[MUSIC PLAYING]
Whois enumeration.
In this video, we're going to be exploring
the process of performing Whois lookups to identify information
regarding a particular domain.
So if you're targeting a website,
then it's always important to perform a Whois
lookup to essentially get an idea as to when the site was
registered, who owns it, what registrar it was registered
with, so on and so forth.
So again, I'm also going to be performing
this on my Kali Linux VM.
As I said, within the passive information gathering phase,
you can perform this on the sites
that I will be showcasing in this video.
And as I said, remember that whenever
you're performing checks on sites or property
that you do not own, you do require authorization.
And in this case, I am giving you authorization to do this.
So I'm just going to switch over to my Kali Linux VM.
All right, so I'm back on my Kali Linux VM.
And I've just performed a quick Google search on Whois,
just so that I can explain what it is.
All right, so Whois, as you can see, is an internet protocol.
It's essentially a query and response protocol
that is widely used for querying databases
that stored the registered users or assignees
of a particular internet resource such as a domain
name, an IP address block, or an autonomous system.
So in this case, we're essentially
going to be utilizing it in the context of a particular domain
name.
So there's tons of Whois lookup websites
online, like for example, who.is.
But we'll be firstly taking a look at the actual--
we'll be taking a look at the command line utility
available in Kali Linux.
So if I type in whois and hackersploit.org and hit enter,
we'll give this a couple of seconds.
And you can see it's going to output
quite a lot of information.
So the information it'll output is the actual domain name
itself, the registry domain ID, the registry Whois service.
So in this case, it tells us it's whois.namecheap.com,
which means that this domain was registered with namecheap.
And that's confirmed through the registrar URL
when this domain was renewed or updated, when it was created.
So you can see 2018, and it was recently
renewed in February of 2022.
OK, so you guys know when I renew my domains
or this particular domain.
And of course, it tells us when this domain will expire,
which is 2023.
We also get the actual registrar abuse contact
email and the phone.
But this is really not important.
What we're looking for is going to be the actual--
let's see if I can find it here--
the name server, which in this case
points to Cloudflare, which makes sense,
as I've already mentioned that in the previous video.
But we can see that in this case,
DNSSEC is enabled, which means that information
like the owner of the domain, like my personal name,
my address is all redacted.
Now if I run this on another website--
for example, let's just showcase it
right now because we are going to be exploring it.
And that, of course, is zone transfer--
let me see if I can type that in.
Transfer.me.
This is a website that's set up to teach
students or individuals about DNS zone transfers.
But we can essentially just run a quick Whois on it.
So whois zonetransfer.me.
And you can see that this will display--
does it display any more information?
Yeah, so it actually displays information.
In this case, like the registrant organization.
In this case, DigiNinja, the registrant state,
which is Routerville.
So that was set up.
Again, as I said, it's there to teach you about DNS.
So this is going to be really just information that's
there to toy with you.
But you can see we have the registrant country,
like in this case Great Britain.
And then the name servers, which, again in this case,
look like they're going through their own name servers, which
is quite interesting in and of itself.
But you'll typically gain information
like the actual owner of the website,
unless that information is protected or redacted.
If we take a look at the Whois lookup sites like who.is,
we can also run the same query.
It essentially does the same thing.
So hackersploit.org.
And you can see it'll essentially tell us what
we were already able to obtain.
So in this case, we can see that the registrant contact
information for some reason is listed here.
But I can confirm that this is incorrect,
because you can see that that looks random, actually.
This is in Iceland.
But I can tell you for a fact that I'm not in Iceland.
But the name is redacted for privacy,
and the privacy service provided by my registrar,
which is Cloudflare, has protected my information
from being leaked.
Now this is going to be the case in most cases.
But in some cases, you may find domains with this information.
This information will be publicly exposed.
So it could also give you the email address
of the individual who owns the domain, which, again, can
be used for a phishing attack.
I'm not giving you any ideas, but I'm just
telling you how penetration testers will typically
use this information.
But yeah, that's pretty much it with regards to Whois.
It, again, can also be performed on an IP address.
So for example, we can perform it on one of the names of IPs
here for Cloudflare.
Of course, I don't recommend doing this.
But let's just see what this brings up.
So you can see it doesn't bring up anything here.
However, if we go ahead and run the host
command on hackersploit.org.
And we maybe perform a Whois lookup directly
from our terminal.
Let's see what this brings up.
There we are.
So you can see this is owned by Cloudflare, which makes sense.
This is an actual IP block or a block of IP addresses.
So when you're performing a Whois lookup on an IP address
or a block of IPs, this is what will be displayed.
So we have the network range, the CIDR annotation,
or the subnet range, if you will.
The network name.
In this case, it is CloudflareNet,
which makes sense.
The organization is Cloudflare.
When it was registered, the date it
was updated on or renewed on.
The organization information is displayed here.
So this is very important if we were targeting an organization.
So in this case, the organization is Cloudflare Inc,
or incorporated.
Organization ID, the address, city, et cetera.
And then, of course, we have the various emails
associated with abuse and customer support.
So there we are.
Those are all displayed here.
So there we go.
So that is going to conclude the practical demonstration
side of this video.
All right.
In the next video, we're going to be exploring
the process of performing website footprinting
with a service called Net Craft.
Now you might be asking yourself,
why didn't I cover this in the website footprinting video?
Well, there's a good reason for that.
The reason for that is because Net Craft is a third party
tool.
And it actually helps you understand
what's running on our website and organizes that data
in a way that's easy to consume.
This is a tool that's used by penetration testers.
And you'll actually see why so.
I'll be seeing you in the next video.