bing-ip2hosts - Enumerate hostnames for an IP using bing.com

M2G · December 22, 2012

Introduction

Bing.com is a search engine owned by Microsoft formerly known as MSN Search and Live Search. It has a unique feature to search for websites hosted on a specific IP address. This feature is can be used with the IP: parameter in the search query as shown in the image above.

Bing-ip2hosts uses this feature to enumerate all hostnames which Bing has indexed for a specific IP address. This technique is considered best practice during the reconnaissance phase of a penetration test in order to discover a larger potential attack surface. Bing-ip2hosts is written in the Bash scripting language for Linux. This uses the mobile interface and no API key is required.

Usage

Usage: ./bing-ip2hosts [OPTIONS]

OPTIONS are:
-n	 Turn off the progress indicator animation
-t <DIR>	Use this directory instead of /tmp. The directory must exist.
-i	 Optional CSV output. Outputs the IP and hostname on each line, separated by a comma.
-p	 Optional http:// prefix output. Useful for right-clicking in the shell.

Example usage and output

$ ./bing-ip2hosts treshna.com
[ 210.48.71.196 | Scraping 10-19 of 27 | Found 13 | \ ]
annaklekottka.com
ignavus.net
ladychatterley.co.nz
massivenz.com
nzbridgecongress.co.nz
nzcps.treshna.com
stac.treshna.com
www.cricklewoodhouse.co.nz
www.dressfordialogue.com
www.glaciervalley.co.nz
www.hurunuihotel.co.nz
www.ignavus.net
www.kokiribnb.co.nz
www.massivenz.com
www.nzkiosk.co.nz
www.zqnbalmoral.co.nz