Hello, my name is Stephan.
In previous lecture, we learned about the importance of information gathering and security assessments.
We explored various techniques for Nmap and its scripts for gathering valuable information about a target's
assets attack surface and potential vulnerabilities.
To begin with, we discussed the scripts used for IP geolocation, namely IP geolocation, plugin,
IP allocation, Maxmind and IP geolocation.
IP info.
Here we learned that IP geolocation plugin does not require an API key, while IP geolocation Maxmind
relies on a database that needs to be downloaded separately.
The IP geolocation IP info.
Here script requires an IP key as well, which can be obtained for free by registering on their website.
So here.
We also discuss some additional options for who is script here.
We can select specific providers using who DB argument, which we will learn in next lecture again.
So from the scripts mentioned previously only IP geolocation.
Your plugin does not require an API key as I said, and the IP geolocation maxmind script depends on
the on a database that's not included in Nmap.
By default, you can sign up and download from Maxmind light city database from their website, but
the IP geolocation IP info DB script requires an IP key to IP API key to require IT external service
and the service actually is free and you can only you need to only register at their website which is
IP info db.com.
And here what we're going to do is we will use the free version of it.
We will not register any IP API keys and others here.
We will just use the IP geolocation in this script here and this script here.
So we will open a terminal.
We will write a pseudo here Nmap.
We can also use the SDN here to make it faster and after that we will use a script script here, script
after script.
Here you will enter the script and as a script name.
In this case it's IP geolocation and after that you will enter this and this character, and after that
you will just enter the target IP or domain.
So in this case, it's going to be a domain code telecom.
That's it.
And now we will press enter.
And as you can see here, we got this coordinates.
So this this the test result was, uh, what output was so fast here?
Because we, we use as n here and here, if we use it without n, we are actually, uh, would need
to wait for like a minute or 30s here.
So we always use as n two for using your location here.
And as you can see, this is our coordinates here.
What we're going to going to do is we will, uh, coordinates to IP here or coordinates to location.
And here we will use DuckDuckGo.
Here, enter.
And now we will select some website here.
Let's GPS coordinates.
And here we are.
Go.
We're going to go use longitude and latitude and longitude here.
Uh, the latitude is first one.
Latitude is the first one, and longitude is second place here.
And now we are going to press get address.
And here, as you can see here, we need to.
See map here.
And this is the geolocation of our web server or IP address where the IP address belongs here.
And here we can zoom it in and here it's on a.
Weslo wheel low here.
Okay.
As you can see, capital is seafood and seek settlers Restaurant and pastry.
Sierra West.
Western Guilford High School.
Doris Henderson.
Newcomers.
School, Korean First Parish Church and so on.
So this is how IP geolocation or geolocation works here.
You can also use this markers to mark on the places.
That's it.
So now we are going to close this.
And here this is the scanner report for this Nmap plugin here.
So let's think about firstly how it works.
So the script IP geolocation options initialize all the scripts here.
So here with this we initialize all the scripts starting with the file name pattern IP geolocation.
So at the moment there are three scripts available to geolocate IP addresses.
The first is geo plugin maxmind and IP info here.
So IP geolocation geo plugin IP geolocation Maxmind and IP geolocation IP info database DB here.
So the service providers will not return information about certain IP addresses, so it's recommended
to use them all and compare the results.
So the information returned by these scripts includes at least the latitude and longitude coordinates
and other fields such as country, state, address and city when available.
So and there is a more, of course.
So the IP geolocation Geo Plug-in Mnsi scripts works by creating a free public service.
So consider the number of queries you need to send and be considered.
Otherwise the provider will restrict the service as the other providers have done in the past.
So it's a common misconception that IP to geolocation services provide a 100% accurate location of the
computer or device.
So the location accuracy heavily depends on the database, and each service provider may have used different
methods of collecting data and keep it in mind when interpreting results from external providers here.
Right?
So it's a misconception that IP to geolocation services provide a 100% accurate location of the computer
or device.
So.
And here you can also map that your location marker.
So the IP geolocation map scripts can be used for generating graphical representations of the markers
obtained by the previous scripts.
And similarly, they require API keys that are free but require signing up to get hold of.
So consider using them to view and interpret results easily.
After all, most of us are already familiar with the Google Maps and other service providers, so you
can, instead of using this and registering to some websites, you can use online tools for geo locating
a map and seeing the graphical placement of the map here.
So you can also submit a new geolocation provider.
So if you know a better IP to geolocation provider and don't hesitate in submitting your geolocation
script to the official mailing list.
So don't forget to document if the script requires an external API or database, or if you know an excellent
service but do not have experience developing the scripts, you may add your idea to scripts.
Visualize located at their Security.org and map script idea link here.
So now let's get get information from Whois records here.
So.
Now.
Now what we are going to do, we will get information from Whois Records.
So the Whois records contains useful information, right?
Such as register organization, name creation and expiration date.
So geographical location and abuse, contact information among some potential interesting fields.
So system administrators, IT staff and other security professionals have been using who is records
for years now.
And although there are many tools and websites available to query this information and Map can process
IP range targets lists in many formats to perform this tasks in batch.
So this is I will show you how to retrieve the Whois records of an IP address or domain name with Nmap
here.
So what we're going to do is we will use the sudo SDN and script here.
We will use Whois and we will do that again.
We will use all the scripts that start with who is here and after that we will enter our target here
code Silicom and here we get sudo nmap here of course sudo nmap that's it now.
And as you can see here, it's almost completed.
50% is done.
So now we're going to get the output here.
And as you can see here, we got the output here.
So now we have the register in a register here.
Namecheap here, expired date.
This is the expired date of this domain creation date update date.
And we also have the register Whois server in this case.
Who is that?
Namecheap.com and domain name called telecom, which we obviously need that.
And here we have the name servers here, DNS one, DNS two here, Namecheap hosting.com and the URL
of the icon who is inaccurate, accurate, complete form, and that's it.
So here we have some notices, we have the register database here and so on.
So here let's actually think about how it works.
So the nmap here nmap is n script whois nmap command scripts, the port scanning phase with s n here,
which makes it more fast and executes the scripts that match the file name pattern from that starts
with the who is here.
So there there are two scripts that match this expression here.
Uh, let me actually do that here.
There are two scripts that match to this expression.
The the first is who is IP and who is domain.
So the who is IP script queries I regional regional internet whois database and who is domain script
queries the iana that org who is to obtain records until it finds the requested information.
But there is more of course, so the behavior or behavior of the who is IP and its script can be configured
to enable or disable the lookup catch so you can select a specific server provider and ignore referral
records.
So we can let's actually see how we can use these options.
Now what we're going to do is we will select a service provider specifically.
So the Who is IP script uses Ian's assignment, E A and a assignment data to select the RA and it catches
the results locally.
Alternatively, you could override this behavior and select the order of the service providers to use
in the Who DB argument here.
In order to do that, we will use the sudo and after that Nmap here we will enter the script.
Who is that?
Who is IP here?
And after that we will enter the we need to use the call signs here and after that we will enter the
script script arguments here.
And who is that?
Who?
DB Here.
Arin ripe and AfriNIC, and after that you will enter the target here in this case silly.com.
And here we have failed to resolve this script here.
So what we're going to do is we will add the.
To.
Here.
And here we also had a we had arc here.
We need to.
Add argument, script arguments.
That's it.
And here our scan is started.
And that's it.
So.
Here we selected the in ripe and AfriNIC to scan catholic.com and it's almost done.
I guess here 93.
It's almost done.
And here this is the output.
Here we have the again with results from different scripts here.
And that's it.
We have open ports and so on.
So here we can also use the ignore the referral records.
So the Whois script, the Whois IP script requires a list of who is providers in sequential order until
the record or a referral to the record is fine.
So taking out the Ripper records, you can use the nofollow script argument.
In order to do that, we will just change Nmap script.
Who is IP, IPS, IP script arguments here and now.
What we're going to do is we is that after instead of deleting the airfield ripe and so on, we will
just write nofollow and after that you enter the target.
So sometimes catch it.
Responses will be preferred over curing the Whois service and this might prevent the discovery of an
IP address.
So we will we can also disable the catch with no catch here.
So actually let it complete.
So we will just we will use the option.
We don't need the ports here for now.
So it will get get us the.
Outputs so faster.
And here, as you can see here, this is the Ethernet and we scanned with ignoring referral records.
So now what we're going to do is we will disable the catch here.
So in order to disable the catch, we just we will just delete the nofollow and we will add no catch
here.
So here and as you can see here, we the catch responses will be preferred over querying the Whois services
and this might prevent the discovery of an IP address assignment.
And here we disabled the catch here.
So as with every free service, we need to consider the number of queries that we need to make to avoid
reaching the daily limit and getting banned, or even worse, ruining the free services for everyone
else here.
So this is our lecture.
And in summary, this lecture covers the practical aspects of IP geolocation using Nmap NSA scripts,
including the set of requirements for specific scripts, the execution commands and the interpretation
of results.
We also explore the retrieval of Whois records and learned about the additional configuration options
for the Whois IP script.
So by applying these techniques, security professionals can gather essential information to enhance
their security assessment and make informed decisions.