Clever Geek Handbook

Intelligence with geo2ip and reverse-whois

The reconnaissance of the company's network resources mainly consists in brute-force subdomains with the subsequent resolution of the found network blocks. Then new level 2 domains can be found and the procedure is repeated again. This allows new IP addresses to be found at each iteration.





This method is perhaps the most effective. However, there were situations where the whole / 24 subnet was not found.





Nowadays, another powerful tool has appeared - passive dns, which allows you to do the same as a classic DNS resolution, but using a special API. This can be, for example, "virustotal" or "passive-total". These services record DNS requests and responses that are collected from popular DNS servers. The advantage of this approach is that we don't need brute force. We just enter the IP address and get all known DNS records. Or, conversely, by specifying DNS, we get all the IP addresses that are associated with this name. This approach has an undeniable advantage - we can find old site servers that were resolved earlier. After all, older sites are more likely to contain vulnerabilities.





Despite the techniques described above, there are still several slightly less popular, but still giving results. In this article, we will look at two more intelligence techniques - looking up IP addresses by geographic data (geo2ip) and finding IP addresses by company name (reverse-whois).





Geo2ip

I think many of us know what geoip is. It is used quite often by both developers and administrators. However, geoip is mainly used in the ip -> geo direction. In our case, it is not so interesting. It's funny, but before developing your own solution, not a single library was found that allows you to make requests in the opposite direction geo → ip. Therefore, it was decided to write our own tool, moreover, it is not so difficult to implement it.





Figure 1. Installation
Figure 1. Installation

, python2.





:





  1. geoip — ip → geo, city → ip, country → ip, lat:long → ip ..;





  2. rwhois — whois ( ).





, geoip-:





Figure 2. Updating the geoip database and viewing the number of network blocks in it
2. geoip-

, 2020 , geoip . .





geoip , . , , , . «%» (SQL-).





, IP-, , :





Figure 3. Search for networks by CIDR and city
3. CIDR

geoip , , - :





Figure 4. Getting all networks of any country
4. -
Figure 5. Viewing the location of networks on the map
5.

() . :





Figure 6. Search for all networks by geographic coordinates
6.
Figure 7. Visualization using Google Earth
7. Google Earth

.





geoip- shodan:





Figure 8. Using geoip with shodan
8. geoip shodan

, .





apache, , :





Figure 9. Analyzing Apache logs with geoip
9. Apache geoip

dns-:





Figure 10. Analyzing bind logs using geoip
10. bind- geoip

. – mongo :





Figure 11. Scanning a city using geoip
11. - geoip

– memcached :





Figure 12. Scanning an entire country with geoip
12. geoip

Reverse whois

Whois , 43/tcp . – IP-. . 5 , 5 :





  • (RIPE);





  • (APNIC);





  • (AFRINIC);





  • (ARIN);





  • (LACNIC).





whois :





whois 8.8.8.8





, telnet:





telnet whois.ripe.net 43

1.2.3.4





IP-. :





whois -h whois.ripe.net -T person admin@somecompany.com









whois -h whois.ripe.net -- '-i mnt-by RIPE-NCC-MNT'





, RIPE :





  • as-set;





  • aut-num;





  • domain;





  • inetnum;





  • organisation;





  • person;





  • role;





  • route.





, - «netname» «descr», . . , «-T person *@somecompany.com».





web-, , https://apps.db.ripe.net/db-web-ui/#/fulltextsearch. RIPE .





whois- :





RIPE: ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz

APNIC: https://ftp.apnic.net/apnic/whois/apnic.db.inetnum.gz

AFRINIC: https://ftp.afrinic.net/dbase/afrinic.db.gz

LACNIC: https://ftp.lacnic.net/lacnic/dbase/lacnic.db.gz

ARIN: https://ftp.arin.net/pub/rr/arin.db.gz





, grep:





grep netname: *company* ripe.db





ripe.db () 5 GB. . , CIDR (, 77.77.0.0/16), grep .





– rwhois, geoip.





, :





Figure 13. Updating whois databases
13. whois-

5 . IP- :





Figure 14. Number of IP addresses by registrar databases
14. IP-

:





Figure 15. Updating the whois database for Europe only
15. whois-

-. IP- :





Figure 16. Searching for blocks of IP addresses by network name
16. IP-

«descr»:





Figure 17. Searching for IP addresses by the network description field and at the same time by country
17. IP-

, :





Figure 18. Networks in a single country
18.

CIDR-:





Figure 19. Searching for networks by CIDR
19. CIDR

geo2ip + reverse whois

geoip rwhois .





, «telecom»:





Figure 20. Searching for telecom networks in a certain geographic segment
20. telecom-

— , :





Figure 21. Searching for networks on the map by name
21.
Figure 22. Viewing networks found by name on the map
22. ,

, RECON . , - , . .





pip2 install georipe





Author: Specialist of the Ural Center for Security Systems







More articles:


All Articles