whois-lookup

用途

该技能使用 whois 命令查询域名或 IP 地址的注册信息，解析并整理关键字段，以报告格式输出。

适用场景

• 核实域名所有权与注册商
• 根据域名到期日期评估接管潜力
• 识别 IP 地址关联的 ASN 与组织
• 探索相关 IP 范围（CIDR）以发现更多攻击面

前置条件

安装 whois 命令：

# Ubuntu/Debian
sudo apt-get install -y whois
# CentOS/RHEL
sudo yum install -y whois

需要设置环境变量 SECSKILL_TARGET：要查询的域名或 IP 地址。

输入

变量	必需	描述
SECSKILL_TARGET	必需	要查询的域名或 IP 地址
SECSKILL_OUTPUT_DIR	可选	保存结果的目录（默认：./output）

工作流程

步骤 1：准备环境并检测输入类型

export TARGET="${SECSKILL_TARGET:?Set the SECSKILL_TARGET environment variable (domain or IP)}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
mkdir -p "$OUTDIR"

# Detect IPv4/IPv6
if echo "$TARGET" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
  TARGET_TYPE="ipv4"
elif echo "$TARGET" | grep -qE '^[0-9a-fA-F:]+:[0-9a-fA-F:]+$'; then
  TARGET_TYPE="ipv6"
else
  TARGET_TYPE="domain"
fi

echo "[*] Target: $TARGET (type: $TARGET_TYPE)"
SAFE_NAME=$(echo "$TARGET" | tr '/' '_')
OUTFILE="$OUTDIR/whois_${SAFE_NAME}.txt"

步骤 2：运行 WHOIS 查询并保存原始输出

echo "[*] Running WHOIS lookup..."
echo "===== WHOIS Raw Data: $TARGET =====" > "$OUTFILE"
echo "Query time: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$OUTFILE"
echo "" >> "$OUTFILE"

whois "$TARGET" 2>/dev/null >> "$OUTFILE"

if [ $? -ne 0 ] || [ ! -s "$OUTFILE" ]; then
  echo "[-] WHOIS lookup failed or returned no results"
  exit 1
fi
echo "[+] Raw WHOIS data saved: $OUTFILE"

步骤 3：解析域名目标的关键字段

if [ "$TARGET_TYPE" = "domain" ]; then
  echo ""
  echo "===== Domain WHOIS Summary ====="

  REGISTRAR=$(grep -iE "Registrar:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  CREATED=$(grep -iE "Creation Date:|Created:|Registered:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  EXPIRES=$(grep -iE "Expiry Date:|Expiration Date:|Expires:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  UPDATED=$(grep -iE "Updated Date:|Last Modified:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  STATUS=$(grep -iE "Domain Status:" "$OUTFILE" | head -3 | cut -d':' -f2- | xargs | tr '\n' ', ')
  NS=$(grep -iE "Name Server:" "$OUTFILE" | cut -d':' -f2- | xargs | tr ' ' '\n' | sort -u | tr '\n' ' ')
  REGISTRANT=$(grep -iE "Registrant Organization:|Registrant Name:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  REGISTRANT_EMAIL=$(grep -iE "Registrant Email:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)

  echo "Registrar       : ${REGISTRAR:-(not available)}"
  echo "Registrant      : ${REGISTRANT:-(privacy protected)}"
  echo "Registrant email: ${REGISTRANT_EMAIL:-(redacted)}"
  echo "Created         : ${CREATED:-(not available)}"
  echo "Expires         : ${EXPIRES:-(not available)}"
  echo "Last updated    : ${UPDATED:-(not available)}"
  echo "Domain status   : ${STATUS:-(not available)}"
  echo "Name servers    : ${NS:-(not available)}"
  echo "==============================="
fi

步骤 4：解析 IP 目标的关键字段

if [ "$TARGET_TYPE" = "ipv4" ] || [ "$TARGET_TYPE" = "ipv6" ]; then
  echo ""
  echo "===== IP WHOIS Summary ====="

  NETRANGE=$(grep -iE "NetRange:|inetnum:|CIDR:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  CIDR=$(grep -iE "CIDR:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  NETNAME=$(grep -iE "NetName:|netname:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  ORGNAME=$(grep -iE "OrgName:|org-name:|owner:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  COUNTRY=$(grep -iE "Country:|country:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  ASN=$(grep -iE "OriginAS:|origin:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)
  ABUSE=$(grep -iE "OrgAbuseEmail:|abuse-mailbox:" "$OUTFILE" | head -1 | cut -d':' -f2- | xargs)

  echo "IP range     : ${NETRANGE:-(not available)}"
  echo "CIDR         : ${CIDR:-(not available)}"
  echo "Network name : ${NETNAME:-(not available)}"
  echo "Organization : ${ORGNAME:-(not available)}"
  echo "Country      : ${COUNTRY:-(not available)}"
  echo "ASN          : ${ASN:-(not available)}"
  echo "Abuse email  : ${ABUSE:-(not available)}"
  echo "========================="
fi

步骤 5：从域名 A 记录查询 IP 范围（仅域名目标）

if [ "$TARGET_TYPE" = "domain" ]; then
  echo ""
  echo "[*] Looking up IP range from domain A record..."
  IP=$(dig "$TARGET" A +short 2>/dev/null | head -1)
  if [ -n "$IP" ]; then
    echo "[*] Resolved IP: $IP - running WHOIS..."
    whois "$IP" 2>/dev/null \
      | grep -iE "NetRange:|inetnum:|CIDR:|OrgName:|org-name:" \
      | head -10 \
      | tee -a "$OUTFILE"
  else
    echo "[-] No A record found"
  fi
fi

完成条件

• 原始 WHOIS 数据已保存到文件
• 关键字段（注册商、日期、名称服务器或 IP 范围、组织）已解析并显示
• 显示输出文件路径

失败模式

症状	原因	解决方式
whois: command not found	未安装	运行 apt-get install whois
结果为空	WHOIS 服务器无响应	手动尝试：whois -h whois.iana.org $TARGET
因隐私保护无信息	适用 GDPR/隐私盾	预期结果。使用其他侦察方法
速率限制错误	请求过多	等待后重试

说明

• 即将到期的域名应进一步评估域名接管潜力。
• 自 GDPR 以来，许多域名的注册人信息已被隐去。
• IP 范围数据可用于确定额外扫描的范围。
• 结果可与 port-scan 技能链式使用。