whois-pentesting

name

whois-pentesting

description

Perform WHOIS enumeration and security testing on port 43 services. Use this skill whenever you need to enumerate domain/IP/ASN registration data, test WHOIS services for vulnerabilities, follow referral chains, or compare WHOIS vs RDAP data. Trigger this skill for any task involving WHOIS queries, domain registration lookups, IP allocation data, or testing legacy WHOIS infrastructure for injection vulnerabilities or rogue server abuse.

WHOIS Pentesting Skill

A skill for enumerating and testing WHOIS services (TCP port 43) during reconnaissance and security assessments.

When to Use This Skill

Use this skill when you need to:

• Query WHOIS services for domain, IP, or ASN registration data
• Enumerate exposed WHOIS servers on port 43
• Follow WHOIS referral chains to find authoritative servers
• Test WHOIS services for injection vulnerabilities (SQLi, LDAP, command injection)
• Compare WHOIS vs RDAP data for consistency
• Identify rogue or stale WHOIS servers
• Perform asset expansion through registration data

Quick Start

# Basic domain query
whois -h <HOST> -p 43 "example.com"

# Basic IP query
printf '8.8.8.8\r\n' | nc -vn <HOST> 43

# Use bundled scripts for automation
./scripts/whois-enumerate.sh <HOST> <QUERY>

WHOIS Protocol Basics

WHOIS is a plain-text TCP service on port 43:

• Client sends a query string
• Server returns human-readable text
• Connection close marks end of response
• No authentication, integrity, or confidentiality

Modern Context: WHOIS vs RDAP

ICANN sunset WHOIS for gTLD registration data on . RDAP is now the authoritative protocol for machine-readable domain lookups. However, TCP/43 remains relevant for: