Command to retrieve all informations from a website - unix

is there a unix command to retrieve all informations possible from a website?
I mean info like: IP, IP geo location, (sub-)domains, alternative domain names, name server, and all other informations I'm thinking about.
I know about whois, but is there anything else?
Something that gives more informations?
Thanks

I don't know any command that can do all of that at once but a simple pipeline should work too.
ping www.website.com for IP
curl ipinfo.io/ip-adress for geo-location
nslookup -query=soa www.website.com for original DNS
Alternatively you can use the command dig to find the subdomains via the DNS:
dig domain.com the output in the authority section are the DNS servers which are used
dig #dns.server domain.com AFXR to retrieve the subdomains of domain.com

Related

How to find all subdomain for a particular given domain

So I have a domain name let's say example.com, so is it possible to find all the sub-domains like a.example.com, b.example.com, etc.?
You can use command like:
dig example.com ALL
or
host -l example.com
But be aware you will get result only if machine where you run this have permission to do zone transfers for this domain. Otherwise you will see nothing.

How to access site through IP address when website is on a shared host?

I want to edit my host file to forward a website to another IP, but that IP is on a shared host, so the IP doesn't take me to the domain I want. Is there a way around this?
i.e.
Website: http://somerandomservice.com/
Ping the site and go to: 67.225.235.59
But they're different sites.
Thanks!
Update: Tried nmap, but unable to find the correct port.
According with the HTTP/1.1 standard, the shared IP hosted site can be accessed by a GET request with the IP as URL and a header of the host.
Here there are two examples(wget and curl):
$ wget --header 'Host:somerandomservice.com' http://67.225.235.59
$ curl --header 'Host:somerandomservice.com' http://67.225.235.59
Resources:
https://en.wikipedia.org/wiki/Shared_web_hosting_service
http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.23
Include the port number with the IP address.
For example:
http://19.18.20.101:5566
where 5566 is the port number.
You can access you website using your IP address and your cPanel username with ~ symbols.
For Example:
http://serverip/~cpusername like as https://xxx.xxx.xx.xx/~mohidul
serverIPaddress/~cpanelusername will only work for cPanel. It will not work for Parallel's Panel.
As long as you have the website created on the shared, VPS or Dedicated, you should be able to always use the following in your host file, which is what your browser will use.
67.225.235.59 somerandomservice.com www.somerandomservice.com

Add subdomain to localhost URL

I am writing an web application that behaves differently depending on a url prefix. The format is something like:
https://myprefix.mycompany.com
The web app behaves differently based on myprefix. My web app extract that part from the URL and act on that.
However, when I test on my local, I use an localhost address:
https://localhost:1234
I counldn't do something like:
https://myprefix.localhost:1234
What is the best way for me to test this scenario?
Many thanks
Unfortunately, because localhost is not a proper domain, you can't add a subdomain to it like that. You can, however, trick your computer into thinking it owns a specific domain and test things that way. For instance, if you have a UNIX-based operating system, open (as root) the file /etc/hosts and add a line (or lines) like this:
127.0.0.1 example.com
127.0.0.1 subdomain.example.com
Your computer will now treat both example.com and subdomain.example.com as belonging to itself. If you visit either in your web browser, they will work the same, in principle, as localhost, but your web server will see the correct domain in its Host header.
I'm not sure about same behaviour on windows. I'm working on linux mint.
You can use lvh.me:port as a local domain. You can imagine that your project is deployed on localhost:port on this domain.
Instead of sub.localhost:port you've to use sub.lvh.me:port
UPDATE
sub.localhost:port works on Chrome.
Note: Firefox automatically adds www. at the beginning of entered domain that can cause problems with subdomains testing
For Windows users, based on this answer and per this comment, you can achieve this by adding ports to localhost via the hosts file that resides at this path:
C:\Windows\System32\drivers\etc\hosts
And append lines like the following to it:
127.0.0.1 example.com
127.0.0.1 subdomain.example.com
One-Line Solution for Windows
Open PowerShell as Administrator and run the following command, replacing sub.mydomain.com with whatever you want.
"`n127.0.0.1 sub.mydomain.com" | Out-File C:\Windows\System32\drivers\etc\hosts -encoding ASCII -append
Breakdown:
`n - newline
127.0.0.1 - loopback address
sub.mydomain.com - domain name
| Out-File C:\Windows\System32\drivers\etc\hosts - pipe the string to the hosts
-encoding ASCII - correct encoding
-append - append to end of file (important!)
You should be using the .test domain for things like that. That is what .test is for. localhost is not supposed to have any subdomains.
To do so violates the approved RFC standards. localhost has an A record and in IPv6 environments, an AAAA record. All other DNS record types, including SOA are forbidden.
Without an SOA record, it cannot be a zone apex that has sub-records, so no subdomains nor delegations are permitted. Even the recent RFC draft titled Let localhost be localhost is consistent with this.
https://myprefix.mycompany.localhost:1234
This should do the trick. Because localhost is a top-level-domain, it behaves like a .com in production code.
It took me a bit of time to find public wildcard DNS domains pointing to localhost so I'm leaving it here for future reference.
The domain that worked for me is localtest.me. That domain and its sub-domains resolve to 127.0.0.1 and ::1.
For example:
$ host localtest.me
localtest.me has address 127.0.0.1
localtest.me has IPv6 address ::1
$ host some-sub-domain.localtest.me
some-sub-domain.localtest.me has address 127.0.0.1
some-sub-domain.localtest.me has IPv6 address ::1
A maintained list of other public wildcard DNS domains that point to localhost can be found in this Gist.
From WSL in Windows:
First navigate to /mnt/c/Windows/System32/drivers/etc(Navigate cause, you may find more interesting files. Don't play here, but see what do they do)
Then do nano hosts(add at very bottom)
127.0.0.1 random.com
127.0.0.1 auth.random.com

How to Check IP Address of Subdomain

I'm sending XML from a client's site to an external server. This external server admin needs to verify the IP from the sender. We have the script working fine when sending from the main site (domain.com), but I am not sure when we are sending from a subdomain of the main site (sub.domain.com, getting an error currently). Is there a way to check the IP of a subdomain so I can give the admin the right IP address?
Thanks.
UPDATE: I've used the firefox extension 'IP Addresses and Domain Information' and am comparing the info from both domain.com and sub.domain.com and both look pretty much identical.
You should be able to just use nslookup from a terminal
nslookup google.com
nslookup mail.google.com
From here it's trivial to write a script for this. Here is a simple ruby example:
nslookup.rb
#!/usr/bin/env ruby
domain = ARGV[0]
lookup = `nslookup #{domain}`.split("\n")
lines = lookup.select{ |line| line[/Address/] }[1..-1]
ips = lines.map{ |l| l.split('Address: ').last }
verb = ips.count > 1 ? 'are' : 'is'
puts "the IP addresses for #{domain} #{verb}:\n#{ips.join("\n")}"
Run from command line
ruby nslookup.rb api.stackoverflow.com
# or just
./nslookup.rb api.stackoverflow.com
should output something like
the IP addresses for stackoverflow.com are:
151.101.193.69
151.101.65.69
151.101.1.69
151.101.129.69
I was also search on this topic then i have found a web site that helps me to find my subdomains IP address http://www.hcidata.info/host2ip.htm

IIS Subdomain Host Headers Not Working

Using IIS 7, I have an existing website, example.com, and I have added another website to which I'd like the URL, sub.example.com to point. I've set up the host headers for this, but it does not work. Trying to ping the subdomain URL give the message "Ping request could not find host sub.example.com. Please check the name and try again."
Should a DNS setting perhaps be set?
The subdomain must be set in the DNS or it will not resolve to an IP address. Just having it defined in IIS is not enough. The client computer must be able to translate the name into a meaningful server address.

Resources