Menu

HostHunter a recon tool for discovering hostnames using OSINT techniques

A tool to efficiently discover and extract hostnames providing a large set of target IP addresses

IP Domain Extra
Hosthunter options

Features.

  • Extracts information from SSL/TLS certificates.
  • Supports Free API requests.
  • Scraps Bing.com results.
  • Gathers information from HTTP headers.
  • Takes Screenshots of the target applications.
  • Validates the targets IPv4 address.
  • Verifies Internet access.
  • Retrieves hostname values from services at 21/tcp, 25/tcp, 80/tcp and 443/tcp ports.

A tool to efficiently discover and extract hostnames providing a large set of target IP addresses. HostHunter utilises simple OSINT techniques to map IP addresses with virtual hostnames. It generates a CSV or TXT file containing the results of the reconnaissance.

HostHunter a recon tool for discovering hostnames
Bugbounty with Hosthunter

This tool is handy for bugbounty professionals

Recon your webapplication

This tool can be used to find out more extra information about web application

Hosthunter

This package contains a tool to efficiently discover and extract hostnames providing a large set of target IP addresses. HostHunter utilises simple OSINT techniques to map IP addresses with virtual hostnames. It generates a CSV or TXT file containing the results of the reconnaissance. Latest version of HostHunter also takes screenshots of the targets, it is currently a beta functionality

Get All domains sharing IP

Get All domains sharing a given IP addresses, for example one cloudflare IP can host numerous domains, you can find all of them returned including the IP and the domains associated with the API.

Why use it

If you want to find websites being hosted on a single ip address. For example many websites run behind cloudflare but using a single ipaddress, this tool enumerates hostnames from bing for an IP address, this happens to be a feature unique with being alone.