Hostfind

This bash-based CLI tool is extremely lame simple. It appends a wordlist to the front of a domain name in order to discover additional hosts to test during a vulnerability assessment or penetration test.

This incarnation is a standalone, but I'll soon be building it into my mst tool--another one of my bash-based laziness optimization applications oriented around information security testing.

hostfind.tar.bz2
hostfind.tar.bz2.sha1
hostfind.tar.bz2.sha1.asc

Output

-------------------------------------------------------
- Hostfind -- A lame tool for finding hostnames to scan
-------------------------------------------------------

Searching google.com...

Host 66.249.83.19 not scanned
Host ns1.google.com (216.239.32.10) not scanned
Host ns1.google.com (216.239.32.10) not scanned
Host ns2.google.com (216.239.34.10) not scanned
Host proxy.google.com (216.239.37.5) not scanned
Host smtp1.google.com (216.239.57.25) not scanned

Enjoy...

Again, the goal is to add valid systems to a list to be scanned, so in practice you'll want to put this through | cut -d" " -f2 to get your list. The next version of this "module" will use host to pull DNS information and add that as well.

--

[Note: This tool, as well as the other security tools on my site, are to help authorized professionals save time during security testing. If you have authorization to scan your own systems that's fine, but please don't point my tools at systems you're not supposed to.]