When you assess the security of any system(s) the first step is to find out what the system made of (if the system is a computer then you look for what OS, which services it is running, who uses it, etc.).
In this challenge, the system will be a domain, composed of different hosts and the goal is to find as many hosts as possible belonging to the domain. For example, the domain university.edu could be made of hosts math.university.edu, physics.university.edu, cs.university.edu, etc.
Functionality
* Finds as many hosts as possible for a given domain.
The amount of hosts will be taken as the number of existing IPs that match to a host.domain (ex: math.university.edu), no matter if the host is alive (responds to pings for example) or not.
Restrictions
Other than finding the hosts, it should include an option to search for them in normal mode or stealth mode.
* Normal mode: the user running the program is allowed to send any kind of packet directly to the hosts or to the domain he is trying to discover.
* Stealth mode: the user must find the hosts without sending any packet to any machine in the domain he is assessing.
It may be programmed in ANY language but speed and portability will be appreciated. No Windows-only solution will be considered.
Evaluation (aka choosing the winner)
The following points will be taken into account:
1. Functionality.
2. Amount of hosts discovered (at the end I will choose three domains and test all submitted programs).
3. Innovative solutions (nmap -sP ip/mask is stupid and any trained monkey can do it).
4. Performance in terms of speed such as loading, implementing the attack, etc (so try not to use Java).
5. Flexibility (you may use a scripting language that invokes other programs to do what you need or code everything yourself into one single program).
Prize
I have sent a message to forum owners to see if we can give some stickers or decals of TSF, but for the moment there's only pride and glory to the winner.
Hints
Don't code everything, use available tools. For example:
* Use a simple Google query with site:domain.edu and parse the results to get them in stealth mode.
* Use tools such as Google Sets to create new possible host.domain and then look if they exist or not.
* Use recursive DNS queries for stealth mode instead of iterative ones.
* Scripting languages are your friends :)
Last words
Do NOT submit your solutions in this forum, PM them or email them to me. If you have any questions or need any help let me know. I already have a perl solution that does some of the things stated above which I used to "learn" the language in case you want to have a look at it.