In this video you're going to learn how to do information gathering with python.
Now we start this course assuming that you already know the basics of the Python programming language.
So this is a prerequisite.
If you don't you can learn for free online on YouTube and other Web sites or you could also take my
course Python basics which complements this course perfectly.
Now there are three things that we're going to code that in this video.
So first we're going to code a banner wrapper.
Then we're going to look up host names and then we're going to do IP look up.
So all in Python.
I assume you already have your favorite code Ed installed on your computer.
Here I'm on Windows 10 and I'm going to use Visual Studio code which I find very suitable for my needs.
All right.
Now first for banner grabbing we'll be using their Requests module and we'll make a GET request to the
server and then print that response.
So this is actually basic stuff as you might know when you make a request.
The Response Headers reveal important information about the server.
Oftentimes way too much information.
So let's do the initial imports first.
We're going to import says we'll be using the command line arguments which is why we need this this
this this module then we'll import requests.
OK.
So if you don't already have this module installed you could just do pip install requests this module
does not come with standard python library and then we'll do some more imports later.
All right.
So how this is going to work is that we provide a command line argument containing the address of the
site.
We want to grab the banner for it.
So for that we'll going to start by doing a simple check and display a message.
There is no argument provided in the command line.
So we'll see if len
sis or V is smaller than to simply say print and then we'll say so print Usage like that plus SAS are
the 0 which is the name of the script and then we'll say plus you are all let's say your l here.
OK so we're going to provide a basic health message if there are no arguments provided when we run this
script with by in the command line we're going to run it with Python info recon which is the name of
this script that P Y and if there is no argument provided then we'll actually print a message.
So we're going to print this message sis or V 0 plus the message and then we're going to gracefully
exit source's exit dot 1 OK.
And then we were actually going to code the main functionality so we'll say rack equals requests gets.
We'll make a get request to HD DP s and then we'll gonna make a request of the domain would provide
as a command line argument.
So that's going to be Sis are v 1 because this RV 0 is the name of this script.
So this arguably one and then what do we want us to print the head there is.
But first let's do a print message.
So we'll say or an output will say on a new line plus string of rack dot headers.
OK
so and that's actually for the better grabbing.
Next we want to get the hostname.
And for that we're going to use the socket module so to be using the socket module we'll have to first
imported.
So we'll say import socket.
OK now we go back here
and in the socket module we have this function called Get host by name which we'll use.
So first we instantiate the variable let's say get host by underscore and then we say socket.
So we use the socket get host by name.
This are the one.
All right.
And then we'll actually going to print it's also a print on a new line.
We'll say the IP address would double D of and then plus.
So sorry the one.
All right.
We'll add another string so plus a string is like that and then plus our variable get hosted by.
OK.
And then plus let's actually do another new line.
So we're going to move on a new line once we finish this.
This output.
OK.
And that the should actually do the trick.
Now for the IP lookup part that I said we're going to do we want to get the location of this IP that's
for us for our domain.
So the location is gonna be we want to get the latitude and longitude and for that we're going to make
a request to an API that provides this kind of service and that API is so in a comment here that API
is IP and full IP info that I.
So that's that's actually the API in Python we often use modules and also API to greatly enhance our
work.
And this is a very good example so for this we're going to make another request say rack on their score
two equals requests get another get request to CTP yes IP in full thought I Oh OK.
And then we're going to do we need to provide the IP so get hosted by underscore and then what we also
need to provide is that we want our response to be in the J song format.
So this is actually how we request to do IP info should look like.
So IP info address plus the IP plus.
Jason to get the request in the Jason format.
Okay.
So because this is going to being Jason we can manipulate Jason with the Jason module.
So going back to the top here we need to import Jason.
Okay.
Now going back down here
we use the load function to load the response.
So let's say our ESB under score equals J song dot loads rack on their score to dot text and then we'll
finally print what we need.
So let's say the location the city and also the region.
So this is like for prints let's say location
is going to be the response on their score LOC that's the index which provides the location federal
also print.
Region
plus
response underscore in this case it's going to be region as you might guess.
What else did I say.
Print the city.
Okay.
Plus response on their score of course city.
All right.
And finally print it's also print.
Country
like that plus response
country
so I'm not being consistent here with these single double quotes.
Let me actually make sure that I'm consistent.
Just for I don't know better readability.
So if I'm using doubles then I'll be using doubles
OK.
Now this is it for the call.
So it's not as you can see there's not much do it.
Now to test this we're gonna open up a command line.
But first let's actually save this.
All right.
And now let's actually navigate to where this is located on the desktop.
And then we can simply say five minus three because I'm using Python 3.
Here we want to execute it.
If you just have one installation of Python you can simply do Python and for racked up p y and then
specify the domain.
But in my case I do fine minus three in four record.
And then let's say Google dot com because Google is probably not going to be offended by our small little
recon here and then hit enter.
We get it valid we get a syntax here we need to do a plus.
All right.
Now let's do that again
OK.
And there you have it.
We have the request headers with quite a lot of information about the Google dot com.
We have the IP address and we also have the location and of course we have the much needed invalid syntax
error.
And then we have a very nice response with all the information we requested.
Now isn't that awesome.
So Python allows for automation at its finest.
I urge you to keep on experimenting with all the modules we've worked with here such as the service
that requests the socket and the Jason because they will greatly simplify whatever projects you are
working on be it in cyber security or other fields.