Printable View
I swear there used to be a site with a database of subdomain names. Like you type in the main domain name, for example: domain.com, and it serves out a list of recorded or known subdomains, such as mail.domain.com, serverx.domain.com etc. I've been searching google for the past hour and played around with nslookup, but I'm stumped.
Anyone wanna shed some light on this one for me and whoever else may be looking for this type of information?
Hi, you are certainly not crazy.............. I remember that..........
Try DNS stuff and advanced DNS stuff?
Will look around later ;);)
cheers
yeah I tried dns stuff, but's that's not what I'm looking for. I think that this site actually crawled the web for the purpose of finding and and adding subdomains to a database so that in case they "dissapeared" it was still possible to find them.Quote:
Originally Posted by nihil
Not to be pedantic, but he could be right about the subdomain database and still be crazy:DQuote:
Originally Posted by nihil
DNSstuff.com used to offer that as a free service, I believe. All their
stuff was free. Then they went to a paid subscriber service (two plans
actually) about two or three years back (hey, you gotta make a living).
Check out their "tool sets" as they call them.
http://www.dnsstuff.com/
PLEASE NOTE: I'm Not specifically looking for a reverse dns lookup. As I mentioned earlier, I tried DNS stuff...it's not what I'm looking for.Quote:
Originally Posted by brokencrow
I'm looking for cached dns information .
Here:
Let's say that once upon a time. An organization with the domain "domain.com" had a website in 1999 that had links to several of the organization's internal servers available to the publicon the main page, but as time went on and admins got smarter, the links were removed from public view in 2003. However the links were not dead.
If you wanted to discover these links, you could try google's cache of the site and maybe find what you are looking for, OR you could use archive.org and view the pages as there were in 1999 and find the links.
The service that I'm looking for, which I cannot for the life of me remember the name of, was like archive.org except instead of caching pages it collected subdomains. So, if at one point in time, if domain.com or any site that this service crawled contained links to subdomains for domain.com then it would put this information in a database and make it available to the public. By using this site you'd be able to easily see what subdomains were known about domain.com like:
Information about domain.com
domain.com (IP HERE)
webserver.domain.com (IP HERE)
mailserver.domain.com(IP HERE)
and it held other information about the domain as well. I hope this clarifies what I'm looking for. Please do not suggest DNS stuff, as my copy of windows comes with nslookup, thank you.
There's a script here that will look for subdomains : http://www.edge-security.com/subdomainer.php
They also have heaps of other cool tools for Pentesting.
Cheers,
Niggles
i think ive found what you've been lookin for. try this site http://www.networksolutions.com/whois/index.jsp
after u do a search scroll down towards the bottom. you should find a see listings link. im pretty sure thats what ur lookin for. hope this helps
Another website that is real good at giving that information is Central-Ops.
http://centralops.net/co/
Treanglin, I know exactly what you meant. DNSstuff used to be all free
and I recall doing a couple of lookups there like you're describing.
Try 'dig'. It's a Unix lookup utility. I know it's part of BSD, not sure about
Linux.
http://linux.about.com/od/commands/l/blcmdl1_dig.htm
Here's a 'howto':
http://freebsdhowtos.com/62.html
HTH.
years ago, no one stopped queries for dns xfers, now a days just to aid in the information gathering technique for hacking, most not deny requests for xfers.
My point being, it is more difficult for any single entity to maintain a database of subdomains, since they are really only recorded by the domains name servers of record.
You can get the root domain from net sol but not subdomains. Very difficult these days without the use of xfer via commands such as dig.