lbd

lbd is a lightweight tool designed to identify whether a target domain is behind a load balancer. This is useful in reconnaissance phases to understand the infrastructure of a target, potentially revealing multiple backend servers or cloud services like ECS.

The tool performs checks for DNS-based load balancing and HTTP-based load balancing by examining server responses. It outputs whether load balancing is found or not, along with specific details like server headers when applicable.

Written by Stefan Behte, lbd is a proof-of-concept tool that may produce false positives. It is particularly handy for pentesters mapping out web infrastructure.

lbd first checks for DNS-Loadbalancing, likely by querying DNS records for variations indicating round-robin or similar setups. For HTTP-Loadbalancing, it sends requests to the target domain and inspects the Server header or other response indicators. In the example, it detects ECS (sea/55ED) and ECS (sea/1C15), suggesting variations in response headers from different backend servers behind a load balancer.