📖 What is Whois?
Whois is a query and response protocol used for searching databases that store the registered users or assignees of an internet resource, such as a domain name or an IP address block. It provides essential reconnaissance data, including registrant contact information.
"Be aware that Whois Privacy services often mask this data. If the data is redacted, you will need to pivot to other OSINT techniques."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Whois?
- ▸ Registrar and Registrant Data: Whois reveals the entity that registered the domain and the company that sold it, helping identify the target's infrastructure providers.
- ▸ Name Server Identification: Identifying authoritative name servers allows a tester to determine if the target uses third-party DNS or manages their own infrastructure.
- ▸ IP Address Allocation: Whois queries for IP blocks through regional registries like ARIN or RIPE help testers identify the organization owning a specific network range.
- ▸ Registration Timelines: Analyzing registration and expiration dates provides clues about the age of a domain or potential windows for domain hijacking and expiration attacks.
- ▸ RDAP Integration: Registration Data Access Protocol (RDAP) is the modern, standardized successor to Whois, providing machine-readable data via HTTP instead of a custom port.
🎯 How does Whois appear on the PT0-002 Exam?
You may be asked to identify the best tool for passive reconnaissance to find the administrative contact and registration date of a target domain without interacting with the server.
A scenario might describe a need to map out an organization's network footprint; you would use Whois to find the IP address blocks assigned to that specific entity.
Expect questions where you must determine the next step after finding that a target's Whois record is redacted by a privacy service, requiring a pivot to other OSINT tools.
❓ Frequently Asked Questions
Is Whois considered active or passive reconnaissance?
Whois is passive reconnaissance because you are querying a third-party database maintained by a registrar or registry rather than interacting directly with the target's own servers.
How does Whois differ from a DNS query like dig or nslookup?
Whois retrieves registration and ownership data from a registrar, whereas DNS queries retrieve technical routing records (like A, MX, or TXT records) from the DNS system.
What should a tester do if Whois privacy is enabled?
When data is redacted, testers should pivot to other OSINT techniques, such as searching social media, using search engine dorks, or analyzing SSL/TLS certificate details for clues.