Reconnaissance Techniques · Topic 3 of 8
Website, Email, Whois and DNS Footprinting
Learn website mirroring and header analysis, email tracking, Whois registration data and DNS records and zone transfers for the CEH reconnaissance topics.
- 5 min
- Mirroring and email tracking are active footprinting techniques.
- Whois holds registrant, name server and date data, and the five regional registries are ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC.
- Know the DNS records A, AAAA, MX, NS, CNAME, PTR, SOA, TXT and SRV.
What it is
These four techniques collect data from the target's own web presence and from the registries behind it. Website and email footprinting involve some contact with the target, so they are active. Whois and DNS data come from public registries and name servers.
Together they reveal technology, contact details, name servers and the host names that make up the network.
How it works
Website footprinting
A website shows more than its visible pages. Analysts examine the following.
- Server software and version, from HTTP response headers and error pages.
- The content management system and plug-ins, from page source and file paths.
- Links, scripts and comments in the HTML source.
- Cookies and which technologies set them.
- Directory structure and files, found by crawling.
- Sub-domains and linked sites.
Website mirroring copies a whole site to a local machine so that it can be studied offline and searched for hidden details. Tools such as HTTrack do this. Web spiders and crawlers such as Burp Suite's crawler follow links to map a site, and a tool such as Netcraft or an archive can show the technologies and the history.
Email footprinting
Email gives away information in two ways. Headers show the path a message took, the sending server and its address, and the mail software. Tracking tools add an invisible image or link to a message and report when the recipient opens it, from which address and with which client.
| Data from a tracked email | Use |
|---|---|
| Recipient's IP address and location | Network and geography |
| Mail client and operating system | Software version |
| Time the message was opened | Habits of the target |
| Whether links were clicked | Interest in the content |
Tools such as eMailTrackerPro and Infoga are examples of this category. Defenders block remote images in mail clients, and use mail gateways that strip tracking.
Whois footprinting
Whois is a query and response protocol for domain registration data. Regional internet registries and domain registrars hold it.
| Whois record data | Meaning |
|---|---|
| Registrant, administrative and technical contacts | Names, emails and phone numbers |
| Registrar and creation, update and expiry dates | History and timing |
| Name servers | Where the DNS zone is hosted |
| Address ranges for IP lookups | The owner of a network block |
Domain registrations may use privacy services that hide the personal details. IP-based Whois queries go to the regional registries: ARIN (North America), RIPE NCC (Europe, the Middle East and parts of Central Asia), APNIC (Asia Pacific), LACNIC (Latin America and the Caribbean) and AFRINIC (Africa).
DNS footprinting
The Domain Name System maps names to addresses, and its records describe the organization's infrastructure.
| Record | Meaning |
|---|---|
| A | Name to IPv4 address |
| AAAA | Name to IPv6 address |
| MX | Mail exchanger for the domain |
| NS | Authoritative name server |
| CNAME | Alias to another name |
| PTR | Address to name (reverse lookup) |
| SOA | Start of authority, with zone serial and timers |
| TXT | Text data such as SPF and other policies |
| SRV | Location of a service |
Tools for DNS queries include nslookup, dig and host. Online services such as DNSdumpster list records and sub-domains, and sub-domain finders such as Sublist3r use search engines and wordlists.
A zone transfer (request type AXFR) copies the whole zone from a name server. Servers should only allow it to their own secondary servers. If misconfigured, anyone can download every record.
DNS cache snooping, reverse lookups on an IP range and checking for sub-domain takeover candidates are further steps in the same family.
Defenses
- Remove version banners and generic error pages.
- Use registrar privacy and role-based contact addresses.
- Restrict zone transfers to named secondary servers and split internal from external DNS.
- Block remote content in email and train staff.
A worked example
A tester runs a Whois query and learns the domain's name servers. A query to one of them for a zone transfer is refused, so the tester uses a wordlist to guess sub-domains and finds a development site that points to a test server. The reverse lookup of nearby addresses suggests more hosts in the same block.
How the exam asks about this
- "Which tool copies an entire website for offline analysis?" -> HTTrack, through website mirroring.
- "Which DNS record identifies the mail server of a domain?" -> MX.
- "What does a successful AXFR request give the attacker?" -> A copy of all records in the zone.
What to remember for the exam
- Mirroring and email tracking are active footprinting techniques.
- Whois holds registrant, name server and date data, and the five regional registries are ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC.
- Know the DNS records A, AAAA, MX, NS, CNAME, PTR, SOA, TXT and SRV.
- AXFR is a zone transfer, and it should be limited to secondary servers.
- Tools: nslookup, dig, HTTrack, eMailTrackerPro.
SOA is the start of authority record, while NS lists the name servers. A question about "who is authoritative" can point to either, so read the wording.
Common mistakes
Mixing up MX and NS. MX is for mail delivery and NS is for the name servers of the zone.
Assuming Whois is about IP traffic. It is registration data, not live information about hosts.
Thinking a zone transfer is a scan. It is a normal DNS request that is only dangerous when permitted to anyone.
Check yourself
What is website mirroring?
Copying a site to a local machine for offline study.
Which DNS request type copies a whole zone?
AXFR, a zone transfer.
What does an MX record show?
The mail server that accepts email for the domain.
Topic 3 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.