Skip to content
HackIndex.io

Reverse DNS Lookup Sweeps

1 min read Created Jan 3, 2026 Last updated May 6, 2026

PTR records expose internal hostnames. Sweep ranges to map live hosts and naming conventions.

  • Single reverse lookups use dig, nslookup, or host to resolve individual IPs to hostnames.
  • Range sweeps with dig loop through a /24 and collect every PTR response for live host mapping.
  • dnsrecon reverse mode automated reverse sweep against a CIDR range with optional target resolver.
  • fierce range mode maps reverse lookups back to the target domain context for adjacent host discovery.

Single Reverse Lookup

┌──(kali㉿kali)-[~]
└─$ dig -x $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nslookup $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ host $TARGET_IP

All return PTR if present.

Range Sweep with dig

# Set BASE to the first three octets of your target subnet (e.g. BASE="10.10.10")
BASE="$TARGET_SUBNET_BASE"
for i in {1..254}; do dig -x ${BASE}.$i +short; done

Non-empty output indicates live/named hosts.

Automated Reverse Sweeps

Dnsrecon

┌──(kali㉿kali)-[~]
└─$ dnsrecon -r $TARGET_SUBNET/24
┌──(kali㉿kali)-[~]
└─$ dnsrecon -r $TARGET_SUBNET -n $TARGET_IP

Fierce range mode

┌──(kali㉿kali)-[~]
└─$ fierce --range $TARGET_SUBNET_BASE.1-$TARGET_SUBNET_BASE.254 --domain $DOMAIN

Maps reverses to domain context.