From 0d47952611198ef6b1163f366dc03922d20b1475 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Wed, 17 Apr 2024 09:42:04 +0200
Subject: Adding upstream version 7.94+git20230807.3be01efb1+dfsg.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 scripts/whois-domain.nse | 173 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 173 insertions(+)
 create mode 100644 scripts/whois-domain.nse

(limited to 'scripts/whois-domain.nse')

diff --git a/scripts/whois-domain.nse b/scripts/whois-domain.nse
new file mode 100644
index 0000000..8404929
--- /dev/null
+++ b/scripts/whois-domain.nse
@@ -0,0 +1,173 @@
+description = [[
+Attempts to retrieve information about the domain name of the target
+]]
+
+---
+-- @see whois-ip.nse
+--
+-- @usage nmap --script whois-domain.nse <target>
+--
+-- This script starts by querying the whois.iana.org (which is the root of the
+-- whois servers). Using some patterns the script can determine if the response
+-- represents a referral to a record hosted elsewhere. If that's the case it will
+-- query that referral. The script keeps repeating this until the response don't
+-- match with any of the patterns, meaning that there are no other referrals and
+-- prints the output.
+--
+-- @output
+-- PORT   STATE SERVICE REASON
+-- 80/tcp open  http    syn-ack
+-- | whois-domain:
+-- | whois3: Record found at whois.arin.net
+-- | netrange: 199.19.112.0 - 199.19.119.255
+-- | netname: WEBRULON-NETWORK
+-- | orgname: webRulon, LLC
+-- | orgid: WL-1
+-- | country: US stateprov: NY
+-- |
+-- | orgtechname: webRulon Support
+-- | orgtechemail: support@webrulon.com
+-- |
+-- | Domain name record found at whois.enom.com
+-- |
+-- | Registration Service Provided By: Namecheap.com
+-- | Contact: support@namecheap.com
+-- | Visit: http://namecheap.com
+-- | Registered through: eNom, Inc.
+-- |
+-- | Domain name: random-foo-example.com
+-- |
+-- | Registrant Contact:
+-- |    Example
+-- |    John Foo ()
+-- |
+-- |    Fax:
+-- |    Dimosthenous 215
+-- |    Athens, Attiki 17673
+-- |    GR
+-- |
+-- | Administrative Contact:
+-- |    Example
+-- |    John Foo (john@gmail.com)
+-- |    +30.69425555555
+-- |    Fax: +1.5555555555
+-- |    Dimosthenous 215
+-- |    Athens, Attiki 17673
+-- |    GR
+-- |
+-- | Technical Contact:
+-- |    Example
+-- |    John Foo (john@gmail.com)
+-- |    +30.69425555555
+-- |    Fax: +1.5555555555
+-- |    Dimosthenous 215
+-- |    Athens, Attiki 17673
+-- |    GR
+-- |
+-- | Status: Active
+-- |
+-- | Name Servers:
+-- |    dns1.registrar-servers.com
+-- |    dns2.registrar-servers.com
+-- |    dns3.registrar-servers.com
+-- |    dns4.registrar-servers.com
+-- |    dns5.registrar-servers.com
+-- |
+-- | Creation date: 14 Oct 2011 13:41:00
+-- | Expiration date: 14 Oct 2013 05:41:00
+---
+
+author = "George Chatzisofroniou"
+license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
+categories = {"discovery", "external", "safe"}
+
+local ipOps = require "ipOps"
+local nmap = require "nmap"
+local stdnse = require "stdnse"
+local string = require "string"
+local table = require "table"
+
+hostrule = function( host )
+  local is_private, err = ipOps.isPrivate( host.ip )
+  if is_private == nil then
+    stdnse.debug1("Error in Hostrule: %s.", err )
+    return false
+  end
+
+  return not is_private
+end
+
+
+action = function( host )
+
+  local mutexes = {}
+
+  -- If the user has provided a domain name.
+  if host.targetname then
+
+    local referral_patterns = {"refer:%s*(.-)\n", "Whois%sServer:%s*(.-)\n"}
+
+    -- Remove www prefix and add a newline.
+    local query_data = string.gsub(host.targetname, "^www%.", "") .. "\n"
+
+    local result
+
+    -- First server to query is iana's.
+    local referral = "whois.iana.org"
+
+    while referral do
+
+      if not mutexes[referral] then
+        mutexes[referral] = nmap.mutex(referral)
+      end
+
+      mutexes[referral] "lock"
+
+      result = {}
+      local socket = nmap.new_socket()
+      local catch = function()
+        stdnse.debug1( "fail")
+        socket:close()
+      end
+
+      local status, line = {}
+      local try = nmap.new_try( catch )
+
+      socket:set_timeout( 50000 )
+
+      try( socket:connect(referral, 43 ) )
+      try( socket:send( query_data ) )
+
+      while true do
+        local status, lines = socket:receive_lines(1)
+        if not status then
+          break
+        else
+          result[#result+1] = lines
+        end
+      end
+
+      socket:close()
+
+      mutexes[referral] "done"
+
+      if #result == 0 then
+        return nil
+      end
+
+      table.insert(result, 1, "\n\nDomain name record found at " .. referral .. "\n")
+
+      -- Do we have a referral?
+      referral = false
+      for _, p in ipairs(referral_patterns) do
+        referral = referral or string.match(table.concat(result), p)
+      end
+
+    end
+
+    result = table.concat( result )
+    return result
+  end
+  return "You should provide a domain name."
+end
+
-- 
cgit v1.2.3