Introduction
Information gathering is the critical first step in any security assessment. Before interacting directly with a target's servers, security professionals perform "passive reconnaissance" to collect publicly available information.
Passive reconnaissance matters because it lets you build context before you create any obvious signal on the target's infrastructure. Good operators do not begin with packets if public records can already answer foundational questions such as who owns the domain, which registrar is involved, and which nameservers appear to control the namespace.
One of the most fundamental techniques for passive reconnaissance is Whois enumeration. Whois is a widely used internet record listing that identifies who owns a domain and how to get in contact with them. The Internet Corporation for Assigned Names and Numbers (ICANN) regulates domain name registration and ownership, requiring registrars to maintain these public records.
In this lab, you will learn how to use the Linux command-line to query Whois databases. You will gather foundational intelligence about a target domain, extract administrative contact information, and identify the authoritative nameservers responsible for routing the target's traffic.
Perform Whois Lookup
In this step, you will learn how to perform a basic Whois lookup against a target domain. We will use ubuntu.com as our target for this educational exercise.
The whois command in Linux is a client utility that queries the Whois directory service. It retrieves information about a domain's registration, including the registrar, creation and expiration dates, and the organization that owns it.
Whois data is not a direct map of running systems, but it does reveal ownership and administrative relationships. That makes it useful for scoping, attribution, and understanding which external providers may be part of the target's footprint.
To keep a record of our findings, we will use the output redirection operator (>). This operator takes the output of a command that would normally print to your screen and saves it into a file instead.
Ensure you are in your default working directory (~/project). Run the following command to perform a Whois lookup on ubuntu.com and save the entire output to a file named whois_full.txt:
whois ubuntu.com > whois_full.txt
Because we redirected the output, you will not see anything printed on the screen. To verify that the command worked and to view the first few lines of the file, use the head command:
head -n 15 whois_full.txt
You should see an output similar to this, showing the initial registration details:
Domain Name: UBUNTU.COM
Registry Domain ID: 121365156_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2024-04-27T10:28:21Z
Creation Date: 2004-05-29T18:38:39Z
Registry Expiry Date: 2026-05-29T18:38:39Z
Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2086851750
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Name Server: NS1.CANONICAL.COM
This raw data contains a wealth of information, but it can be overwhelming to read through manually. In the next steps, we will learn how to filter this file for specific intelligence.
Extract Administrative Contacts
In this step, you will learn how to extract specific contact information from the raw Whois data we collected.
During reconnaissance, identifying administrative and technical contacts is valuable. These email addresses and phone numbers can provide insight into the target organization's structure and are often used in later stages of an assessment (such as social engineering or identifying key personnel).
Even when modern privacy rules hide personal details, the remaining registrar and abuse contacts still tell you something about how the domain is managed and which parties are responsible for it.
To extract this information, we will use the grep command. grep is a powerful text-search utility in Linux that prints lines matching a specific pattern. We will use the -i flag with grep to make our search case-insensitive, meaning it will match "Email", "email", or "EMAIL".
Run the following command to search for the word "email" within our whois_full.txt file, and save the results to a new file named contacts.txt:
grep -i "email" whois_full.txt > contacts.txt
Now, let's view the contents of the contacts.txt file using the cat command, which reads a file and outputs its entire content to the screen:
cat contacts.txt
Your output should look similar to this, displaying the contact emails associated with the domain:
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrant Email: Select Request Email Form at https://domains.markmonitor.com/whois/ubuntu.com
Tech Email: Select Request Email Form at https://domains.markmonitor.com/whois/ubuntu.com
...
Note: Due to modern privacy regulations like GDPR, many registrars now redact personal email addresses from public Whois records. However, you will often still find abuse contact emails or generic administrative addresses, which are still useful pieces of intelligence.
Identify Target Nameservers
In this final step, you will extract the authoritative nameservers for the target domain.
Nameservers are a fundamental part of the Domain Name System (DNS). They act like the internet's directory, translating human-readable domain names (like ubuntu.com) into IP addresses that computers use to communicate. Identifying a target's nameservers tells you which company hosts their DNS infrastructure. This can reveal whether they manage their own servers internally or use a third-party cloud provider (like AWS, Cloudflare, or a specific registrar).
This is strategically useful because DNS providers often become part of the attack surface story. They may expose transfer settings, misconfigurations, or clues about how the target operates its external services.
We will once again use the grep command to filter our original Whois data. This time, we are looking for the term "Name Server".
Run the following command to extract the nameserver records from whois_full.txt and save them to a file named nameservers.txt:
grep -i "Name Server" whois_full.txt > nameservers.txt
Use the cat command to view the extracted nameservers:
cat nameservers.txt
You should see an output similar to the following:
Name Server: NS1.CANONICAL.COM
Name Server: NS2.CANONICAL.COM
Name Server: NS3.CANONICAL.COM
Name Server: ns1.canonical.com
Name Server: ns3.canonical.com
Name Server: ns2.canonical.com
In this example, the nameservers point to CANONICAL.COM. Canonical is the company that develops and maintains Ubuntu. This tells us that Canonical manages their own DNS infrastructure rather than relying on a third-party service, which is a valuable piece of technical intelligence.
Summary
Congratulations! You have successfully completed the Domain and Whois Enumeration lab.
In this lab, you learned how to perform passive reconnaissance using native Linux command-line tools. You used the whois command to query public domain registration databases and utilized output redirection (>) to save your findings. Furthermore, you practiced using the grep command to parse through large amounts of text, successfully extracting specific, actionable intelligence such as administrative contact emails and authoritative nameservers.
These foundational skills are essential for mapping out a target's external footprint before any active scanning or engagement begins.
