Whois servers hold information about what IP addresses, domain names, and other network addressing relevant information certain organizations are responsible for or strictly associated with. When you request information about a Whois record, all you are doing is querying a database hosted on a Whois server using a special application protocol called Whois. The details of the protocol are referenced in the Further reading section.

During a penetration test, you may be given a list of IP addresses to work with, or a domain name that resolves to an IP address. Often, you might want to know who this IP belongs to and what else is likely hosted on the same logical network block; Whois is a great tool to find out this kind of information.

Interrogating Whois servers from your command line is done by using a tool called whois, which comes shipped with many Linux/Unix distributions, Kali included.

There are a number of options you can specify when you use the whois tool...