post... thanks for clearing that up!
I am on the same page as MsMittens; neat program though =)
February 8th, 2008, 10:01 PM
HTRegz

Quote:

Originally Posted by disfigure

Reverse IP != Reverse DNS

Reverse IP is a generic term that has been used to indicate looking up all vhosts on a particular IP address. You can not get this information with a reverse DNS lookup, as it will only return the records from the authoritative zone.

AFAIK, Netcraft does not offer a reverse IP tool, i.e. a tool used to search by IP for all vhosts on a system. All I can see is a query which returns domains matched by the input string. If they *do* provide a true reverse ip tool, I would certainly like to see it. I like to test my results against similar services.

-d-

Thank you :)

For a second I thought I was going crazy :)