43-whois.md

Port 43 - WHOIS

Table of Contents

• Enumeration
• Information Gathering
• Exploitation

---

Enumeration

Quick Check (One-liner)

whois $domain && whois -h $rhost $domain

Banner Grabbing

nc -vn $rhost 43

Nmap Scripts

nmap -sV -sC -p43 $rhost

---

Information Gathering

Basic WHOIS Query

whois $domain
whois $ip

Query Specific WHOIS Server

whois -h $rhost $domain
whois -h whois.verisign-grs.com $domain

Regional Internet Registries

# ARIN (North America)
whois -h whois.arin.net $ip

# RIPE (Europe, Middle East, Central Asia)
whois -h whois.ripe.net $ip

# APNIC (Asia Pacific)
whois -h whois.apnic.net $ip

# LACNIC (Latin America)
whois -h whois.lacnic.net $ip

# AFRINIC (Africa)
whois -h whois.afrinic.net $ip

Extract Useful Information

# Get registrar info
whois $domain | grep -i "registrar"

# Get nameservers
whois $domain | grep -i "name server"

# Get admin contact
whois $domain | grep -i "admin"

# Get creation/expiry dates
whois $domain | grep -i "date"

---

Exploitation

WHOIS Injection

Some WHOIS servers may be vulnerable to command injection

# Test for injection
whois -h $rhost '$(id)'
whois -h $rhost '; ls -la'

Information Disclosure

# Gather email addresses for phishing
whois $domain | grep -i "@"

# Find related domains (same registrant)
whois $domain | grep -i "registrant"

Reverse WHOIS

# Find other domains owned by same entity
# Use online tools: viewdns.info, domaintools.com

---

Online Tools

• ViewDNS: https://viewdns.info/whois/
• DomainTools: https://whois.domaintools.com/
• ICANN Lookup: https://lookup.icann.org/

---

References

• HackTricks - WHOIS