Skip to content
HackIndex logo

HackIndex

Reverse DNS Lookup Sweeps

1 min read May 6, 2026

PTR records expose internal hostnames. Sweep ranges to map live hosts and naming conventions.

Single Reverse Lookup

┌──(kali㉿kali)-[~]
└─$ dig -x $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nslookup $TARGET_IP
┌──(kali㉿kali)-[~]
└─$ host $TARGET_IP

All return PTR if present.

Range Sweep with dig

# Set BASE to the first three octets of your target subnet (e.g. BASE="10.10.10")
BASE="$TARGET_SUBNET_BASE"
for i in {1..254}; do dig -x ${BASE}.$i +short; done

Non-empty output indicates live/named hosts.

Automated Reverse Sweeps

Dnsrecon

┌──(kali㉿kali)-[~]
└─$ dnsrecon -r $TARGET_SUBNET/24
┌──(kali㉿kali)-[~]
└─$ dnsrecon -r $TARGET_SUBNET -n $TARGET_IP

Fierce range mode

┌──(kali㉿kali)-[~]
└─$ fierce --range $TARGET_SUBNET_BASE.1-$TARGET_SUBNET_BASE.254 --domain $DOMAIN

Maps reverses to domain context.