Finding named hosts on a network

If you have just gained access to a network, one of the first things you can do is to get an idea of what hosts are on the network. You can scan all IP addresses on a subnet and then do a DNS lookup to see if you can find any named hosts. Hostnames can have descriptive or informative names that give clues as to what a server may be running.

The pure Go resolver is default and can only block a goroutine instead of a system thread, making it a little more efficient. You can explicitly set the DNS resolver with an environment variable:

export GODEBUG=netdns=go    # Use pure Go resolver (default)export GODEBUG=netdns=cgo   # Use cgo resolver

This example looks for every possible host on a subnet and tries to resolve ...

Get Security with Go now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.