Footprinting and Reconnaissance - Finding Companies' Restricted URLs

Restricted URLs provide an insight and understanding of the number of websites hosted on a particular server. Not only the number of websites but also you can find the name of the site. From the name, we can easily know the importance of that site.

Restricted URLs are always present on any server. They are useful for administrator purpose. When making a huge server, a single man (admin) cannot handle it. Hence, it becomes necessary that the site be maintained by many people according to the task assigned to them.

When there is a need to access data of any website by employees, it asks for authentication of employees and then they are logged in. Many a times, when we visit a bank, we see the employees doing their work on a private window using their authentication. But we can't access the server. Its because we don't know the exact URL on which they are working.

Suppose there be a large server xyz.com. The server can't be accessed by a single person. Hence, it might include the page where a person needs to login as admin and start his/her work. The admin login page is generally admin.xyz.com. Here, the guess was easy but there are many other such private URLs made for employee use only. So, today we will see how to find such private URLs of a server.

In the above image, you can see the private URLs of microsoft.com. Its what I searched for. Now, let's start the tutorial.

How to find Private URLs of any company?

Follow these simple steps to know the trick.

1. Open : https://www.netcraft.com.
2. Search the Home Page of netcraft for text 'What's that site running?'.
3. You will find a search box besides the text written 'Find out what technologies are powering any website:'.
4. Type the name of the server (company) you want to search for. (Here, in my case its microsoft.com).
5. Enjoy with the results...