{"id":3068,"date":"2014-05-02T19:22:16","date_gmt":"2014-05-02T11:22:16","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3068"},"modified":"2014-05-02T19:22:23","modified_gmt":"2014-05-02T11:22:23","slug":"host-extract-enumerate-iphost-patterns-web-page","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/05\/host-extract-enumerate-iphost-patterns-web-page\/","title":{"rendered":"Host-Extract &#8211; Enumerate All IP\/Host Patterns In A Web Page"},"content":{"rendered":"<p>host-extract is a little ruby script that tries to extract all IP\/Host patterns in page response of a given URL and JavaScript\/CSS files of that URL.<\/p>\n<p>With it, you can quickly identify internal IPs\/Hostnames, development IPs\/ports, cdn, load balancers, additional attack entries related to your target that are revealed in inline js, css, html comment areas and js\/css files.<\/p>\n<p>This is unlike a web crawler which looks for new links only in HTML anchor tags or the like. Using that method you might miss many additional targets if you ever use such web crawler or other GUI-based tools that shows you your main target and its relationship with its linked sub\/off-site domains.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/farm8.staticflickr.com\/7377\/13901435490_8c16fc9871.jpg\" alt=\"Host Extract \" \/><\/p>\n<p>In some cases, host-extract may give you false positives when there are some words like &#8211; main-site_ver_10.2.1.3.swf. With the -v option, you can ask the tool to output html view-source snippets for each IP\/Domain extracted. This will shorten your manual analysis time.<\/p>\n<p><strong>Usage<\/strong><\/p>\n<pre>ruby host-extract.rb URL [option]\r\n\r\nUsage: host-extract [options]\r\n        -a               find all ip\/host patterns\r\n        -j               scan all js files\r\n        -c               scan all css files\r\n        -v               append view-source html snippet for manual verification<\/pre>\n<p>There are other tools that do similar things, some overlap, but nothing exactly like this. host-extract would be well combined with the following:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2007\/12\/wsscanner-web-services-footprinting-discovery-enumeration-scanning-and-fuzzing-tool\/\">wsScanner \u2013 Web Services Footprinting, Discovery, Enumeration, Scanning and Fuzzing tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2012\/01\/theharvester-gather-e-mail-accounts-subdomains-hosts-employee-names-information-gathering-tool\/\">theHarvester \u2013 Gather E-mail Accounts, Subdomains, Hosts, Employee Names \u2013 Information Gathering Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2012\/10\/web-sorrow-v1-48-version-detection-cms-identification-enumeration-server-scanning-tool\/\">Web-Sorrow v1.48 \u2013 Version Detection, CMS Identification, Enumeration &#038; Server Scanning Tool<\/a><\/p>\n<p>You can grab host-extract via SVN here:<\/p>\n<pre>svn checkout http:\/\/host-extract.googlecode.com\/svn\/trunk\/ host-extract-read-only<\/pre>\n<p>Or read more <a href=\"https:\/\/code.google.com\/p\/host-extract\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>host-extract is a little ruby script that tries to extract all IP\/Host patterns in page response of a given URL and JavaScript\/CSS files of that URL. With it, you can quickly identify internal IPs\/Hostnames, development IPs\/ports, cdn, load balancers, additional attack entries related to your target that are revealed in inline js, css, html comment [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"host-extract is a little ruby script that tries to extract all IP\/Host patterns in page response of a given URL and JavaScript\/CSS files of that URL.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9,15],"tags":[7552,2345,2501,56,47],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3068"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3068"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3068\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}