BACKTRACK 5 R3 : ReverseRaider

1.   This post will brief on a tool known as Reverse Raider available in the information gathering menu drop down in Backtrack 5

About the Tool 

2.   ReverseRaider is a domain scanner that uses various techniques, such as wordlist scanning to find target's subdomains or reverse resolution for a range of ip.It's fully multi-threaded and supports permutation on wordlist, IPv6 and various DNS options (e.g. no-recursion).

3. Developed by  Acri Emanuele at crossbower@gmail.com

Usage: reverseraider -d domain | -r range [options]
 

Options:

  -r    range of ipv4 or ipv6 addresses, for reverse scanning
        examples: 208.67.1.1-254 or 2001:0DB8::1428:57ab-6344
  -f    file containing lists of ip addresses, for reverse scanning
  -d    domain, for wordlist scanning (example google.com)
  -w    wordlist file (see wordlists directory...)
 

Extra options:
  

  -t    requests timeout in seconds
  -P    enable numeric permutation on wordlist (default off)
  -D    nameserver to use (default: resolv.conf)
  -T    use TCP queries instead of UDP queries
  -R    don't set the recursion bit on queries

4.   Most of the  DNS enumeration scripts available in backtrack focus on typical DNS but reverseraider does what it sounds like it might do which is enumerate reverse DNS names. Enumerating reverse DNS on an IP or set of IP’s can sometimes reveal information you did not previously have. It is possible to be targeting a web server that has a bunch of virtual hosts and you prefer to track down primary web site on the web server which is where reverseraider may provide the results necessary as it is more likely that the most important site on the virtual web server has reverse DNS configured on the host itself. 

5.   I found out this very useful and exhaustive post at http://www.question-defense.com/2012/04/01/backtrack-5-information-gathering-network-analysis-dns-analysis-reverseraider

This post gives an excellent description with details of three methods of using reverseraider.

BACKTRACK 5 R3 : LBD [ Load Balancing Detector ]

1.   Before we start working on this tool,we need to first get clear of what exactly is Load Balancing?

2.    Load balancing is a method to distribute workload over multiple computers , network links, central processing units, disk drives, or other resources, to achieve optimal resource utilization, maximize throughput, minimize response time, and avoid overload. So before any one performs a penetration test, some recon work needs to be done on the target domain to make sure it does not have the ability to misdirect any probes and attacks.

About the Tool : LBD

3.   LBD (Load Balancing Detector) is a small script that tells if a given domain uses DNS and/or HTTP Load-Balancing (via Server: and Date: header and diffs between server answers). The main purpose of the tool is to check if the given domain uses load balancing.In other words when a server uses load balancing to distribute its work load over multiple systems, it should not get clogged up with excessive requests that prevents disruptions. This will mostly be applicable to renowned websites to reduce their system workload and to prevent malicious DOS attacks.

Usage : ./lbd [Domain]

4.    I could not find any switch option that can be used with the command ....so the usage is simple....I have tried this on two sites : certifiedhacker.com and dvwa.co.uk.Screen shots of the results obtained are seen below :