0Pricing
Cyber Security Academy · Lesson

WHOIS, DNS Enumeration, and Certificates

Query WHOIS records, enumerate DNS, and use certificate transparency logs to map attack surfaces.

WHOIS, DNS Enumeration, and Certificates is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

WHOIS Lookup

WHOIS queries databases for domain registration information: registrant name, email, registrar, creation/expiry dates, and nameservers. While GDPR has anonymized much WHOIS data in EU, historical records and non-EU registrations remain valuable for recon.

whois example.com
whois 93.184.216.34   # reverse WHOIS on IP

DNS Enumeration Basics

DNS enumeration discovers a target's infrastructure by querying DNS records:

dig example.com A      # IPv4 address
dig example.com AAAA   # IPv6 address
dig example.com MX     # mail servers
dig example.com TXT    # SPF, DKIM, verification records
dig example.com NS     # nameservers

Subdomain Enumeration

Subdomains reveal internal services. Methods:

  • DNS brute-force with wordlists
  • Certificate transparency logs
  • Web archives and crawlers
gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt
amass enum -d example.com
subfinder -d example.com

Zone Transfer Attempts

A misconfigured DNS server may allow zone transfers, revealing all records:

dig axfr @ns1.example.com example.com
# If successful, dumps all DNS records
# Modern servers restrict AXFR to authorized secondaries

Passive DNS Intelligence

Passive DNS databases record historical DNS resolutions. Even if a domain's current IP changes, passive DNS reveals what IP it resolved to historically — useful for tracing infrastructure across campaigns.

Tools: SecurityTrails, VirusTotal passive DNS, CIRCL pDNS.

Reverse DNS

Reverse DNS (PTR records) maps IP addresses back to hostnames. This reveals hostname patterns that expose internal naming conventions (e.g., prod-db-01.internal.example.com).

dig -x 93.184.216.34
nslookup 93.184.216.34
host 93.184.216.34

Certificate Transparency for Recon

Certificate Transparency logs contain every TLS certificate issued, including SANs (Subject Alternative Names) that list all subdomains on a certificate. Invaluable for subdomain discovery without any active scanning.

curl "https://crt.sh/?q=%.example.com&output=json" | jq ".[].name_value" | sort -u

ASN and IP Range Discovery

Finding all IP ranges owned by an organization via ASN lookup:

whois -h whois.radb.net -- "-i origin AS12345"
# or use bgp.he.net to look up ASN by organization name
nmap --script asn-query --script-args targets=example.com

Email Infrastructure Recon

MX records, SPF TXT records, and DMARC TXT records reveal email providers and security posture:

dig example.com MX
dig TXT _dmarc.example.com    # DMARC policy
dig TXT _domainkey.example.com # DKIM selectors
# No DMARC = trivially spoofable domain

Shodan and Censys Integration

Cross-referencing IP ranges from WHOIS/ASN lookups with Shodan or Censys reveals all internet-facing services: open ports, software versions, and exposed interfaces — without sending a single packet to the target.

Putting It Together

A complete passive recon workflow:

  1. WHOIS → registrant, nameservers
  2. DNS enumeration → subdomains, MX, TXT
  3. CT logs → comprehensive subdomain list
  4. ASN lookup → IP ranges
  5. Passive DNS → historical resolutions
  6. Shodan/Censys → exposed services on those IPs

Quick Check: DNS Recon

Which source lists every TLS certificate ever issued for a domain, including all subdomains in the Subject Alternative Names?

Lesson Recap

WHOIS reveals domain registration data. DNS enumeration (dig, gobuster, amass) discovers subdomains and infrastructure. Certificate Transparency logs (crt.sh) list all issued certificates including SAN subdomains. ASN lookups reveal IP ranges. Passive DNS records historical resolutions. Combining these sources builds a comprehensive target picture without active scanning.

Frequently asked questions

Is the “WHOIS, DNS Enumeration, and Certificates” lesson free?

Yes — the full text of “WHOIS, DNS Enumeration, and Certificates” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “WHOIS, DNS Enumeration, and Certificates”?

Query WHOIS records, enumerate DNS, and use certificate transparency logs to map attack surfaces. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “WHOIS, DNS Enumeration, and Certificates” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Google Dorking for Information Gathering
  2. WHOIS, DNS Enumeration, and Certificates
  3. Shodan: The Search Engine for Internet Devices
  4. Social Media and People-Search OSINT
← Back to Cyber Security Academy