cunneen · May 26, 2025 09:50 · cunneen · May 26, 2025
diff --git a/reverseip.sh b/reverseip.sh
 # WARNING: this is brittle as hell. It will break when robtex changes their website.
 # 
 # reverseip
 # A shell function to get a list of domain names associated with the given IP address, using Robtex.com
 # 
 # Parameters:
 #   IP - IP address to reverse lookup
 # 
 # Returns:
 #   List of domain names associated with the IP address
 # 
 # Requires:
 #   curl
 #   jq
 # 
 function reverseip() {
  local IP=${1} # IP address as first parameter

  # How this works:
  # 1. Use curl to get the HTML from https://www.robtex.com/en/ip-lookup/${IP}
  # 2. In the HTML body returned by Robtex, there is a reference to a plain-text data file for the IP address. 
  #    We attempt to scrape the HTML to find the URL of the data file (using awk).
  # 3. We use curl to fetch the data file from Robtex, and try to parse it to extract all the domain names
  #    using awk, sed and jq.

  # print usage if no IP address is given, or --help is given
  if [[ -z "${IP}" || "${IP}" == "--help" ]]; then
    echo "Usage: reverseip [IP]"
    echo "Parameters:"
    echo "  IP - IP address to reverse lookup"
    echo "Example:"
    echo "  reverseip 207.204.43.124"
    return 0
  fi

  # check for dependencies
  command -v curl >/dev/null 2>&1 || {
    echo "reverseIP: curl is required" >&2
    return 1
  }
  command -v jq >/dev/null 2>&1 || {
    echo "reverseIP: jq is required" >&2
    return 1
  }
  local CURLPATH=$(where curl)
  # ==== complex parsing rules ====
  # Used to convert an IP address to a Robtex lookup URL component e.g. "207.204.43.124" becomes "207/204/43/124"
  local SED_IP_WITH_SLASHES='s/\./\//g' 
  # Used to extract the URL of the Robtex data file from Robtexs initial HTML
  local AWK_GET_ROBTEX_DATA_URL_FROM_ROBTEX_OUTPUT='/^< link: </{gsub(/[\<\>\;]/,"",$3); print $3; exit 0;}'
  # Used to parse the Robtex data file, extracting the data from the line immediately following "id:21"
  local AWK_PARSE_ROBTEX_DATA_OUTPUT='/^id:21\ndata: /{gsub(/^id:21\ndata: /,"",$0); gsub(/\>\</,"\>\\n\<",$0); print $0;}'
  # Extracts the domain names from the HTML data
  local SED_TIDY_ROBTEX_LINKS='s/^\<a href="https:\/\/www\.robtex\.com\/en\/dns-lookup\/[^"]*"\>(.+)\<.*$/\1/gp'
  # Joins the domain names parts together, where there's a line ending in a dot
  local AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS='/\.\n([^\n]+)/{gsub(/\.\n/,".",$0); printf("%s\n",$0);}'

  # ==== main logic ====
  echo ${IP} | \
    sed "${SED_IP_WITH_SLASHES}" | \
    xargs -I % "${CURLPATH}" -s -o /dev/null -v https://www.robtex.com/en/ip-lookup/% 2>&1 | \
    awk "${AWK_GET_ROBTEX_DATA_URL_FROM_ROBTEX_OUTPUT}" | \
    xargs curl -s | \
    awk -v RS="\0" -v ORS="" "${AWK_PARSE_ROBTEX_DATA_OUTPUT}" | \
    jq -r '.content0' | \
    sed -n -E -e "${SED_TIDY_ROBTEX_LINKS}" | \
    awk -v RS="\0" -v ORS="" "${AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS}"
 }
	# WARNING: this is brittle as hell. It will break when robtex changes their website.
	#
	# reverseip
	# A shell function to get a list of domain names associated with the given IP address, using Robtex.com
	#
	# Parameters:
	# IP - IP address to reverse lookup
	#
	# Returns:
	# List of domain names associated with the IP address
	#
	# Requires:
	# curl
	# jq
	#
	function reverseip() {
	local IP=${1} # IP address as first parameter

	# How this works:
	# 1. Use curl to get the HTML from https://www.robtex.com/en/ip-lookup/${IP}
	# 2. In the HTML body returned by Robtex, there is a reference to a plain-text data file for the IP address.
	# We attempt to scrape the HTML to find the URL of the data file (using awk).
	# 3. We use curl to fetch the data file from Robtex, and try to parse it to extract all the domain names
	# using awk, sed and jq.

	# print usage if no IP address is given, or --help is given
	if [[ -z "${IP}" \|\| "${IP}" == "--help" ]]; then
	echo "Usage: reverseip [IP]"
	echo "Parameters:"
	echo " IP - IP address to reverse lookup"
	echo "Example:"
	echo " reverseip 207.204.43.124"
	return 0
	fi

	# check for dependencies
	command -v curl >/dev/null 2>&1 \|\| {
	echo "reverseIP: curl is required" >&2
	return 1
	}
	command -v jq >/dev/null 2>&1 \|\| {
	echo "reverseIP: jq is required" >&2
	return 1
	}
	local CURLPATH=$(where curl)
	# ==== complex parsing rules ====
	# Used to convert an IP address to a Robtex lookup URL component e.g. "207.204.43.124" becomes "207/204/43/124"
	local SED_IP_WITH_SLASHES='s/\./\//g'
	# Used to extract the URL of the Robtex data file from Robtexs initial HTML
	local AWK_GET_ROBTEX_DATA_URL_FROM_ROBTEX_OUTPUT='/^< link: </{gsub(/[\<\>\;]/,"",$3); print $3; exit 0;}'
	# Used to parse the Robtex data file, extracting the data from the line immediately following "id:21"
	local AWK_PARSE_ROBTEX_DATA_OUTPUT='/^id:21\ndata: /{gsub(/^id:21\ndata: /,"",$0); gsub(/\>\</,"\>\\n\<",$0); print $0;}'
	# Extracts the domain names from the HTML data
	local SED_TIDY_ROBTEX_LINKS='s/^\<a href="https:\/\/www\.robtex\.com\/en\/dns-lookup\/[^"]"\>(.+)\<.$/\1/gp'
	# Joins the domain names parts together, where there's a line ending in a dot
	local AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS='/\.\n([^\n]+)/{gsub(/\.\n/,".",$0); printf("%s\n",$0);}'

	# ==== main logic ====
	echo ${IP} \| \
	sed "${SED_IP_WITH_SLASHES}" \| \
	xargs -I % "${CURLPATH}" -s -o /dev/null -v https://www.robtex.com/en/ip-lookup/% 2>&1 \| \
	awk "${AWK_GET_ROBTEX_DATA_URL_FROM_ROBTEX_OUTPUT}" \| \
	xargs curl -s \| \
	awk -v RS="\0" -v ORS="" "${AWK_PARSE_ROBTEX_DATA_OUTPUT}" \| \
	jq -r '.content0' \| \
	sed -n -E -e "${SED_TIDY_ROBTEX_LINKS}" \| \
	awk -v RS="\0" -v ORS="" "${AWK_JOIN_ROBTEX_DOMAIN_NAME_PARTS}"
	}