| name | whois-pentesting |
| description | Perform WHOIS enumeration and security testing on port 43 services. Use this skill whenever you need to enumerate domain/IP/ASN registration data, test WHOIS services for vulnerabilities, follow referral chains, or compare WHOIS vs RDAP data. Trigger this skill for any task involving WHOIS queries, domain registration lookups, IP allocation data, or testing legacy WHOIS infrastructure for injection vulnerabilities or rogue server abuse. |
WHOIS Pentesting Skill
A skill for enumerating and testing WHOIS services (TCP port 43) during reconnaissance and security assessments.
When to Use This Skill
Use this skill when you need to:
- Query WHOIS services for domain, IP, or ASN registration data
- Enumerate exposed WHOIS servers on port 43
- Follow WHOIS referral chains to find authoritative servers
- Test WHOIS services for injection vulnerabilities (SQLi, LDAP, command injection)
- Compare WHOIS vs RDAP data for consistency
- Identify rogue or stale WHOIS servers
- Perform asset expansion through registration data
Quick Start
whois -h <HOST> -p 43 "example.com"
printf '8.8.8.8\r\n' | nc -vn <HOST> 43
./scripts/whois-enumerate.sh <HOST> <QUERY>
WHOIS Protocol Basics
WHOIS is a plain-text TCP service on port 43:
- Client sends a query string
- Server returns human-readable text
- Connection close marks end of response
- No authentication, integrity, or confidentiality
Modern Context: WHOIS vs RDAP
ICANN sunset WHOIS for gTLD registration data on 2025-01-28. RDAP is now the authoritative protocol for machine-readable domain lookups. However, TCP/43 remains relevant for:
- Legacy or private WHOIS services
- RIR / IP allocation workflows
- Internal registries and custom asset databases
- Third-party tools that still trust WHOIS responses
Enumeration Procedures
Step 1: Basic WHOIS Query
Test both domain and IP/ASN style queries:
printf 'example.com\r\n' | nc -vn <HOST> 43
printf '8.8.8.8\r\n' | nc -vn <HOST> 43
printf 'AS15169\r\n' | nc -vn <HOST> 43
Why test multiple query types? Many WHOIS implementations expose different backends or parsers depending on the object type. One might leak more data than another.
Step 2: Follow Referral Chains
WHOIS responses often contain referrals to more authoritative servers:
./scripts/whois-referral-chase.sh <DOMAIN_OR_IP>
whois -I example.com
whois -I 8.8.8.8
nmap --script whois-domain <target>
nmap --script whois-ip <target>
Why chase referrals? Custom services may mishandle follow-up queries, redact fields inconsistently, or leak extra backend metadata. Some forgotten WHOIS infrastructure only appears through referral chains.
Step 3: Extract Key Fields
When the service is not fully redacted, pivot on these fields:
| Field | Use Case |
|---|
| Registrar / Org / abuse contact | Phishing reporting, org-mapping |
| Creation / update / expiration times | Spot newly registered infrastructure |
| Nameservers | Cluster domains managed by same operator |
| Referral server names | Find legacy or forgotten WHOIS infrastructure |
Step 4: Compare with RDAP
Even if port 43 is exposed, check for RDAP:
./scripts/rdap-lookup.sh <DOMAIN_OR_IP>
curl -s https://www.rdap.net/domain/example.com | jq
curl -s https://rdap.arin.net/registry/ip/8.8.8.8 | jq
Why compare? A 2024 measurement study found WHOIS and RDAP are not always interchangeable, with inconsistencies in registrar identifiers, creation dates, and nameservers. If your recon pipeline depends on these values, compare both sources.
Security Testing
Injection Vulnerabilities
WHOIS services query databases, making them susceptible to injection attacks. Test for:
- SQL Injection in query parsing
- LDAP Injection in directory backends
- Command Injection in shell wrappers
- HTTP API injection in registrar portals
./scripts/whois-fuzz.sh <HOST> <PORT>
whois -h <HOST> -p 43 "a') or 1=1#"
printf "'; DROP TABLE domains;--\r\n" | nc -vn <HOST> 43
printf "*\r\n" | nc -vn <HOST> 43
printf "$(whoami)\r\n" | nc -vn <HOST> 43
Why fuzz? The protocol itself is simple; the dangerous part is usually the parser or backend glue code. Internal or niche WHOIS deployments often have custom query handling.
Rogue/Stale WHOIS Servers
A 2024-2025 attack path involves abusing outdated WHOIS trust:
- Registry changes WHOIS hostname
- Old domain expires
- Attacker registers old hostname
- Attacker operates rogue WHOIS server
Impact: Rogue WHOIS responses can enable:
- Stored/reflected XSS in web WHOIS frontends
- Parser bugs / command injection in consuming libraries
- Bad automation decisions when systems trust attacker-controlled data
Check for: Returned refer: / Whois Server: values pointing to expired or attacker-registerable domains.
Shodan Recon
Find exposed WHOIS services:
port:43 whois
port:43 "whois server"
port:43 "whois database"
Output Analysis
When reviewing WHOIS responses, look for:
- Database identifiers - Sometimes the backend database appears in responses
- Inconsistent redaction - Some fields redacted, others exposed
- Referral chains - Pointers to more authoritative servers
- Timestamps - Creation, update, expiration dates
- Contact information - Abuse contacts, registrant details
- Nameserver patterns - Clustering opportunities
Scripts Reference
| Script | Purpose |
|---|
scripts/whois-enumerate.sh | Basic WHOIS enumeration for domain/IP/ASN |
scripts/whois-referral-chase.sh | Follow WHOIS referral chains automatically |
scripts/rdap-lookup.sh | Query RDAP as structured alternative |
scripts/whois-fuzz.sh | Fuzz WHOIS for injection vulnerabilities |
Best Practices
- Always test multiple query types - Domain, IP, and ASN queries may hit different backends
- Follow referrals - Authoritative data often lives on referred servers
- Compare WHOIS vs RDAP - Inconsistencies can reveal misconfigurations or outdated data
- Check for injection - Simple protocol, complex backends
- Document referral chains - May reveal forgotten infrastructure
- Verify timestamps - Spot newly registered or expiring infrastructure
References
