As usual, the first thing that we do before we start trying to exploit or find any vulnerabilities,
we do information gathering.
So we try to gather as much information as possible about the target and what applications are no different.
So we're going to start by trying to get as much information as we can about the target IP address,
the domain name info, the technologies used on the websites or what programming language is used,
what kind of server is installed on it, what kind of database is being used.
And we're going to gather information about the company, the DNS records, and we'll also see if we
can find any files that are not being listed or any subdomains that are not visible to other to other
people.
So the first thing that we're going to have a look on is who is Look-Up?
Who's the cop is a protocol that's used to find owners of Internet resources, for example, server
and IP address or a domain.
So we're actually not hacking or doing anything.
We're literally just retrieving info from a database that contains information about owners of stuff
on the Internet.
So, for example, when you sign up when you sign up for a domain name, if you wanted to register a
domain name for yourself, for example, Zaide dot com.
When I do that, I have to supply information about myself, my address, and then the name would be
stored in my own name.
And people can see that Zade owns this domain name.
So this is all we're going to do.
If you Google who is look up, you'll see a lot of websites providing the service.
So I'm using who is the domain tools dot com and I'm just going to put my target domain name and I'm
just going to use a security dot org.
So, as you can see, very simple and we get a lot of information about our Target website.
He'll see the email that you can use to contact the domain name info.
Usually you'll be able to see the address of the company that has registered this domain name.
But we can see that this company is using privacy on their domain.
So you can't really see the address.
But if they have it, if they're not using privacy, you'll be able to see their address and more information
about the actual company.
You can see when the my name was created.
You can see the IP address of security dot org, so if you pick this, you should get this IP address
and I'll show you.
If I do take.
A security story, you'll see it's the same domain name here, the same IP address here, sorry.
You can see the IP location, we can see the status, obviously, it's active.
Can also access the history, but you need to register for that.
And obviously, you can see the title here and something that's very useful here, we can see that it's
using Apache Web server.
So this is software that can be used as a Web server.
And we can see that executed uses this Web server and version two point two point three one.
So, again, we can use this to find exploits and we can see that it's using UNIX, the operating system
of the website of the server, and it's using the following orders as well as using Mod SSL and open
SSL.
Now, right here, you can find more information about the company who registered this domain.
So again, security is used in privacy, so you won't be able to see the address.
You can see that it's saying that the target person is using privacy protection.
But usually you'll be able to see phone numbers and addresses of that company.
So, as you can see, very simple stuff, but it's very helpful in the long run just to know what your
target was, their IP, what services are they using?
We can also hear actually didn't show.
You can see the name servers that are being used and you can see that they are provided by a company
called Dimness Dot Net.
Now, if you go on dimness, you'll see that this is a hosting company.
So if we go on the English version.
That you'll see that this is a hosting company and again, you can even use this hosting company and
trying to social engineer your way, maybe into hacking, into your targets, into a security.