-: Whois and Host Commands.
So up to this point we've talked about DNS
and some of the vulnerabilities associated with it
by allowing people to figure out where your domain name
relates into the IP and where physically that's
located based on your different regions.
Now, we've also talked about zone transfers
and we've talked about brut forcing the DNS
to get that information specifically
about the IP address and the name.
But if we want to take it a step further
and find out a lot of information about
this organization we can use Whois.
And Whois is gonna allow us to search a database
for domain names and IP blocks and figure out who owns them
which is why it's called Whois.
This is gonna provide details on the registration
information who that person claimed the domain with.
So for instance if you look up jasondion.com
you will get the business address for our company,
you'll get my name and you'll have my support email address.
Right, something like that.
If you look up Google you'll
get the same type of information.
If you look up Microsoft or Udemy or any of those
big companies you'll be able to get that type of information
for who is the technical point of contact,
who is the administrative point of contact
and other things like that.
This will give you names, addresses, IP addresses,
phone numbers, and even email addresses.
Why is all that important?
Because those can all be used as part of spear fishing
campaigns and social engineering campaigns, right.
And so this is information
and a way to get into the network.
So here's an example of Whois.
This is a Whois for Google.com.
Now, you'll notice here that the client
has prohibited several things here.
In the middle you'll see domain status,
client update prohibited, right.
The register of use complaints at mark monitor, right.
Down here at the registration down at the bottom.
Who's it registered to?
DNS admin, right, not the person's name.
Organization, Google link.
Where is there address?
1600 Amphitheater Parkway, Mount View California.
What's their phone number?
They give you their phone number,
they give you their email address, right.
Large companies tend to use a single big thing like this.
If you go to a smaller company, right.
Like, think of the neighborhood pizza store
that has a website you're gonna get the actual website
administrators name, their phone number,
you're gonna get their email address and things like that.
So Whois can be very helpful.
In recent years it's becoming less and less helpful
because people are starting to do privacy blocking.
But there are ways to look at historical Whois data as well
and that will give you some of that information back anyway.
Now, the other way you can do this is from the
command prompt using something called Host.
And Host is another command.
So you can type hostgoogle.com and you'll see
it comes back with google.com has these
6 IP addresses associated with it, right.
And here's where its mail servers are handled at, right.
It's gonna give you information about itself
and the servers that it knows about
and that's information and that gives you additional
forward-facing websites that you can look
for vulnerabilities and attack later on in the process.
That's the idea here when you start talking
about using Host or Whois is,
"what else can I find that's related to this domain"
"and how can I use that to my benefit?".
(soft electronic music)