One of the first steps in a security review conducted via the public Internet networks, is to gather the information available publicly about the target of the test.
You might also want to query these records to confirm that the information that needs to be publicised about a network is in fact publicly available, or being publicised correctly.
This information is freely available since it is necessary for devices to be able to resolve IP address details and plot the routes to get to the servers as part of normal communications via the Internet.
There are many places where you can get the information, but I like to make use of these two services:
http://nwtools.com – The original site for this was http://network-tools.com/, but it was not functioning correctly at the time of me writing this article.
Here are some examples of the outputs obtained from them. I will pick on google.com again for my examples:
There are a number of individual utilities available (e.g. Ping, Lookup, DNS Records, Network Lookup, etc), but they also have a handy one which executes them all at once to give you a nice complete output to work with - they call it Express. The example below is what resulted upon submitting this request for "google.com":
| IP address: 64.233.167.99 TraceRoute to 64.233.167.99 [google.com] Trace complete Xwhois query for google.com... MarkMonitor.com - The Leader in Corporate Domain Management The Data in MarkMonitor.com's WHOIS database is provided by MarkMonitor.com Registrant: Domain Name: google.com Administrative Contact: Created on..............: 1997-Sep-15. Domain servers in listed order: MarkMonitor.com - The Leader in Corporate Domain Management Retrieving DNS records for google.com... Answer records Authority records Additional records Network IP address lookup: Xwhois query for 64.233.167.99... NetRange: 64.233.160.0 - 64.233.191.255 RTechHandle: ZG39-ARIN # ARIN WHOIS database, last updated 2006-07-18 19:10 |
similar information can be obtained by using the tools at geektools.com. Here is an example of using the “Dig DNS Interface” link on http://geektools.com/tools.php which points to: http://geektools.com/digtool.php
a query for “google.com” results in an HTTP POST request which effectively can be represented as this GET request:
http://geektools.com/cgi-bin/do-dig.cgi?domain=google.com&dtype=ANY&target=&dig=Dig
| ; <<>> DiG 8.2 <<>> @ google.com ANY ;; ANSWER SECTION: ;; AUTHORITY SECTION: ;; Total query time: 0 msec ;; MSG SIZE sent: 28 rcvd: 15 |
traceroute.org can also be very helpful in determining alternate routes to destinations, identifying global congestion points, and finding out if a destination has multiple ISPs.
ReplyDeleteYou are so interesting! I do not think I've read something like this before. So great to find somebody with a few original thoughts on this issue. Really.. thank you for starting this up. This web site is something that is required on the web, someone with a little originality!
ReplyDelete