loading
Loading content
loading
Recon
OSINT mapping from IP addresses to virtual hostnames.
overview
HostHunter reverses typical recon: start from IPs, recover the virtual hostnames each address serves. One IP often fronts many sites, so the interesting app rarely answers on the bare address.
Inputs are a targets file of IPs or a single -t address. --format writes CSV or TXT so the mapping lands in a spreadsheet or the next pipeline stage. Recovery leans on reverse DNS, TLS certificate names, and public OSINT sources.
Trickest runs HostHunter as a managed recon step that reads targets and writes a file plus a results folder. Place it after IP-range collection, then pass hostnames to httpx. For forward discovery from a domain, use subfinder.
use cases
Hand HostHunter a file of target IPs to recover the virtual hostnames each one serves, turning a netblock into named assets.
After mapping an organization's IP ranges, use HostHunter to find the hostnames on them, broadening the in-scope surface.
Choose CSV output to drop the IP-to-hostname mapping straight into a spreadsheet or asset inventory.
Pass discovered hostnames to httpx so the workflow continues against named web hosts instead of bare IPs.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| targets | FILE | · | File of target IP addresses to map to hostnames. |
| single-ip-target | STRING | -t | Scan a single IP instead of a file. |
| format | STRING | --format | Output file format, CSV or TXT. |
Showing key inputs. hosthunter exposes 3 inputs in total.
example
# map a file of target IPs to hostnames, export as CSVpython3 hosthunter.py targets.txt --format csv[*] Loaded 6 target IP addresses[+] 203.0.113.10 vpn.example.com[+] 203.0.113.11 mail.example.com[+] 198.51.100.24 www.example.com[+] 198.51.100.25 api.example.com[+] 198.51.100.26 staging.example.com[!] 203.0.113.12 no hostname found[*] 5 hostnames written to hosts.csvguidance
Use HostHunter when you start from IP addresses and need the hostnames behind them. For forward discovery from a domain, use subfinder. For live web verification of the hostnames it finds, follow with httpx.
Also derives hostnames from IPs via TLS and reverse DNS. Different sources, narrower output.
Forward discovery from a domain to subdomains. Opposite direction from HostHunter.
Probes which recovered hostnames are live web hosts. Run it after HostHunter.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
An IP list feeds HostHunter, which recovers the hostnames behind each address and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.