7 ms·
HardCIDR will query ARIN and a pool of BGP route servers
- jauer 10y agoOK, but what does it do? The README is pretty sparse. Some examples would really help. Edit: the header from the script is good, toss it into the README for great success.
- deleted 10y ago[deleted]
- jlgaddis 10y agoIt simplifies the process of finding the IP address blocks allocated/assigned to an organization. > HardCidr is written by Jason Ashton, Senior Security Consultant at TrustedSec I'm guessing it was written with pen-testing in mind.
- simplehuman 10y agoI guess this is on hn because it sounds cool? It's impossible to understand what it is.
- finnn 10y agoFrom the top of the script: > A tool to enumerate CIDRs by querying RIRs & BGP ASN prefix lookups > Currently queries: ARIN, RIPE NCC, APNIC, AfriNIC, LACNIC > > Queries are made for the Org name, network handles, org handles, customer handles, > BGP prefixes, PoCs with target email domain, and 'notify' email address - used by > some RIRs. > > Note that severl RIRs currently limit query results to 256 or less, so large > target orgs may not return all results. > > LACNIC only allows query of ASN or IP address bloks & cannot search for Org names > directly. The entire DB as been downloaded to a separate file for queries to this RIR. > The file will be periodically updated to maintain accurate information. > > Output saved to two csv files - one for org & one for PoCs > A txt file is also output with a full list of enumerated CIDRs > > Author: Jason Ashton (@ninewires) > Created: 09/19/2016
- simplehuman 10y agoThis might well be Arabic. I have been in the industry for over 10 years and that explanation is meaningless
- wyldfire 10y agoThese are all Internet Protocol routing features. "CIDR" refers to classless interdomain routing, iirc. > ARIN, RIPE NCC, APNIC, AfriNIC, LACNIC These are the global agencies that manage the IP address allocations
- xj9 10y agoyou might want to go back an re-read your networking books.
- simplehuman 10y agoCare to point to a book that talks about these acronyms. They are not in comer or Stevens both which are networking bibles
- jlgaddis 10y agoSome of these acronyms are specific to BGP. You could work in networking for years and not encounter some of them, especially if you aren't running BGP. As far as "bibles" go, however, Halabi's _Internet Routing Architectures_ is the BGP variant. TCP/IP Illustrated might not mention CIDR since it was still pretty new when those books were written. My copies haven't been opened in years so I can't be sure. If you've performed any subnetting in the last 15 years or so, however, I fully expect that you have encountered CIDR.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- 10y ago
- javajosh 10y agoNote that this script installs "ipcalc" (or really, whatever is in http://jodies.de/ipcalc-archive/ipcalc-0.41.tar.gz http://jodies.de/ipcalc-archive/ipcalc-0.41.tar.gz) without user interaction. I'm generally pretty not okay with scripts that curl | tar things (or apt-get install things, which this does if it's run on a linux) from the interwebs without my explicit consent.
- jlgaddis 10y agoThat shouldn't be an issue if you don't run it as root. By running it as root, I'd argue that you did give explicit consent for the script to do anything it wants.
- sigjuice 10y agoSorry, no. The opposite, in fact. A script that demands to run as root on my computer needs to be extremely well mannered.
- jlgaddis 10y agoI certainly don't disagree with that. If one downloads and blindly runs some random script as root, however, you are effectively allowing it to do anything it wants. It sounds like javajosh took the time to look the script over first which, of course, is exactly what one should do.
- packetized 10y agoOh, this is superfly. Easy way to build your own up-to-date ASN DB, similar to the one from Maxmind. Think: embellishing Apache/Nginx logs with up-to-date information about the IP address of the client, including ASN/OrgId. Useful for identifying snowshoers spreading their footprint across a lot of discontiguous IP addresses in one ASN/Org.
- yusyusyus 10y agoRoute server operators would prefer people didn't do something like this against their devices.
- packetized 10y agoAgreed, that's why I'd run it against systems I operate that have at least one full view of the DFZ.
- justinsaccount 10y agoOh, if that's what you want: https://iptoasn.com/ https://iptoasn.com/ https://pypi.python.org/pypi/pyasn https://pypi.python.org/pypi/pyasn I've been working on tweaking pyasn a bit and building a service around that.
- coderholic 10y agoOr if an API works for you, https://ipinfo.io https://ipinfo.io $ curl ipinfo.io/8.8.8.8 { "ip": "8.8.8.8", "hostname": "google-public-dns-a.google.com", "city": "Mountain View", "region": "California", "country": "US", "loc": "37.3860,-122.0840", "org": "AS15169 Google Inc.", "postal": "94035", "phone": "650" } $ curl ipinfo.io/8.8.8.8/org AS15169 Google Inc. And ASN details are available on the web, eg https://ipinfo.io/AS15169 https://ipinfo.io/AS15169
- packetized 10y agoI'd like this service a lot more if it had a "last_refreshed" field. BGP/network-announcement hijacks aren't exactly common, but it'd be a useful bit of info to have in terms of determining how reliable the announcement is.
- mixologic 10y agoThis might give it some more context: https://www.trustedsec.com/march-2017/classy-inter-domain-routing-enumeration/ https://www.trustedsec.com/march-2017/classy-inter-domain-ro...
- mablap 10y agoIt all makes sense now! This is much more pertinent than the code if you don't know much about the subject matter.
- TheRealPomax 10y agoThose are some cool acronyms that I've never heard of. Reading the README does not explain any more. It's quite the mystery how this got to the top-30...
- jlgaddis 10y agoPerhaps because some of the people here do know what the acronyms stand for?
- natch 10y ago>The script with no specified options will query ARIN and a pool of BGP route servers. To what end?
- natch 10y agoBeware, this script will hose / clobber and then silently clean up (delete) a ton of various different files if files with those names happen to already exist. To see the exact file names you'll have to carefully pick through the script. So obviously? run it in its own directory, which is no guarantee of safety, but should be safer. If you have a subdirectory where you run it named after your email hostname (such as "example/" for "example.com"), then it will prompt you to "overwrite the contents of the directory" and then, if you accept, it will not only overwrite the contents, it will remove the entire contents with: cd $outdir rm * 2>/dev/null There's a slight violation of user expectations here. Removing and replacing the contents isn't quite the same as overwriting the contents. It may be a fine line, but it's better to err on the side of protecting the user's files, not deleting them, when deciding where to come down on that fine line. And if $outdir is empty or not there, it tries to detect that by first doing a check for -d $outdir, but this won't save the user if $outdir gets moved aside by another process while they are reading the prompt and before the cd happens, leaving them in another directory. Hopefully the user has rm aliased to rm -i but that still won't help since the rm is being run in its own shell in the script. I know we're not supposed to focus on the negative here on HN. I'm sure the script is awesome for whatever it does. Just be careful out there!
- LinuxBender 10y agoThat is bad. One should always use set -u on scripts that rm any files or perform any destructive actions. One can always unset that if you need to accept args further along in a script to use in a variable.
- joshka 10y agoYou seem to have a good eye for picking up problems in scripts, and enough of an interest to write about it. Have you considered submitting a PR with your suggested changes, or if you don't have time for that, perhaps an issue with your problems?
- natch 10y agoNo, because the README for this project leaves me having utterly no idea who the audience is, what it is for, why it exists, etc., so I wouldn't feel I have the right background to do a proper PR against it.
- popol12 10y agoI can't find how to make it work for european companies. For instance, fnac.com doesn't give any result with the -r option. Did I miss something ?
- blockfinder 10y agosee also blockfinder: https://github.com/ioerror/blockfinder https://github.com/ioerror/blockfinder