Domain host related info, so the conducted web penetration test are generally close to a black box
testing, as we mentioned before.
So we don't have, well, hardly any information about the target, if any.
Maybe just a U.
RL IP address or a domain name is given to us.
So to start testing and gathering information, we'll need to dig around in our own IP or domain name,
no problem.
So in this section, we're going to first extract domain registration information by using the who is
service.
Then we're going to use the extracted information to get subdomains of the target and even the other
hosts and the network.
And then if it's possible we're going to discover the applications that are served on the same server
or same service.
All right.
So let's start with the who is service.
When registering a domain, the domain owner needs to provide his personal information to the domain
registrar, such as name, phone, no other contact information.
And all this is public information due to the nature of the who is service.
So that means that you can view the name, address, phone number and email address of the person or
entity who registered the domain.
If you query the registrar who is service, you can get this information, but sometimes the registrars
can hide this if they have a service to change the owner information with their.
Who is records and holds the registration details provided by the domain owner to the domain registrar?
Yes, I say, who is?
Who is is a protocol that works on Port TCP 43 and there are multiple who is servers on the Internet
around the world.
These servers are operated by regional Internet registrars, so they are used to extract information
about the domains and the associated contacts information.
OK, so open your terminal in Cali.
And thanks to our developers, Carly has, who is a client and it's very easy to use.
OK, so type who is to see the help file and we're going to use that.
So let's think of Google dot com as your target domain, and you got to wonder about Google's registration
info, right?
So type who is Google dot com and enter?
OK, so this is the output for this domain, it's long, so scroller.
And as you're seeing this with me, the registrar for this domain is Mark Monitor.
The data of validity period are also displayed.
The output of a who is query also points out the DNS servers for Google dot com.
And those will help us to find additional hosts in the domain.
So now I will run another who is Guerrieri?
But first, let me get the Google dot com IP address on Google dot com.
And the host command performs a reverse ipecac.
So when you give the domain, it returns the corresponding IP address.
So type who is Dash H, who is Dot Aaron dot net?
Now, I will copy this IP address.
With the age parameter, you can point to a specific who is server to query.
So hit enter.
And again, you get along output.
But it's got a lot of information, such as network range, phone number and address.
So who is queries are very handy to originate a domain name.
There are also online who is services and you've probably had a look at them.
You may want to look at them again.