loading
Loading content
loading
Recon
Bulk reverse DNS lookups from an IP list.
overview
hakrevdns reads a FILE of IPs and writes PTR hostnames to FILE and FOLDER. Point -r at a resolver, -p at its port, raise -t for concurrency, and use -d when you want bare names only.
Reach for it after ASN-to-prefix mapping when forward enum from a company name still leaves IP space dark. PTR hits often name mail, VPN, and edge hosts the domain tree never showed.
Trickest runs hakrevdns as a managed Recon node. It finds names only; follow with a resolver and httpx. For forward subdomain enum from a root, start with subfinder instead.
source github.com/hakluke/hakrevdns
use cases
Feed hakrevdns the IPs in an organization's prefixes so PTR records surface the domains and subdomains its name alone would never reveal.
Run it after mapping an ASN to its prefixes so reverse lookups widen the footprint before any active probing begins.
Set the domains-only flag to keep bare hostnames, ready to hand straight to a resolver or prober without extra parsing.
Point the resolver IP and port at a server you trust so bulk queries run at a rate you set.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | Target list of IP addresses to resolve. |
| resolver | STRING | -r | IP of the DNS resolver to use for lookups. |
| port | STRING | -p | Port to query the resolver on (default 53). |
| threads | STRING | -t | How many threads to use for concurrent lookups (default 8). |
| domains-only | BOOLEAN | -d | Output only the hostnames, without the source IP. |
Showing key inputs. hakrevdns exposes 5 inputs in total.
example
# reverse-resolve a /24 of owned IPs through a chosen resolverprips 198.51.100.0/24 | hakrevdns -r 203.0.113.53 -t 16198.51.100.10 mail.example.com.198.51.100.23 vpn.example.com.198.51.100.44 gw-edge01.example.com.198.51.100.58 mx1.corp.example.com.198.51.100.87 assets.cdn.example.com.198.51.100.113 legacy-app.example.com.198.51.100.140 ns2.example.com.198.51.100.201 staging.example.com.guidance
Use after you have owned IP ranges and need PTR hostnames. Pair with asnmap upstream; follow with httpx. Prefer subfinder when the seed is a domain, not an IP list.
Discovers hostnames tied to IPs from multiple sources. hakrevdns stays a focused PTR-lookup client.
Broader DNS toolkit with reverse lookups among many record types. Heavier surface than hakrevdns.
Maps an organization to ASN and IP ranges. Run it before hakrevdns to produce the IP list.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
An IP list feeds hakrevdns, which resolves the hostnames behind them and passes the names to httpx so only live hosts land as output.
Facts on this page come from the live Trickest tool library.