Skip to content

Commit 7a1c330

Browse files
carlospolopcarlospolop
authored
Merge pull request #2033 from HackTricks-wiki/research_update_src_network-services-pentesting_43-pentesting-whois_20260319_205455
Research Update Enhanced src/network-services-pentesting/43-...
2 parents d4bc148 + 216dbcd commit 7a1c330

1 file changed

Lines changed: 107 additions & 5 deletions

File tree

‎src/network-services-pentesting/43-pentesting-whois.md‎

Lines changed: 107 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,33 +8,127 @@ The **WHOIS** protocol serves as a standard method for **inquiring about the reg
88

99
**Default port:** 43
1010

11-
```
11+
```text
1212
PORT STATE SERVICE
1313
43/tcp open whois?
1414
```
1515

16+
From an offensive point of view, remember that **WHOIS is just a plain-text TCP service**: the client sends a query, the server returns human-readable text, and the **connection close marks the end of the response**. There is **no built-in authentication, integrity, or confidentiality** in the protocol.
17+
18+
### Modern Reality: WHOIS vs RDAP
19+
20+
For Internet domain registration data, **WHOIS is no longer the authoritative option for many public gTLD workflows**. ICANN sunset WHOIS for gTLD registration data on **2025-01-28**, making **RDAP** the protocol to prefer for machine-readable domain registration lookups.
21+
22+
However, TCP/`43` is still worth testing because it keeps appearing in:
23+
24+
- **Legacy or private WHOIS services**
25+
- **RIR / IP allocation workflows**
26+
- **Internal registries and custom asset databases**
27+
- **Third-party web tools and old automation** that still trust WHOIS responses
28+
29+
If your goal is **reverse whois**, broader asset expansion, or recursive external recon, check [the External Recon Methodology page](../generic-methodologies-and-resources/external-recon-methodology/README.md) to avoid duplicating work here.
30+
1631
## Enumerate
1732

1833
Get all the information that a whois service has about a domain:
1934

2035
```bash
2136
whois -h <HOST> -p <PORT> "domain.tld"
22-
echo "domain.ltd" | nc -vn <HOST> <PORT>
37+
printf 'domain.tld\r\n' | nc -vn <HOST> <PORT>
38+
```
39+
40+
If you find a public-facing WHOIS service, test both **domain** and **IP/ASN** style queries because many implementations expose different backends or parsers depending on the object type:
41+
42+
```bash
43+
# Domain
44+
printf 'example.com\r\n' | nc -vn <HOST> 43
45+
46+
# IP / CIDR / ASN examples
47+
printf '8.8.8.8\r\n' | nc -vn <HOST> 43
48+
printf 'AS15169\r\n' | nc -vn <HOST> 43
2349
```
2450

2551
Notice than sometimes when requesting for some information to a WHOIS service the database being used appears in the response:
2652

2753
![](<../images/image (301).png>)
2854

55+
### Referral Chasing and Better Enumeration
56+
57+
A lot of useful WHOIS enumeration is hidden behind **referrals**. For example, one server may only point you to the next authoritative WHOIS server for a TLD or an RIR. This is worth testing manually because some custom services mishandle follow-up queries, redact fields inconsistently, or leak extra backend metadata.
58+
59+
Useful options and helpers:
60+
61+
```bash
62+
# Ask IANA first and then follow the authoritative referral (common Linux whois clients)
63+
whois -I example.com
64+
whois -I 8.8.8.8
65+
66+
# Let Nmap follow domain/IP WHOIS referrals automatically
67+
nmap --script whois-domain <target>
68+
nmap --script whois-ip <target>
69+
70+
# For IP ranges, disable the WHOIS cache if you care about smaller delegated blocks
71+
nmap --script whois-ip --script-args whois.whodb=nocache <target>
72+
```
73+
74+
Interesting fields to pivot on when the service is not fully redacted:
75+
76+
- **Registrar / Org / abuse contact** for phishing reporting or org-mapping
77+
- **Creation / update / expiration times** to spot newly registered infrastructure
78+
- **Nameservers** to cluster domains managed by the same operator
79+
- **Referral server names** to find legacy or forgotten WHOIS infrastructure
80+
81+
### RDAP as the Structured Successor
82+
83+
Even if the exposed service is classic WHOIS on port `43`, check whether the same provider also offers **RDAP** because RDAP is often easier to parse and better for automation:
84+
85+
```bash
86+
curl -s https://www.rdap.net/domain/example.com | jq
87+
curl -s https://rdap.arin.net/registry/ip/8.8.8.8 | jq
88+
```
89+
90+
A practical offensive nuance: a 2024 measurement study comparing WHOIS and RDAP at scale found that they are **not always interchangeable**, with inconsistencies in fields such as registrar identifiers, creation dates, and nameservers. If your recon pipeline depends on those values, compare both sources before making decisions.
91+
92+
## Offensive Notes
93+
94+
### Backend Injection in Custom WHOIS Gateways
95+
2996
Also, the WHOIS service always needs to use a **database** to store and extract the information. So, a possible **SQLInjection** could be present when **querying** the database from some information provided by the user. For example doing: `whois -h 10.10.10.155 -p 43 "a') or 1=1#"` you could be able to **extract all** the **information** saved in the database.
3097

98+
Do not limit testing to SQLi. In internal or niche WHOIS deployments, the query can be proxied to:
99+
100+
- SQL / NoSQL backends
101+
- LDAP directories
102+
- shell wrappers around other lookup tools
103+
- HTTP APIs used by registrar or asset-management portals
104+
105+
So fuzz with payloads for **SQLi**, **LDAP injection**, delimiter abuse, very long strings, and malformed UTF-8 / control characters. The protocol itself is simple; the dangerous part is usually the **parser or backend glue code**.
106+
107+
### Rogue / Stale WHOIS Servers
108+
109+
A relevant 2024-2025 attack path is abusing **outdated WHOIS trust**. If a registry or tool changes its WHOIS hostname and the old domain expires, an attacker may be able to register the old hostname and operate a **rogue WHOIS server**.
110+
111+
That gives the attacker control over the response body seen by:
112+
113+
- old WHOIS clients with hardcoded server mappings
114+
- web applications that fetch WHOIS output and render it back to users
115+
- automation that still uses WHOIS for domain validation or ownership workflows
116+
117+
This matters because a rogue WHOIS response can become an entry point for:
118+
119+
- **stored/reflected XSS** in web WHOIS frontends
120+
- **parser bugs / command injection / eval bugs** in libraries consuming the text response
121+
- **bad automation decisions** when systems trust attacker-controlled WHOIS contact data
122+
123+
When you find a private or legacy WHOIS service, always check whether the returned `refer:` / `Whois Server:` values, banners, or TLD mappings point to **expired or attacker-registerable domains**.
124+
31125
## Shodan
32126

33127
- `port:43 whois`
34128

35129
## HackTricks Automatic Commands
36130

37-
```
131+
```yaml
38132
Protocol_Name: WHOIS #Protocol Abbreviation if there is one.
39133
Port_Number: 43 #Comma separated if there is more than one.
40134
Protocol_Description: WHOIS #Protocol Abbreviation Spelled out
@@ -51,10 +145,18 @@ Entry_1:
51145
Entry_2:
52146
Name: Banner Grab
53147
Description: Grab WHOIS Banner
54-
Command: whois -h {IP} -p 43 {Domain_Name} && echo {Domain_Name} | nc -vn {IP} 43
148+
Command: whois -h {IP} -p 43 {Domain_Name} && printf '{Domain_Name}\r\n' | nc -vn {IP} 43
149+
150+
Entry_3:
151+
Name: Nmap WHOIS Referrals
152+
Description: Follow WHOIS referrals for domain and IP lookups
153+
Command: nmap --script whois-domain,whois-ip --script-args whois.whodb=nocache {IP}
55154
```
56155
57-
{{#include ../banners/hacktricks-training.md}}
58156
59157
158+
## References
60159
160+
- [ICANN Update: Launching RDAP; Sunsetting WHOIS](https://www.icann.org/en/announcements/details/icann-update-launching-rdap-sunsetting-whois-27-01-2025-en)
161+
- [watchTowr Labs - We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI](https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/)
162+
{{#include ../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)