How to nmap without rDNS and write the DNS in the output

Question

I need to use nmap to check if port 443 is open for a list websites. So, I saved them into a file. I need the output to tell me if the port is open or not. I used the command:

nmap -PN -p443 gnmap -oG logs/output.gnmap -iL myfolder/input.txt

The problem: the output file is giving me a different domain names. Nmap made rDNS and I found that the IP points to adifferent domain name. Please, explain. Does this means both domains are hosted in the same server ? However, I checked their certificates and found each domain has different certificate. I am concerned about port 433 in my list to check their certificates later. So, I don't want to check another domain's certificate's other than the one I entered in the file.

To solve the issue, I used the -n option. But the problem is that the output file contains IPs only. How can I produce output file that contains the result of my domains without rDNS ??

Answer 1

The "Grepable" output format (-oG) is deprecated because it cannot show the full output of an Nmap scan. There is no way to get the output you want with the -oG option unless you modify Nmap and recompile it.

Luckily, the XML output format (-oX) contains the information you want and more:

<hostnames>
  <hostname name="bonsaiviking.com" type="user"/>
  <hostname name="li34-105.members.linode.com" type="PTR"/>
</hostnames>

In this example, from scanning my domain, the hostname provided on the command line has the attribute type="user", and the hostname that was a result of the reverse lookup has type="PTR".