Everybody welcome to the next video.
So in this video we're gonna be talking about who is now this is still part of the passive side not
physically touching the site or the target at all.
Now I can manage is a who is database which every Web site generally will have some information around
it such as the name servers the DNS servers an address a phone number and email a name of the owner
of the site.
Now in most cases a enterprise or any anything you'd like Go Daddy.
They provide a privacy in front of who is.
So it's not showing your private information that you might not want available such as if you're a small
business owner you might not want your home address being visible on who is anybody who looks up your
site but you want something because something has to be there.
Right.
So this is the who is database it's publicly available.
Anybody can query it and it's normally updated pretty regularly when you update that information it
gets sent over to.
I can.
So who is that.
I cannot or is one site that you can use.
There's there's countless that I'll query the same database.
But in this case we'll use the straight from the source.
Right.
So we're gonna go ahead and do as we'll type in Red Team nation dot com.
Let's go ahead to go and look that up.
We will confirm we are indeed not a robot.
So what this is gonna do is we're going to provide you a few different things.
So in my case it's being proxy by GoDaddy now that means that I have a privacy in between my who is
for my actual information and the public Web site.
Now it's important I understand here is if this is not set up you will have the actual privacy information
of the individuals such as the email or the address the mailing address fax of the admin the registrant
and the TAC which tends to always be the same thing depending on what you've set up.
But what I want to bring you guys down to is the raw who is statement because this is normally what
you're going to see.
So you'll see all this information.
OK so the domain status we can't see that either.
We keep going down and we'll see something interesting name servers.
Now these have to be available.
You have they have to know what name servers you need to have sent to be able to get your requests.
Now this is going to come in handy when it comes to DNS records which we have a whole separate video
on will go over that in that video.
But I want you to know that this is when you're looking at a target you're not going to have their DNS
servers right away.
They might not even have and no dot whatever dot com they might be a completely third party.
However you still can use that information to be able to start pinpointing certain sites and what sites
are still owned by the target company or the target organization or your organization if you're an internal.
But what I want to emphasize here is with this contact information if it is available for the individual
user and it's not you don't see like domains by proxy or anything like that that it shows full information
then you can even use that for spear phishing or any type of phishing attempt to try to gain access
that way.
So there's a lot of things you can go around using this for and it provides a lot of useful information
even when the domain is registered to expire or anything on that cause there are some issues which is
still technically a vulnerability where if the domain is getting ready to expire and they don't have
it on auto renew then you could in theory purchase the domain while it's been expired out there was
an issue not that long ago where somebody purchased Google dot com in between an expiring and being
renewed because it wasn't caught in time they had to give it give it up pretty quickly or it was taken
from them but the same is the same situation can happen for smaller organizations where it's not as
easy to get that domain name back because it was purchased legally through when it was previously expired.
So it's important to keep note on when the registration expiry date is because that may be a potential
issue.
There's nothing worse than having your entire organization drop off the face of the earth because the
domain that you have is no longer available and it was bought out by somebody else so all the DNS records
across the world will all an update to their new information which could put all of your customers at
risk especially if it's they're using that as a spear phishing.
This is normally caught pretty quickly.
However just note that it's there now.
This is all going to talk about for who is.
There is one other way I want to show you how to do this you don't need to go specifically to this Web
site to do this.
So if we look up our Kelly machine so if we go ahead and log in
go ahead down to our menu bar will do applications.
Usual applications system system utilities.
And we want not utilities.
Are you
terminal.
You got our terminal.
Perfect.
Going there.
So if we do who is a team nation.
What this is gonna do is you're gonna see this provides us the same information as we saw above.
And here our DNS servers are named servers and this is just the raw data that we were looking at before.
But it's important no you don't have to go physically to a Web site to do this.
You can do this from Cali itself.
What I want you guys to do now that we're gonna get ready to start working with Cali is go through this
menu.
Start looking at it.
So under applications you're gonna see quite a good list of things.
Information gathering vulnerability analysis password attacks wireless exploitation tools post exploitation
tools forensics.
So go ahead and take a look.
So you can see in here we're just working with the WHO is stuff.
However we when we go over our DNS record we have DNS analysis.
So there's some tools in here for example DNS recon and DNS and none that we can use later when looking
at DNS.
So it's important to understand that this is just a stepping stone and that you're going to use this
information like the DNS servers to perform more reconnaissance and then once you find results from
there that then goes down the next part of the rabbit hole and further and further and further and eventually
you'll have all the information you need to start planning an attack of some kind.