OSINT Fundamentals: WHOIS & Search Engines

1. WHOIS: Querying the Internet's Address Book

Every registered domain name has a public record associated with it, much like a public land deed. This record contains details about who owns the domain, who their registrar is, and technical contact information. The protocol used to query this database is called WHOIS.

WHOIS is a treasure trove of information for an ethical hacker. The data it reveals can be used to:

• Identify key personnel and their email addresses (useful for later social engineering).
• Discover when a domain is set to expire, which could present an opportunity if the owner forgets to renew it.
• Determine the name servers, which can give clues about the target's hosting provider and infrastructure.

Performing a WHOIS Lookup

You can perform WHOIS lookups using online web services or, more conveniently, directly from your Kali Linux terminal.

WHOIS Privacy and Its Limits

As you saw in the video, many domain owners now use privacy protection services (like "WHOIS Guard") to redact their personal information from public records. This replaces their name, address, and email with the details of a proxy service.

Even when information is redacted, you can still gather useful intelligence, such as the registrar, creation and expiration dates, and the name servers handling the domain's DNS.

Hands-on Lab 1: Your First WHOIS Query

Now it's time to use your Kali VM.

1. Open a terminal in your Kali Linux environment.
2. Choose a target domain for your passive reconnaissance. A large, public company like tesla.com or github.com is a good, safe choice for this exercise.
3. Run the whois command on your chosen target:

   whois tesla.com
   

4. Examine the output. Can you identify the Registrar, the Creation Date, the Expiration Date, and the Name Servers?
5. A good practice during reconnaissance is to save all your findings. Redirect the output of your command to a text file for later analysis. The HackerSploit video touched on this.

   whois tesla.com > tesla_whois.txt
   

   You now have a permanent record of your query in a file named tesla_whois.txt. You can view it with cat tesla_whois.txt or less tesla_whois.txt.

2. Google Hacking: Finding What's Hidden in Plain Sight

Search engines like Google are incredibly powerful tools for reconnaissance. They index vast amounts of the internet, sometimes including things that weren't meant to be public, like sensitive documents, login pages, and configuration files.

Google Dorking, also known as Google Hacking, is the technique of using Google's advanced search operators to find this specific, often sensitive, information.

A Critical Warning: Google Dorking itself is legal—you are simply using a public search engine. However, using the information you find to access a system or file you are not authorized to view is illegal. Always respect this boundary.

Key Google Dorking Operators

The power of Google Dorking comes from combining keywords with special operators. Here are the most fundamental ones:

• site: - Restricts the search to a specific website or domain.
• filetype: (or ext:) - Restricts results to a specific file extension (e.g., pdf, xls, log).
• intitle: - Searches for keywords within the title of a web page.
• inurl: - Searches for keywords within the URL of a web page.
• intext: - Searches for keywords within the body text of a web page.

Let's see how to use these operators in practice.

The Google Hacking Database (GHDB)

You don't always have to invent your own dorks. A community of security researchers maintains the Google Hacking Database (GHDB), which is a collection of pre-made queries known to uncover interesting vulnerabilities and information.

Exploring the GHDB on the Exploit-DB website is an excellent way to learn what's possible with Google Dorking.

Hands-on Lab 2: Your First Dorking Queries

Now, let's try some Google Dorking. You can do this from any web browser. We'll continue using tesla.com as our safe, public target.

Try to construct queries for the following challenges:

1. Find Login Portals: Search for pages on tesla.com that might be login portals.
   Hint: Use the site: operator combined with intitle: or inurl: and keywords like "login", "signin", or "portal".

   Click for a possible query

   site:tesla.com intitle:"sign in" OR inurl:login

2. Find Publicly Exposed Documents: Look for any potentially sensitive documents, like spreadsheets (.xls, .xlsx) or presentations (.ppt, .pptx).
   Hint: Use site: and filetype:. You might combine multiple filetypes with OR.

   Click for a possible query

   site:tesla.com (filetype:xls OR filetype:xlsx OR filetype:pdf)

3. Find Information about Employees: Try to find employee profiles on LinkedIn. This can be useful for identifying potential targets for phishing.
   Hint: Use site:linkedin.com/in/ and search for the company name in the text.

   Click for a possible query

   site:linkedin.com/in/ "tesla" "software engineer"

Experiment with your own dorks. See what you can find!

Conclusion

Congratulations on completing your first hands-on reconnaissance exercises! You've taken your theoretical knowledge and applied it using real-world tools and techniques.

Key Takeaways:

• The whois command is a simple but effective tool for gathering domain registration data, which provides clues about a target's infrastructure and personnel.
• Google Dorking is a powerful passive recon technique that uses advanced search operators to find information that has been inadvertently indexed by search engines.
• Effective reconnaissance involves creativity and persistence. Combining different tools and techniques yields the best results.

Next Lesson Preview:
Manually running whois and crafting Google Dorks is effective, but it can be slow. In the next lesson, we'll explore tools that automate parts of this process. You'll learn how to use theHarvester, a classic reconnaissance tool that rapidly scours public sources (including search engines and PGP key servers) to gather email addresses, subdomains, and hostnames associated with a target domain.