Computer Network Investigation

This report discusses the techniques related to footprinting and the relationship between ICANN, RIRs, and ISPs. It also analyzes the results obtained and highlights the pros and cons of public network information.

Running head: COMPUTER NETWORK INVESTIGATION
COMPUTER NETWORK INVESTIGATION
Name of the Student:
Name of the University:
Author Note:

1COMPUTER NETWORK INVESTIGATION
Table of Contents
Introduction................................................................................................................................3
Objectives...................................................................................................................................3
Purpose of ICANN.................................................................................................................3
Relationship between ICANN, RIRs and ISPs......................................................................3
Information discovery............................................................................................................4
Results and Analysis................................................................................................................17
Conclusion................................................................................................................................19
References................................................................................................................................20

2COMPUTER NETWORK INVESTIGATION
Introduction
The term footprinting refers to the process of gathering all the possible amount of data
from a target system and then analyse the data to find ways to enter the system through
hacking. It can be also defined as a vulnerability analysis method. To hack into an
organisation, an ethical hacker needs to spend most of his time trying to profile the
organisation and collecting information regarding the company’s network, host and people.
Footprinting has many uses some of which are: knowing security posture, identification of
vulnerabilities, drawing a network map and reduction of attack area. This report will discuss
some of the techniques related to footprinting. The report will highlight on the namespace
database like ICANN and also describe the relation between RIRs, ICANN and ISPs. The
report will practically demonstrate the footprinting techniques used to gather information
about a system from its IP address.
Objectives
Purpose of ICANN
The International Corporation for Assigned Names and Numbers or ICANN is a non-
profit organisation that is mainly responsible for maintaining and coordinating the procedures
of many other databases that are all involved in numerical spaces and namespace of the
internet. The ICANN is responsible for performing the technical maintenance work for the
DNS root zones and the Central Internet Address Pools. It also develops policies for the
global Domain Name System or DNS of the internet. ICANN also manages the internet
protocol address spaces for the IPv6 and IPv4 addresses.
Relationship between ICANN, RIRs and ISPs
The IP address space is distributed by the authority of the existing Regional Internet
registries or the RIRs. The IP addresses are then distributed to the customers from the allotted
IP address space by the Internet Service Providers or the ISPs. The Regional Internet
Registries or the RIRs which are responsible for the global internet resource management
which comprises of the APNIC, RIPE NCC and ARIN. This RIR document was developed in
a cooperative manner as a response to a request form the International Corporation for
Assigned Names and Numbers or ICANN. So, on request of the ICANN, the RIR was created
which is responsible for allotting IP address space to the ISPs for distribution to customers.

3COMPUTER NETWORK INVESTIGATION
Information discovery
1. Footprint of an IP address
Yahoo.com

4COMPUTER NETWORK INVESTIGATION

5COMPUTER NETWORK INVESTIGATION

6COMPUTER NETWORK INVESTIGATION
Microsoft.com

7COMPUTER NETWORK INVESTIGATION

8COMPUTER NETWORK INVESTIGATION

9COMPUTER NETWORK INVESTIGATION
2. WHOIS IP Lookup
a. 205.6.6.6

10COMPUTER NETWORK INVESTIGATION
b. 210.6.6.6

11COMPUTER NETWORK INVESTIGATION
c. 201.6.6.6
3. Footprinting a company
Company chosen: Facebook.com
1. WHOIS lookup

12COMPUTER NETWORK INVESTIGATION
2. Network Vulnerability Scan

13COMPUTER NETWORK INVESTIGATION
3. Subdomain search

14COMPUTER NETWORK INVESTIGATION
4. Find virtual hosts

15COMPUTER NETWORK INVESTIGATION
5. Google dorking information
a. Directory listing vulnerabilities

16COMPUTER NETWORK INVESTIGATION
b. Public documents exposed
Results and Analysis
1. The WHOIS search is a very useful tool that can be beneficial to both attackers as well as
defenders. The tool works by providing the user with all the possible online publicly
available information about the targeted company. A hacker or cyber-criminal may use this
information to his or her advantage by finding vulnerabilities in the company’s network
architecture or the system. This can lead to exploitation of the company and a possible data
breach if a vulnerability is found by the hacker. In a similar way this tool can used by an
ethical hacker or a defender to find vulnerabilities and loopholes in the organisation system

17COMPUTER NETWORK INVESTIGATION
and framework. Once discovered the defenders can seal off or fix these loopholes to prevent
further exploit.
2. The biggest pro of making the network information public is that it can be used by
potential customers and researchers to see the company information. The data can be
collected for academic purposes and help the company get more customers. The cons of this
is that the information that is publicly available can be utilised by cyber criminals or hackers
to find vulnerabilities and exploit it. The vulnerabilities can be then exploited by hackers to
hack into the company system and network architecture. These publicly available information
can be used by any hacker and easily accessed which can lead to cybercrimes like data
breach, network misuse, identity theft and more.
3. The WHOIS can be freely used to gain information about a company domain or IP address.
The network information displayed by the tool consist of documents like web locations of the
registered users, their name and addresses if provided, their phone numbers and email
addresses. The user can also gain access to expiry records, name servers, domain creation
date and contact data. These information can be used by an ethical hacker or cyber criminals
to do penetration testing. The WHOIS history and search records can be used to the police
advantage as it can help in directly contact domain owners, establish the owner identities,
stop illegal online activities, track spammers and malicious emails and protect customers
against frauds.
4. The five additional sources of footprinting are:
 Footprinting through Search Engine.
 Footprinting through social engineering.
 Footprinting through Social Networking sites.
 Competitive Intelligence
 Email Footprinting
5. The Robtex IP blacklisting is a special service that can help automatically blacklist and
block malicious IP addresses and websites. There are different categories such addresses can
be classified into before being blacklisted.

18COMPUTER NETWORK INVESTIGATION
Conclusion
To conclude, this report discusses all the means of conducting footprinting of a
website and IP addresses. The WHOIS tool is used to gather different publicly available
information about the company and the methods of doing so are discussed. This report also
discusses the ICANN database and its relationship with the RIRs and the ISPs. The report
also analyses the results obtained and answers critical questions related to footprinting and
WHOIS lookup. The report also highlights on the use or misuse of this tool along with the
pros and cons of public network information.

19COMPUTER NETWORK INVESTIGATION
References
Fantin, S. (2018). ICANN, WHOIS and the GDPR: three elephants in the cyber room.
Google Hacking | Pentest-Tools.com. (2019). Retrieved from
https://pentest-tools.com/information-gathering/google-hacking#
Kuyama, M. A. S. A. H. I. R. O., Kakizaki, Y. O. S. H. I. O., & Sasaki, R. Y. O. I. C. H. I.
(2016, September). Method for detecting a malicious domain by using whois and dns
features. In The Third International Conference on Digital Security and Forensics
(DigitalSec2016) (p. 74).
Liu, S., Foster, I., Savage, S., Voelker, G. M., & Saul, L. K. (2015, October). Who is. com?:
Learning to parse whois records. In Proceedings of the 2015 Internet Measurement
Conference (pp. 369-380). ACM.
Perrin, S. E. (2018). The Struggle for WHOIS Privacy: Understanding the Standoff Between
ICANN and the World's Data Protection Authorities (Doctoral dissertation).
Sabih, Z. (2018). Learn Ethical Hacking from Scratch: Your stepping stone to penetration
testing. Packt Publishing Ltd.
Thao, T. P., Yamada, A., Murakami, K., Urakawa, J., Sawaya, Y., & Kubota, A. (2017,
August). Classification of Landing and Distribution Domains Using Whois’ Text
Mining. In 2017 IEEE Trustcom/BigDataSE/ICESS (pp. 1-8). IEEE.
Welcome to Robtex! (2019). Retrieved from https://www.robtex.com/