Unit 3

Vulnerability assessment: baseline analysis and plan

Scanning activity

Assignment

Perform a basic scan using standard tools such as traceroute, dig and nslookup. Please see these instructions on using traceroute, etc. Refer to this week's reading for further assistance. Do not use ping as it will cause confusion because of shared addresses.

Use these basic tools and make a list that details the following information:

How many hops from your machine to your assigned website?
Which step causes the biggest delay in the route? What is the average duration of that delay?
What are the main nameservers for the website?
Who is the registered contact?
What is the MX record for the website?
Where is the website hosted?

1. Run `traceroute`

Running the traceroute command with the default parameters does not yield any results likely due to the settings of the network infrastructure by the hosting provider. However it is possible to trace the route to the resource by using the TCP protocol and addressing requests to the port 443 that is open on the server (to serve HTTPS content):

traceroute -e -P TCP -p 443 ginandjuice.shop

The result of execution for the command is below; entries revealing local network setup as well as the local ISP have been redacted:

traceroute: Warning: ginandjuice.shop has multiple addresses; using 34.249.203.140
traceroute to ginandjuice.shop (34.249.203.140), 64 hops max, 40 byte packets
[REDACTED]  4.144 ms  2.245 ms  2.102 ms
[REDACTED]  9.637 ms  9.055 ms  8.574 ms
[REDACTED]  9.727 ms  8.014 ms  7.851 ms
* * *
* * *
* * *
* * *
* * *
ec2-34-249-203-140.eu-west-1.compute.amazonaws.com (34.249.203.140)  48.305 ms  38.582 ms  39.576 ms
ec2-34-249-203-140.eu-west-1.compute.amazonaws.com (34.249.203.140)  43.642 ms  41.277 ms  39.860 ms
ec2-34-249-203-140.eu-west-1.compute.amazonaws.com (34.249.203.140)  43.121 ms  37.235 ms  37.876 ms

The trace ends with three entries that seem identical on the first sight. However, revealing packets’ contents with the Wireshark protocol analyzer reveals that packets with time to live (TTL) of 9 and 10 are still rejected due to expired TTL. Only after eleven hops the server tries to establish connection in reply to the packets sent by traceroute. The domain names reveal that the resource is hosted on the Amazon Web Services (AWS) infrastructure.

Therefore likely the replies after nine and ten hops are caused by the infrastructure setup in AWS like load balancers, and the actual website is hosted eleven hops away for a location in Western Europe.

2. Execute `dig`

Executing this command reveals the Domain Name System (DNS) settings for the domain.

> dig ginandjuice.shop

This reveals two A records for the domain that reveal IP addresses for the hosting:

; <<>> DiG 9.10.6 <<>> ginandjuice.shop
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60893
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1444
;; QUESTION SECTION:
;ginandjuice.shop.		IN	A

;; ANSWER SECTION:
ginandjuice.shop.	60	IN	A	34.246.169.176
ginandjuice.shop.	60	IN	A	34.249.203.140

;; Query time: 13 msec
;; SERVER: 192.168.178.1#53(192.168.178.1)
;; WHEN: Wed Aug 13 23:46:34 CEST 2025
;; MSG SIZE  rcvd: 77

Vulnerability assessment: baseline analysis and plan​

Scanning activity​

1. Run traceroute​

2. Execute dig​

3. whois​

Vulnerability assessment: baseline analysis and plan

Scanning activity

1. Run `traceroute`

2. Execute `dig`

3. `whois`