經過PowerShell獲取域名whois信息

Whois 簡單來講，就是一個用來查詢域名是否已經被註冊，以及註冊域名的詳細信息的數據庫（如域名全部人、域名註冊商、域名註冊日期和過時日期等）。經過域名Whois服務器查詢，能夠查詢域名歸屬者聯繫方式，以及註冊和到期時間。一般狀況下，whois信息均爲真實信息，經過whois信息能夠找到域名註冊人的不少真實信息，像電話，郵箱，NS記錄，是對網站進行社工很是好的信息來源，對於安全從業人員來講，快速獲取whois信息，可以幫助本身掌握目標網站的不少有用信息。

而whois信息一般是保存在各級域名註冊機構中，日常咱們要查詢whois信息都是經過godaddy、name.com、萬網、新網等域名註冊商網站經過查詢頁面提交域名進行查詢，既慢又不能批量查詢，太費勁了，這裏我就把我珍藏好久的一個PS function貢獻給你們，這個腳本支持140多種後綴的域名進行查詢，尤爲是一些生僻的域，找一個能支持這個域註冊的註冊商就不容易了，如今你不須要再爲這個事情發愁了。

老規矩，先上代碼，而後對關鍵操做進行解釋：

        =====文件名：Get-whois.ps1=====
 function Get-WhoIs {
<# Author:fuhj(powershell#live.cn ,http://fuhaijun.com)  
    # Does a raw WHOIS query and returns the results
    #   The simplest whois search
    #.Example
    #   get-whois dnspod.com
    #
    #   This example is one that forwards to a second whois server ...
    #.Example
    #   get-whois baidu.com -NoForward
    #
    #   Returns the partial results you get when you don't follow forwarding to a new whois server
    #   get-whois n 128.11.5.98 -server whois.arin.net
    # 
    #   Does an ip lookup at arin.net
    #>


    [CmdletBinding()]
    param(
        # The query to send to WHOIS servers
        [Parameter(Position=0, ValueFromRemainingArguments=$true)]
        [string]$query,

        # A specific whois server to search
        [string]$server,

        # Disable forwarding to new whois servers
        [switch]$NoForward
    )
    end {
        $TLDs = DATA {
          @{

            ".com"=  "whois.verisign-grs.com","whois.crsnic.net"
            ".net"=  "whois.verisign-grs.com","whois.crsnic.net"
            ".org"=  "whois.pir.org","whois.publicinterestregistry.net"
            ".info"=  "whois.afilias.info","whois.afilias.net"
            ".biz"=  "whois.neulevel.biz"
            ".us"=  "whois.nic.us"
            ".uk"=  "whois.nic.uk"
            ".ca"=  "whois.cira.ca"
            ".tel"=  "whois.nic.tel"
            ".ie"=  "whois.iedr.ie","whois.domainregistry.ie"
            ".it"=  "whois.nic.it"
            ".li"=  "whois.nic.li"
            ".no"=  "whois.norid.no"
            ".cc"=  "whois.nic.cc"
            ".eu"=  "whois.eu"
            ".nu"=  "whois.nic.nu"
            ".au"=  "whois.aunic.net","whois.ausregistry.net.au"
            ".de"=  "whois.denic.de"
            ".ws"=  "whois.worldsite.ws","whois.nic.ws","www.nic.ws"
            ".sc"=  "whois2.afilias-grs.net"
            ".mobi"  =  "whois.dotmobiregistry.net"
            ".pro"=  "whois.registrypro.pro","whois.registry.pro"
            ".edu"=  "whois.educause.net","whois.crsnic.net"
            ".tv"=  "whois.nic.tv","tvwhois.verisign-grs.com"
            ".travel"    =  "whois.nic.travel"
            ".name"  =  "whois.nic.name"
            ".in"=  "whois.inregistry.net","whois.registry.in"
            ".me"=  "whois.nic.me","whois.meregistry.net"
            ".at"=  "whois.nic.at"
            ".be"=  "whois.dns.be"
            ".cn"=  "whois.cnnic.cn","whois.cnnic.net.cn"
            ".edu.cn"="whois.edu.cn"
            ".asia"=  "whois.nic.asia"
            ".ru"=  "whois.ripn.ru","whois.ripn.net"
            ".ro"=  "whois.rotld.ro"
            ".aero"  =  "whois.aero"
            ".fr"=  "whois.nic.fr"
            ".se"=  "whois.iis.se","whois.nic-se.se","whois.nic.se"
            ".nl"=  "whois.sidn.nl","whois.domain-registry.nl"
            ".nz"=  "whois.srs.net.nz","whois.domainz.net.nz"
            ".mx"=  "whois.nic.mx"
            ".tw"=  "whois.apnic.net","whois.twnic.net.tw"
            ".ch"=  "whois.nic.ch"
            ".hk"=  "whois.hknic.net.hk"
            ".ac"=  "whois.nic.ac"
            ".ae"=  "whois.nic.ae"
            ".af"=  "whois.nic.af"
            ".ag"=  "whois.nic.ag"
            ".al"=  "whois.ripe.net"
            ".am"=  "whois.amnic.net"
            ".as"=  "whois.nic.as"
            ".az"=  "whois.ripe.net"
            ".ba"=  "whois.ripe.net"
            ".bg"=  "whois.register.bg"
            ".bi"=  "whois.nic.bi"
            ".bj"=  "www.nic.bj"
            ".br"=  "whois.nic.br"
            ".br.com"="whois.centralnic.net"
            ".eu.org"="whois.eu.org"
            ".bt"=  "whois.netnames.net"
            ".by"=  "whois.ripe.net"
            ".bz"=  "whois.belizenic.bz"
            ".cd"=  "whois.nic.cd"
            ".ck"=  "whois.nic.ck"
            ".cl"=  "nic.cl"
            ".coop"=  "whois.nic.coop"
            ".cx"=  "whois.nic.cx"
            ".cy"=  "whois.ripe.net"
            ".cz"=  "whois.nic.cz"
            ".dk"=  "whois.dk-hostmaster.dk"
            ".dm"=  "whois.nic.cx"
            ".dz"=  "whois.ripe.net"
            ".ee"=  "whois.eenet.ee"
            ".eg"=  "whois.ripe.net"
            ".es"=  "whois.ripe.net"
            ".fi"=  "whois.ficora.fi"
            ".fo"=  "whois.ripe.net"
            ".gb"=  "whois.ripe.net"
            ".ge"=  "whois.ripe.net"
            ".gl"=  "whois.ripe.net"
            ".gm"=  "whois.ripe.net"
            ".gov"=  "whois.nic.gov"
            ".gr"=  "whois.ripe.net"
            ".gs"=  "whois.adamsnames.tc"
            ".hm"=  "whois.registry.hm"
            ".hn"=  "whois2.afilias-grs.net"
            ".hr"=  "whois.ripe.net"
            ".hu"=  "whois.ripe.net"
            ".il"=  "whois.isoc.org.il"
            ".int"=  "whois.isi.edu"
            ".iq"=  "vrx.net"
            ".ir"=  "whois.nic.ir"
            ".is"=  "whois.isnic.is"
            ".je"=  "whois.je"
            ".jp"=  "whois.jprs.jp"
            ".kg"=  "whois.domain.kg"
            ".kr"=  "whois.nic.or.kr"
            ".la"=  "whois2.afilias-grs.net"
            ".lt"=  "whois.domreg.lt"
            ".lu"=  "whois.restena.lu"
            ".lv"=  "whois.nic.lv"
            ".ly"=  "whois.lydomains.com"
            ".ma"=  "whois.iam.net.ma"
            ".mc"=  "whois.ripe.net"
            ".md"=  "whois.nic.md"
            ".mil"=  "whois.nic.mil"
            ".mk"=  "whois.ripe.net"
            ".ms"=  "whois.nic.ms"
            ".mt"=  "whois.ripe.net"
            ".mu"=  "whois.nic.mu"
            ".my"=  "whois.mynic.net.my"
            ".nf"=  "whois.nic.cx"
            ".pl"=  "whois.dns.pl"
            ".pr"=  "whois.nic.pr"
            ".pt"=  "whois.dns.pt"
            ".sa"=  "saudinic.net.sa"
            ".sb"=  "whois.nic.net.sb"
            ".sg"=  "whois.nic.net.sg"
            ".sh"=  "whois.nic.sh"
            ".si"=  "whois.arnes.si"
            ".sk"=  "whois.sk-nic.sk"
            ".sm"=  "whois.ripe.net"
            ".st"=  "whois.nic.st"
            ".su"=  "whois.ripn.net"
            ".tc"=  "whois.adamsnames.tc"
            ".tf"=  "whois.nic.tf"
            ".th"=  "whois.thnic.net"
            ".tj"=  "whois.nic.tj"
            ".tk"=  "whois.nic.tk"
            ".tl"=  "whois.domains.tl"
            ".tm"=  "whois.nic.tm"
            ".tn"=  "whois.ripe.net"
            ".to"=  "whois.tonic.to"
            ".tp"=  "whois.domains.tl"
            ".tr"=  "whois.nic.tr"
            ".ua"=  "whois.ripe.net"
            ".uy"=  "nic.uy"
            ".uz"=  "whois.cctld.uz"
            ".va"=  "whois.ripe.net"
            ".vc"=  "whois2.afilias-grs.net"
            ".ve"=  "whois.nic.ve"
            ".vg"=  "whois.adamsnames.tc"
            ".yu"=  "whois.ripe.net"
          }
        }

        $EAP, $ErrorActionPreference = $ErrorActionPreference, "Stop"

        $query = $query.Trim()

        if($query -match "(?:\d{1,3}\.){3}\d{1,3}") {
            Write-Verbose "IP Lookup!"
            if($query -notmatch " ") {
                $query = "n $query"
            }
            if(!$server) { $server = "whois.arin.net" }
        } elseif(!$server) {
            $server = $TLDs.GetEnumerator() |
                Where { $query -like  ("*"+$_.name) } |
                Select -Expand Value | Get-Random
        }

        if(!$server) { $server = "whois.arin.net" }
        $maxRequery = 3 

        do {
            Write-Verbose "Connecting to $server"
            $client = New-Object System.Net.Sockets.TcpClient $server, 43

            try {
                $stream = $client.GetStream()

                Write-Verbose "Sending Query: $query"
                $data = [System.Text.Encoding]::Ascii.GetBytes( $query + "`r`n" )
                $stream.Write($data, 0, $data.Length)

                Write-Verbose "Reading Response:"
                $reader = New-Object System.IO.StreamReader $stream, [System.Text.Encoding]::ASCII

                $result = $reader.ReadToEnd()

                if($result -match "(?s)Whois Server:\s*(\S+)\s*") {
                    Write-Warning "Recommended WHOIS server: ${server}"
                    if(!$NoForward) {
                        Write-verbose "Non-Authoritative Results:`n${result}"
                        # cache, in case we can't get an answer at the forwarder
                        if(!$cachedResult) {
                            $cachedResult = $result
                            $cachedServer = $server
                        }
                        $server = $matches[1]
                        $query = ($query -split " ")[-1]
                        $maxRequery--
                    } else { $maxRequery = 0 }
                } else { $maxRequery = 0 }
            } finally {
                if($stream) {
                    $stream.Close()
                    $stream.Dispose()
                }
            }
        } while ($maxRequery -gt 0)

        $result

        if($cachedResult -and ($result -split "`n").count -lt 5) {
            Write-Warning "Original Result from ${cachedServer}:"
            $cachedResult
        }

        $ErrorActionPreference = $EAP
    }
 }

函數裏定義了三個參數，兩個[string]類型，一個[switch]類型，分別用於接收要進行whois查詢的域名，指定whois域名服務器，以及是否容許將查詢請求轉發到其餘域名解析服務器。隨後建立了一個枚舉值的哈希表，目的是用於存儲不一樣域名後綴和whois服務器的對應關係，由於不一樣的域名後綴對應的域名信息是存儲在不一樣的服務器上的。須要強調的是像.com、.net、.org、.info這幾個註冊量特別大的域名後綴指定了多個whois服務器，避免查詢量過大沒法有效返回結果的問題。

接下來經過New-Object建立一個System.Net.Sockets.TcpClient的TCP對象，鏈接上面指定的whois服務器的43端口用於查詢whois信息，在經過一個System.IO.StreamReader對象接收whois信息返回的數據，並對數據進行解析。除此以外再加上try{}cache{}finally{}進行容錯處理，在數據解析是也用到了正則表達式用於匹配目標字符串。

程序的運行方法有以下四種：

get-whois dnspod.com

先看看dnspod在被騰訊收購後有沒有更改whois信息，貌似鵝廠沒有改過

get-whois jd.com –NoForward

get-whois n 128.11.5.98 -server whois.arin.net

 

 

做者: 付海軍
出處：http://fuhj02.blog.51cto.com
版權：本文版權歸做者和51cto共有
轉載：歡迎轉載，爲了保存做者的創做熱情，請按要求【轉載】，謝謝
要求：未經做者贊成，必須保留此段聲明；必須在文章中給出原文鏈接；不然必究法律責任
我的網站: http://www.fuhaijun.com/