Whois — bu TCP xizmati, vositasi va ma’lumotlar bazasi turi bo‘lib, u orqali domen nomi haqida ma’lumotlar olinadi, masalan: name server va registrar. Ushbu ma’lumotlar ko‘pincha ochiq bo‘ladi, chunki registrarlar shaxsiy ro‘yxatdan o‘tishni pullik xizmat sifatida taklif qilishadi.

Domen nomi haqida asosiy ma’lumotlarni to‘plash uchun odatiy forward qidiruvni bajarishimiz va domen nomi — megacorpone.com ni whois buyrug‘iga uzatishimiz mumkin, bunda bizning Ubuntu WHOIS serverimizning IP manzilini -h parametriga argument sifatida beramiz.

kali@kali:~$ **whois megacorpone.com -h 192.168.50.251**
   Domain Name: MEGACORPONE.COM
   Registry Domain ID: 1775445745_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.gandi.net
   Registrar URL: <http://www.gandi.net>
   Updated Date: 2019-01-01T09:45:03Z
   Creation Date: 2013-01-22T23:01:00Z
   Registry Expiry Date: 2023-01-22T23:01:00Z
...
Registry Registrant ID:
**Registrant Name: Alan Grofield**
Registrant Organization: MegaCorpOne
Registrant Street: 2 Old Mill St
Registrant City: Rachel
Registrant State/Province: Nevada
Registrant Postal Code: 89001
Registrant Country: US
Registrant Phone: +1.9038836342
...
Registry Admin ID:
**Admin Name: Alan Grofield**
Admin Organization: MegaCorpOne
Admin Street: 2 Old Mill St
Admin City: Rachel
Admin State/Province: Nevada
Admin Postal Code: 89001
Admin Country: US
Admin Phone: +1.9038836342
...
Registry Tech ID:
**Tech Name: Alan Grofield**
Tech Organization: MegaCorpOne
Tech Street: 2 Old Mill St
Tech City: Rachel
Tech State/Province: Nevada
Tech Postal Code: 89001
Tech Country: US
Tech Phone: +1.9038836342
...
**Name Server: NS1.MEGACORPONE.COM
Name Server: NS2.MEGACORPONE.COM
Name Server: NS3.MEGACORPONE.COM**
...

2-chi ro‘yxat — megacorpone.com domeniga nisbatan whois ishlatilishi

Bu ma’lumotlarning hammasi foydali emas, lekin biz bir nechta muhim ma’lumotlarni topdik. Avvalo, chiqish natijasidan ko‘rinadiki, domen nomi Alan Grofield tomonidan ro‘yxatdan o‘tkazilgan. MegaCorp One’ning aloqa sahifasiga ko‘ra, Alan — kompaniyaning "IT va Xavfsizlik Direktori".

Biz MegaCorp One’ning name serverlarini ham topdik. Name serverlar DNS’ning tarkibiy qismlaridan biri bo‘lib, hozircha ularni o‘rganmasligimiz mumkin, ammo bu serverlarni yozuvlarimizga qo‘shib qo‘yishimiz kerak.

Agar bizda IP manzil bo‘lsa, whois mijozidan foydalanib, reverse lookup (teskari qidiruv) bajarishimiz va qo‘shimcha ma’lumotlar to‘plashimiz ham mumkin.

kali@kali:~$ **whois 38.100.193.70 -h 192.168.50.251**
...
NetRange:       38.0.0.0 - 38.255.255.255
CIDR:           38.0.0.0/8
NetName:        COGENT-A
...
OrgName:        PSINet, Inc.
OrgId:          PSI
Address:        2450 N Street NW
City:           Washington
StateProv:      DC
PostalCode:     20037
Country:        US
RegDate:
Updated:        2015-06-04
...

3-chi ro‘yxat — Whois yordamida teskari qidiruv

Teskari qidiruv natijasida biz IP manzilni hosting qilayotgan tashkilot haqida ma’lumotga ega bo‘ldik. Bu ma’lumot keyinroq foydali bo‘lishi mumkin, va boshqa barcha to‘plagan ma’lumotlarimiz kabi, bu ma’lumotlarni ham yozuvlarimizga qo‘shamiz.