‫Domain host related info, so the conducted web penetration test, you're generally close to a black
‫box testing, as we mentioned before, so we don't have, well, hardly any information about the target,
‫if any.
‫Maybe just a U.
‫RL IP address or a domain name is given to us.
‫So to start testing and gathering information, we'll need to dig around in our own IP or domain name,
‫no problem.
‫So in this section, we're going to first extract domain registration information by using the who is
‫service.
‫Then we're going to use the extracted information to get subdomains of the target and even the other
‫hosts in the network.
‫And then if it's possible we're going to discover the applications that are served on the same server
‫or same service.
‫All right.
‫So let's start with the who is service.
‫When registering a domain, the domain owner needs to provide his personal information to the domain
‫registrar, such as name, phone, no other contact information.
‫And all this is public information due to the nature of the who is service.
‫So that means that you can view the name, address, phone number and email address of the person or
‫entity who registered the domain.
‫If you query the registrar who is service, you can get this information, but sometimes the registrars
‫can hide this if they have a service to change the owner information with their.
‫Who is records and holds the registration details provided by the domain owner to the domain registrar?
‫Yes, I say who is who is is a protocol that works on Port TCP 43 and there are multiple who is servers
‫on the Internet around the world.
‫These servers are operated by regional Internet registrars, so they are used to extract information
‫about the domains and the associated contacts information.
‫OK, so open your terminal in Cali.
‫And thanks to our developers, Carly has, who is a client and it's very easy to use.
‫OK, so type who is to see the help file and we're going to use that.
‫So let's think of Google dot com as your target domain, and you got to wonder about Google's registration
‫info, right?
‫So type who is Google dot com and hit enter.
‫OK, so this is the output for this domain, it's long, so scroller.
‫And as you're seeing this with me, the registrar for this domain is Mark Monitor.
‫The dates of validity period are also displayed.
‫The output of a who is query also points out the DNS servers for Google dot com.
‫And those will help us to find additional hosts in the domain.
‫So now I will run another who is Creary?
‫But first, let me get the Google dot com IP address on Google dot com.
‫And the host command performs a reverse ipecac.
‫So when you give the domain, it returns the corresponding IP address.
‫So type who is dash age, who is not Erin dot net?
‫Now, I will copy this IP address.
‫With the age parameter, you can point to a specific who is server to query.
‫So hit enter.
‫And again, you get along output.
‫But it's got a lot of information, such as network range, phone number and address.
‫So who is queries are very handy to originate a domain name.
‫There are also online who is services and you've probably had a look at them.
‫You may want to look at them again.