Detecting HTTP Load Balancers using HalberdFinding Subdomains using Goorecon

Download:

<a href="http://halberd.superadditive.com/">http://halberd.superadditive.com/</a>

2.

In this video, we will find the various publicly available sub-domains of Cnn.com using Goorecon. Goorecon is included in Backtrack 4.

3.Load Balancing has becoming an important part of the network architecture, especially for companies which host applications accessed by millions around the world. Good examples of such companies would be Google, Facebook, MSN, YouTube etc. In most cases, Load Balancing for web applications in particular, happens using a DNS based balancer which cycles through the different IPs in the server farm in a round robin fashion, or using a HTTP Load Balancer device which multiplexes incoming connections to one of the servers in the farm.

4.evilgrade

<a href="http://www.infobyte.com.ar/developments.html">http://www.infobyte.com.ar/developments.html</a>

#!/bin/bash

# lbd (load balancing detector) detects if a given domain uses

# DNS and/or HTTP Load-Balancing (via Server: and Date: header and diffs between server answers)

#

# License: GPL-v2

# Written by Stefan Behte

# Contact me, if you have any new ideas, bugs/bugfixes, recommondations or questions!

# Please also contact me, if you just like the tool. :)

# 

# Stefan dot Behte at gmx dot net

QUERIES=50

DOMAIN=$1

METHODS=""

echo

echo "lbd - load balancing detector 0.1 - Checks if a given domain uses load-balancing."

echo "                                    Written by Stefan Behte (http://ge.mine.nu)"

echo "                                    Proof-of-concept! Might give false positives."

if [ "$1" = "" ]

then

echo "usage: $0 [domain]"

exit -1

fi

echo -e -n "/nChecking for DNS-Loadbalancing:"

NR=`host $DOMAIN | grep -c "has add"`

if [ $NR -gt 1 ]

METHODS="DNS"

echo " FOUND"

host $DOMAIN | grep "has add"

else

echo " NOT FOUND"

echo -e "Checking for HTTP-Loadbalancing ["Server"]: "

for ((i=0 ; i&lt; $QUERIES ; i++))

do

printf "HEAD / HTTP/1.0/r/n/r/n" | nc $DOMAIN 80 &gt; .nlog

S=`grep -i "Server:" .nlog | awk -F: '{print $2}'`

if ! grep "`echo ${S}| cut -b2-`" .log &amp;&gt;/dev/null

  echo "${S}"

cat .nlog &gt;&gt; .log

done

NR=`sort .log | uniq | grep -c "Server:"`

METHODS="$METHODS HTTP[Server]"

rm .nlog .log

echo -e -n "Checking for HTTP-Loadbalancing ["Date"]: "

D4=

for ((i=0 ; i&lt;$QUERIES ; i++))

D=`printf "HEAD / HTTP/1.0/r/n/r/n" | nc $DOMAIN 80 | grep "Date:" | awk '{print $6}'`

printf "$D, "

Df=$(echo " $D" | sed -e 's/:0/:/g' -e 's/ 0/ /g')

D1=$(echo ${Df} | awk -F: '{print $1}')

D2=$(echo ${Df} | awk -F: '{print $2}')

D3=$(echo ${Df} | awk -F: '{print $3}')

if [ "$D4" = "" ];  then   D4=0;  fi

if [ $[ $D1 * 3600 + $D2 * 60 + $D3 ] -lt $D4 ]

  echo "FOUND"

  METHODS="$METHODS HTTP[Date]"

  break;

D4="$[ $D1 * 3600 + $D2 * 60 + $D3 ]"

if [ $i -eq $[$QUERIES - 1] ]

  echo "NOT FOUND"

echo -e -n "/nChecking for HTTP-Loadbalancing ["Diff"]: "

printf "HEAD / HTTP/1.0/r/n/r/n" | nc $DOMAIN 80 | grep -v -e "Date:" -e "Set-Cookie" &gt; .nlog

if ! cmp .log .nlog &amp;&gt;/dev/null &amp;&amp; [ -e .log ]

  diff .log .nlog | grep -e "&gt;" -e "&lt;"

  METHODS="$METHODS HTTP[Diff]"

cp .nlog .log

if [ "$METHODS" != "" ]

echo $DOMAIN does Load-balancing. Found via Methods: $METHODS

echo $DOMAIN does NOT use Load-balancing.