OSINT : Les astuces cachées des noms de domaine | Ep. 4

Summary

This video delves into the intriguing world of open-source intelligence, focusing on how domain names can be exploited to uncover valuable information. It explains the structure of domain names and their management by entities like registrars, regulated by international organizations such as ICANN. The video demonstrates how to use the 'whois' command to extract information about a domain, including its creation date, registrar details, and contact information. It also covers the use of various online tools for further investigation, such as ViewDNS, MX Toolbox, and the Wayback Machine, which can reveal historical data, associated emails, and technological insights about websites. The presenter, an experienced cybersecurity professional, shares tips and introduces additional tools like crt.sh and osint.sh for comprehensive domain analysis.

Takeaways

• 🌐 A domain name is a unique address composed of a name and a top-level domain (TLD), such as 'example.com'.
• 🔎 The 'whois' command is commonly used to reveal information about a domain name, including its creation date, registration details, and registrar.
• 💾 On Windows, 'whois' can be downloaded and used to query domain information by navigating to the directory containing the extracted files and running the command.
• 📝 Public domain names are registered and managed by entities called registrars, which are accredited by organizations like ICANN.
• 🔑 The registrar is the accredited company that sells domains to the public and provides contact information and identifiers as part of the domain's WHOIS record.
• 🏢 The registrant is the entity that holds the rights to a domain name, responsible for registration fees and contact information updates.
• 📡 Domain name servers (DNS) resolve domain names into IP addresses, which are essential for web navigation and application queries.
• 🕵️‍♂️ Some domain owners may choose to hide their information using private registration services, making certain details unavailable to the public.
• 🔍 Tools like ViewDNS can be used to discover additional information about a domain, such as associated IP addresses and historical data.
• 📈 The Wayback Machine (web.archive.org) allows users to see historical snapshots of web pages, which can be useful for digital investigations or understanding changes over time.
• 🔗 Tools like Hunter and crt.sh provide functionalities to find associated emails and SSL/TLS certificates for a domain, respectively, which can be valuable for network intelligence gathering.

Q & A

What is the significance of a domain name in the context of the video?

A domain name is a unique address typically composed of a name and a top-level domain. It can reveal various information about the entity that owns it, and is managed by entities called registrars under the governance of international organizations like ICANN.

What is the command used to gather information about a domain name?

The command generally used to gather information about a domain name is 'whois'. It is available by default on Linux machines and can be downloaded for Windows.

How can one extract the content of a ZIP file as mentioned in the video?

The content of a ZIP file can be extracted using a file extraction tool. On Windows, one can navigate to the directory containing the extracted files and use the 'dir' command to list the contents.

What information can be revealed by executing the 'whois' command on 'yube.com' as per the video?

Executing the 'whois' command on 'yube.com' can reveal when the domain was created, when it was last updated, and the registrar managing the domain, among other details.

What is a registrar and what is its role in domain management?

A registrar is an entity accredited by ICANN to sell domain names to the public. They handle the registration and management of domain names.

What does the term 'registrant' refer to in the context of domain names?

The registrant refers to the person, business, or organization that registers and holds rights to a domain name. They are responsible for the payment of registration and renewal fees, as well as updating contact information associated with the domain.

What are the administrative and technical contacts associated with a domain?

The administrative and technical contacts are the individuals or entities responsible for handling administrative and technical issues related to a domain name.

Why might some domain owners choose to hide their information?

Some domain owners may choose to hide their information or use private registration services to protect their privacy and avoid spam or potential security threats.

What is the purpose of the 'viewDNS' tool mentioned in the video?

The 'viewDNS' tool is used to identify the servers that host a domain and to check if certain ports are open on a server, which can be useful for network diagnostics and security assessments.

How can one use the 'Wayback Machine' to view historical changes of a website?

The 'Wayback Machine' allows users to view historical snapshots of web pages, providing a timeline of changes made to a website over time.

What is the 'Hunter' tool and how does it assist in finding email addresses associated with a domain?

The 'Hunter' tool searches for email addresses associated with a domain by scanning public web pages. It can provide contacts of individuals working for or associated with the domain.

What can one learn from the 'crt.sh' tool regarding a domain's SSL/TLS certificates?

The 'crt.sh' tool allows users to search and view SSL/TLS certificates associated with a domain. It provides information on certificate validity dates and lists domains included in the certificate's subject alternative name field.

What is the 'OSINT.sh' platform and how does it aid in domain analysis?

The 'OSINT.sh' platform is a collection of various tools that can be used for domain analysis, including identifying technologies used on a website, finding related subdomains, and checking domain history.