Add hostmap-robtex.nse by Arturo Busleiman.

scripts/hostmap-robtex.nse

@@ -0,0 +1,65 @@
+description = [[
+Tries to find hostnames that resolve to the target's IP address by querying the Robtex service at http://www.robtex.com/dns/.
+]];
+
+---
+-- @usage
+-- nmap --script hostmap-robtex
+--
+-- @output
+-- Host script results:
+-- | hostmap-robtex:
+-- |   example.edu
+-- |   example.net
+-- |   example.edu
+-- |_  example.net
+-- (some results omitted for brevity)
+--
+
+author = "Arturo Busleiman <buanzo@buanzo.com.ar>";
+license = "Same as Nmap--See http://nmap.org/book/man-legal.html";
+categories = {
+  "discovery",
+  "safe",
+  "external"
+};
+
+require "http";
+require "ipOps"
+require "shortport";
+
+--- Scrape domains sharing target host ip from robtex website
+-- @param data string containing the retrieved web page
+-- @return table containing the host names sharing host.ip
+function parse_robtex_response (data)
+  local result = {};
+
+  for linkhref, domain in string.gmatch(data, "<a href=\"/dns/([^\"]-)%.html\">([^<]-)</a></span>") do
+    if not table.contains(result, domain) then
+      table.insert(result, domain);
+    end
+  end
+  return result;
+end
+
+hostrule = function (host)
+  return not ipOps.isPrivate(host.ip)
+end;
+
+action = function (host)
+  local link = "http://www.robtex.com/ip/" .. host.ip .. ".html";
+  local htmldata = http.get_url(link);
+  local domains = parse_robtex_response(htmldata.body);
+  if (#domains > 0) then
+    return stdnse.format_output(true, domains);
+  end
+end;
+
+function table.contains (table, element)
+  for _, value in pairs(table) do
+    if value == element then
+      return true;
+    end
+  end
+  return false;
+end

scripts/script.db

@@ -103,6 +103,7 @@ Entry { filename = "hbase-master-info.nse", categories = { "default", "discovery
 Entry { filename = "hbase-region-info.nse", categories = { "default", "discovery", "safe", } }
 Entry { filename = "hddtemp-info.nse", categories = { "default", "discovery", "safe", } }
 Entry { filename = "hostmap-bfk.nse", categories = { "discovery", "external", "intrusive", } }
+Entry { filename = "hostmap-robtex.nse", categories = { "discovery", "external", "safe", } }
 Entry { filename = "http-affiliate-id.nse", categories = { "discovery", "safe", } }
 Entry { filename = "http-apache-negotiation.nse", categories = { "discovery", "safe", } }
 Entry { filename = "http-auth-finder.nse", categories = { "discovery", "safe", } }