HackerTarget

HackerTarget

Note

This module queries external third-party APIs and is subject to rate limiting and connectivity rules. To configure connection timeouts, retry delays, and maximum attempt logic, refer to the Network Configuration page. To configure authentication, refer to the API Credentials page.

The HackerTarget module provides passive DNS (pDNS) enumeration capabilities. It queries HackerTarget's extensive historical and active DNS databases to discover subdomains and their associated IP addresses, helping map out the target's external infrastructure footprint without directly interacting with the target's servers.

Data Source: HackerTarget

Capabilities

The module accepts Domains as input and extracts the following intelligence:

• Subdomains: Extracts all discovered subdomains from the pDNS records. Each subdomain is explicitly validated, checked against the core organizational scope (to flag Out Of Scope (see Scope Boundaries) assets), and emitted as a new Domain node. All discovered subdomains are automatically tagged with pDNS to indicate their origin.
• Resolved IP Addresses: Extracts the corresponding IP addresses mapped to the discovered subdomains in the historical records. These are validated and emitted as new IP (IPv4/IPv6) nodes. To maintain a clean graph structure, each IP node is explicitly linked to its corresponding subdomain node as its source.

Authentication & Quota Management

While the HackerTarget API can be queried anonymously without an API key, free-tier usage enforces strict rate limits tied to your public IP address. These limits can optionally be bypassed by rotating your outbound IP addresses.

• API Key Integration: To use higher official limits, the module automatically detects and utilizes an API key if configured under the HackerTarget service name in your API keys configuration.
• Proactive Quota Monitoring: The module actively monitors the X-Api-Count and X-Api-Quota HTTP response headers. If it detects that your API quota has been exhausted, it immediately halts further retry attempts for that specific query and gracefully emits an API Quota property indicating the exhaustion, preventing unnecessary network bans or infinite loops.

Resilience & Validation

• Retry Logic: If the API returns a transient error (e.g., HTTP 429 Too Many Requests or 5xx Server Errors), the module employs a progressive backoff-and-retry mechanism (governed by your network settings).
• Strict Parsing: The module strictly expects a CSV-formatted response (domain,ip). It explicitly validates the structure before parsing to prevent injecting malformed HTML error pages or garbage data into your graph.