312-50 Question 41
Single answer▪ Whois FootprintingDuring the reconnaissance phase of an authorized assessment, you are asked to identify external third parties that may manage a target company’s public-facing infrastructure without interacting with the target’s systems directly. You perform a Whois lookup on examplecorp.com and note the following: the registrar is a commercial domain registrar, the registrant organization uses a privacy protection service, the domain status includes clientTransferProhibited, and the listed authoritative name servers are ns1.dnsprovider.net and ns2.dnsprovider.net. Based on this Whois output, which finding is the most useful for pivoting to additional passive footprinting about potentially outsourced services?
- A
The domain uses clientTransferProhibited, indicating the web application is protected against DNS cache poisoning
- B
The listed authoritative name servers suggest a third-party DNS hosting provider that may manage part of the company’s external infrastructure
- C
The use of a privacy protection service proves the organization is attempting to conceal malicious infrastructure
- D
The registrar name is the best indicator of who operates the company’s public-facing mail and web servers
Show answer and explanation
Correct answer: B
Explanation
In Whois footprinting, a key goal is to extract information that supports additional passive reconnaissance. Among common Whois fields, authoritative name servers are especially valuable because they can reveal whether DNS is hosted by the target or outsourced to a provider. That information helps an assessor identify third-party service relationships and guide follow-on passive checks such as DNS enumeration from public sources, ASN review, certificate transparency searches, and provider-linked infrastructure analysis. By contrast, registrar information mainly identifies where the domain was registered, not who hosts operational services. Likewise, EPP status codes such as clientTransferProhibited relate to domain transfer controls, not DNS attack resistance. Privacy protection services should not be overinterpreted; they are common and not evidence of malicious behavior. This aligns with standard Whois and ICANN domain registration concepts, where registrar data, registrant data, status codes, and name server delegation each serve different purposes in domain administration.
- A. Incorrect.
Incorrect. clientTransferProhibited is an EPP domain status that helps prevent unauthorized domain transfers at the registrar level. It does not indicate protection against DNS cache poisoning, which is a different DNS security issue addressed through other controls such as DNSSEC, resolver behavior, and proper DNS administration.
- B. Correct.
Correct. Whois records commonly reveal authoritative name servers, and those entries can indicate whether DNS is hosted internally or by a third-party provider. In passive reconnaissance, third-party DNS hosting is a useful lead because it can point to outsourced infrastructure, related services, provider-specific records, and additional public artifacts without directly touching the target environment.
- C. Incorrect.
Incorrect. Privacy or proxy registration services are commonly used for legitimate reasons such as reducing spam, limiting exposure of personal or organizational contact details, or complying with privacy preferences. Their presence alone does not imply malicious intent or concealment of malicious infrastructure.
- D. Incorrect.
Incorrect. The registrar is the company through which the domain is registered, but that does not reliably identify who operates the target’s web, mail, CDN, or DNS infrastructure. Many organizations register domains with one provider while hosting services with entirely different vendors. Name server data is typically more actionable than registrar information for this scenario.