DNS Internal Reverse Lookup Scan

This scan is performed after an initial compromise into the network has occurred. In the reconnaissance phase of an attack, the attacker gathers as much information as possible about the network. An attacker might search for active server names and try to decipher their primary functions as viable targets for further exploits. Most scanning tools, such as Nmap Security Scanner, perform reverse lookups on each host so that they can display the host names. Large scans can result in a high number of reverse lookup requests.