Recon
Resolve owned IP ranges into hostnames
Bulk reverse DNS lookups from an IP list.
overview
What hakrevdns does
hakrevdns reads a FILE of IPs and writes PTR hostnames to FILE and FOLDER. Point -r at a resolver, -p at its port, raise -t for concurrency, and use -d when you want bare names only.
Reach for it after ASN-to-prefix mapping when forward enum from a company name still leaves IP space dark. PTR hits often name mail, VPN, and edge hosts the domain tree never showed.
Trickest runs hakrevdns as a managed Recon node. It finds names only; follow with a resolver and httpx. For forward subdomain enum from a root, start with subfinder instead.
source github.com/hakluke/hakrevdns
use cases
Where hakrevdns fits
Turn owned IP ranges into hostnames
Feed hakrevdns the IPs in an organization's prefixes so PTR records surface the domains and subdomains its name alone would never reveal.
Extend an ASN-based recon sweep
Run it after mapping an ASN to its prefixes so reverse lookups widen the footprint before any active probing begins.
Carry forward a clean name list
Set the domains-only flag to keep bare hostnames, ready to hand straight to a resolver or prober without extra parsing.
Route lookups through a resolver you control
Point the resolver IP and port at a server you trust so bulk queries run at a rate you set.
reference
hakrevdns inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | Target list of IP addresses to resolve. |
| resolver | STRING | -r | IP of the DNS resolver to use for lookups. |
| port | STRING | -p | Port to query the resolver on (default 53). |
| threads | STRING | -t | How many threads to use for concurrent lookups (default 8). |
| domains-only | BOOLEAN | -d | Output only the hostnames, without the source IP. |
Showing key inputs. hakrevdns exposes 5 inputs in total.
example
Run hakrevdns
# reverse-resolve a /24 of owned IPs through a chosen resolverprips 198.51.100.0/24 | hakrevdns -r 203.0.113.53 -t 16198.51.100.10 mail.example.com.198.51.100.23 vpn.example.com.198.51.100.44 gw-edge01.example.com.198.51.100.58 mx1.corp.example.com.198.51.100.87 assets.cdn.example.com.198.51.100.113 legacy-app.example.com.198.51.100.140 ns2.example.com.198.51.100.201 staging.example.com.guidance
Choosing hakrevdns
Use after you have owned IP ranges and need PTR hostnames. Pair with asnmap upstream; follow with httpx. Prefer subfinder when the seed is a domain, not an IP list.
hosthunter
Discovers hostnames tied to IPs from multiple sources. hakrevdns stays a focused PTR-lookup client.
dnsx
Broader DNS toolkit with reverse lookups among many record types. Heavier surface than hakrevdns.
asnmap
Maps an organization to ASN and IP ranges. Run it before hakrevdns to produce the IP list.
faq
hakrevdns questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run hakrevdns yourself
An IP list feeds hakrevdns, which resolves the hostnames behind them and passes the names to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.