whois-lookup

What this skill does

Uses the whois command to query registration information for a domain or IP address. Parses and organizes key fields — registrar/registrant info, registration/expiry dates, name servers, IP ranges (CIDR) — and outputs them in a report format.

When to use

• When verifying domain ownership and registrar
• When assessing takeover potential based on domain expiry dates
• When identifying the ASN and organization associated with an IP address
• When exploring related IP ranges (CIDR) to discover additional attack surface

Prerequisites

• Install the whois command:

  # Ubuntu/Debian
  sudo apt-get install -y whois
  # CentOS/RHEL
  sudo yum install -y whois
  

• Environment variable SECSKILL_TARGET: domain or IP address to look up

Inputs

Variable	Required	Description
SECSKILL_TARGET	required	Domain or IP address to look up
SECSKILL_OUTPUT_DIR	optional	Directory for saving results (default: ./output)

Workflow

Step 1: Prepare environment and detect input type

export TARGET="${SECSKILL_TARGET:?Set the SECSKILL_TARGET environment variable (domain or IP)}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
mkdir -p "$OUTDIR"

# Detect IPv4/IPv6
if echo "$TARGET" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'; then
  TARGET_TYPE="ipv4"
elif echo "$TARGET" | grep -qE '^[0-9a-fA-F:]+:[0-9a-fA-F:]+$'; then
  TARGET_TYPE="ipv6"
else
  TARGET_TYPE="domain"
fi

echo "[*] Target: $TARGET (type: $TARGET_TYPE)"
SAFE_NAME=$(echo "$TARGET" | tr '/' '_')
OUTFILE="$OUTDIR/whois_${SAFE_NAME}.txt"

Step 2: Run WHOIS query and save raw output

echo "[*] Running WHOIS lookup..."
echo "===== WHOIS Raw Data: $TARGET =====" > "$OUTFILE"
echo "Query time: $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$OUTFILE"
echo "" >> "$OUTFILE"

whois "$TARGET" 2>/dev/null >> "$OUTFILE"

if [ $? -ne 0 ] || [ ! -s "$OUTFILE" ]; then
  echo "[-] WHOIS lookup failed or returned no results"
  exit 1
fi
echo "[+] Raw WHOIS data saved: $OUTFILE"