1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
description = [[
Attempts to retrieve information about the domain name of the target
]]
---
-- @see whois-ip.nse
--
-- @usage nmap --script whois-domain.nse <target>
--
-- This script starts by querying the whois.iana.org (which is the root of the
-- whois servers). Using some patterns the script can determine if the response
-- represents a referral to a record hosted elsewhere. If that's the case it will
-- query that referral. The script keeps repeating this until the response don't
-- match with any of the patterns, meaning that there are no other referrals and
-- prints the output.
--
-- @output
-- PORT STATE SERVICE REASON
-- 80/tcp open http syn-ack
-- | whois-domain:
-- | whois3: Record found at whois.arin.net
-- | netrange: 199.19.112.0 - 199.19.119.255
-- | netname: WEBRULON-NETWORK
-- | orgname: webRulon, LLC
-- | orgid: WL-1
-- | country: US stateprov: NY
-- |
-- | orgtechname: webRulon Support
-- | orgtechemail: support@webrulon.com
-- |
-- | Domain name record found at whois.enom.com
-- |
-- | Registration Service Provided By: Namecheap.com
-- | Contact: support@namecheap.com
-- | Visit: http://namecheap.com
-- | Registered through: eNom, Inc.
-- |
-- | Domain name: random-foo-example.com
-- |
-- | Registrant Contact:
-- | Example
-- | John Foo ()
-- |
-- | Fax:
-- | Dimosthenous 215
-- | Athens, Attiki 17673
-- | GR
-- |
-- | Administrative Contact:
-- | Example
-- | John Foo (john@gmail.com)
-- | +30.69425555555
-- | Fax: +1.5555555555
-- | Dimosthenous 215
-- | Athens, Attiki 17673
-- | GR
-- |
-- | Technical Contact:
-- | Example
-- | John Foo (john@gmail.com)
-- | +30.69425555555
-- | Fax: +1.5555555555
-- | Dimosthenous 215
-- | Athens, Attiki 17673
-- | GR
-- |
-- | Status: Active
-- |
-- | Name Servers:
-- | dns1.registrar-servers.com
-- | dns2.registrar-servers.com
-- | dns3.registrar-servers.com
-- | dns4.registrar-servers.com
-- | dns5.registrar-servers.com
-- |
-- | Creation date: 14 Oct 2011 13:41:00
-- | Expiration date: 14 Oct 2013 05:41:00
---
author = "George Chatzisofroniou"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "external", "safe"}
local ipOps = require "ipOps"
local nmap = require "nmap"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
hostrule = function( host )
local is_private, err = ipOps.isPrivate( host.ip )
if is_private == nil then
stdnse.debug1("Error in Hostrule: %s.", err )
return false
end
return not is_private
end
action = function( host )
local mutexes = {}
-- If the user has provided a domain name.
if host.targetname then
local referral_patterns = {"refer:%s*(.-)\n", "Whois%sServer:%s*(.-)\n"}
-- Remove www prefix and add a newline.
local query_data = string.gsub(host.targetname, "^www%.", "") .. "\n"
local result
-- First server to query is iana's.
local referral = "whois.iana.org"
while referral do
if not mutexes[referral] then
mutexes[referral] = nmap.mutex(referral)
end
mutexes[referral] "lock"
result = {}
local socket = nmap.new_socket()
local catch = function()
stdnse.debug1( "fail")
socket:close()
end
local status, line = {}
local try = nmap.new_try( catch )
socket:set_timeout( 50000 )
try( socket:connect(referral, 43 ) )
try( socket:send( query_data ) )
while true do
local status, lines = socket:receive_lines(1)
if not status then
break
else
result[#result+1] = lines
end
end
socket:close()
mutexes[referral] "done"
if #result == 0 then
return nil
end
table.insert(result, 1, "\n\nDomain name record found at " .. referral .. "\n")
-- Do we have a referral?
referral = false
for _, p in ipairs(referral_patterns) do
referral = referral or string.match(table.concat(result), p)
end
end
result = table.concat( result )
return result
end
return "You should provide a domain name."
end
|
