Ethical Hacking and Penetration Testing Guide

89
Load Balancer Detector
Load balancer detector (lbd) is a Bash script in BackTrack, which could be used for detecting load 
balancers. lbd is capable of detecting both DNS and http load balancers. It analyzes application 
response data for detecting load balancers.
In order to use lbd.sh, navigate to the lbd directory: 
cd/pentest/enumeration/web/lbd
Once in the directory, issue the following command: 
./lbd.sh www.google.com
The output would be something like this:
Determining Real IP behind Load Balancers
As explained before, in order to handle heavy traffic on the server, website administrators install 
load balancers, which sometimes hide the real IP of the webserver behind a virtual IP.
We have already learned how to detect if an organization is running a load balancer. Our next 
goal would be to learn the real IP behind the load balancer.
Halberd is a tool that is capable of detecting real IP behind the load balancers. Unfortunately, 
it does not come with BackTrack. It can be downloaded from the following website: http://halberd.
superaddictive.com
I would recommend you spend some time reading its manual, which explains the methods 
used for determining the real IP behind the webservers. So let’s start setting up halberd to run on 
BackTrack.
Step 1—
Download halberd package from the website and choose to save it in the root directory.
Step 2—
Type 
ls
and you would see halberd’s directory; navigate to it by using the cd halberd 
directory command.
Command
:
tar xzvf halberd-0.2.4.tar.gz
This extracts the contents of the tar.gz file.

---

90
◾ 
Ethical Hacking and Penetration Testing Guide
Step 3—
Again, navigate to the halberd directory and then run the following command:
python setup.py install
Step 4—
Once it’s installed, navigate to the halberd directory by issuing the following command:
cd/Halberd-0.2.4/halberd
Step 5—
Next, issue the following command for scanning a particular domain. In this case, 
I am scanning yahoo.com.
Halberd yahoo.com
The output will look something like this:
As you can see, it has detected the real server behind the load balancers. This could aid us a lot 
during pentesting.