loading
Loading content
loading
Recon
A fast, simple tool for performing reverse DNS lookups en masse.
overview
hakrevdns takes a list of IP addresses and returns the hostnames their PTR records point to. Reverse DNS is a quiet way to widen an attack surface: feed it the ranges an organization owns and the results reveal domains and subdomains you would never find from the company name alone.
It stays small and fast by design. A thread count drives concurrency so a large IP set clears quickly, you can aim lookups at a specific resolver and port, and a domains-only mode strips the output down to bare hostnames when that is all you want to carry forward.
On Trickest, hakrevdns is a Recon node that reads an IP list and writes a file and a folder of results. Reach for it after resolving an organization's ASN to its prefixes, then hand the recovered hostnames to a resolver and an HTTP prober to learn which are live.
source github.com/hakluke/hakrevdns
use cases
Feed hakrevdns the IPs in an organization's prefixes so PTR records surface the domains and subdomains its name alone would never reveal.
Run it after mapping an ASN to its prefixes so reverse lookups widen the footprint before any active probing begins.
Set the domains-only flag to keep bare hostnames, ready to hand straight to a resolver or prober without extra parsing.
Point the resolver IP and port at a server you trust so bulk queries run at a rate you set.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | Target list of IP addresses to resolve. |
| resolver | STRING | -r | IP of the DNS resolver to use for lookups. |
| port | STRING | -p | Port to query the resolver on (default 53). |
| threads | STRING | -t | How many threads to use for concurrent lookups (default 8). |
| domains-only | BOOLEAN | -d | Output only the hostnames, without the source IP. |
Showing key inputs. hakrevdns exposes 5 inputs in total.
example
# reverse-resolve a /24 of owned IPs through a chosen resolverprips 198.51.100.0/24 | hakrevdns -r 203.0.113.53 -t 16198.51.100.10 mail.example.com.198.51.100.23 vpn.example.com.198.51.100.44 gw-edge01.example.com.198.51.100.58 mx1.corp.example.com.198.51.100.87 assets.cdn.example.com.198.51.100.113 legacy-app.example.com.198.51.100.140 ns2.example.com.198.51.100.201 staging.example.com.guidance
Use hakrevdns to turn a set of IP addresses into hostnames during recon, typically after resolving an ASN to its prefixes. It finds names, it does not test them, so follow it with a resolver and httpx. For forward enumeration from a domain, start with subfinder.
Discovers hostnames tied to IPs using multiple sources. hakrevdns is a focused PTR-lookup tool.
Versatile DNS toolkit that also does reverse lookups among many record types. Broader than hakrevdns.
Maps an organization to its ASN and IP ranges. Run it before hakrevdns to produce the IP list.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
An IP list feeds hakrevdns, which resolves the hostnames behind them and passes the names to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.