penafieljlm / inquisitor

Opinionated organisation-centric OSINT footprinting inspired from recon-ng and Maltego
165 stars 56 forks source link

Perform whois queries only on "second level" domains #1

Open penafieljlm opened 7 years ago

penafieljlm commented 7 years ago

Let's say we encounter a host www.coca-cola.co.uk.

In the current implementation, we send out separate whois queries for www.coca-cola.co.uk and coca-cola.co.uk. In cases like these, the subdomain should just defer to the whois results of its parent domain so we can save up on the queries we send.

My initial solution was to split by zones and simply get the whois results for the concatenation of the last two zone, but as in cases like www.coca-cola.co.uk, that won't work because we'd be deferring to the whois results for co.uk instead of coca-cola.co.uk.

Is there's a way to find the "organisation-level" domain?