Skip to content

Latest commit

 

History

History
59 lines (42 loc) · 1.95 KB

README.md

File metadata and controls

59 lines (42 loc) · 1.95 KB
Raw

php-ipfinder

A simple tool to enumerate various info about a single or multiple IP addresses

Overview

The tool relies on IPINFO, implementing a client to interact and extract interesting information regarding geolocation and general information. Additionally, the tool uses phpwhois/phpwhois as the WhoIs library, while the TorChecker and BLChecker use a custom implementation to check the presence of the IP into publicly available lists.

Features

Currently, the features implemented in php-ipfinder are:

  • Geolocation
  • WhoIs Information
  • Tor Exit-Node Identification
  • Public Blacklisted IP Identification

Usage

The tool takes a single IP or a list (file), and return the analysis output as an Excel file or a console table. Additionally, the tool permits to specify an API key to be used against IPINFO.

Usage:
    php php-ipfinder [-i <IP>] [-f <IP List file>] [-o <Output File>] [-k <API-KEY>]
    -i: Single IP Address to search
    -f: File with a list of IP Address to search
    -o: Output file name without extension (the format is .xlsx)
    -k: API Key for https://ipinfo.io (free account gives 50k monthly requests)

Utils

IPFinder is provided with two additional utils:

  • merger: Merge multiple results files into a single file (xlsx)
Usage:
    php merger.php -t <target_directory>
  • splitter: Old utility that tries to take a file and extract an IP list from them.
    • Supports: xls, txt and csv files
Usage:
    php splitter.php <target_file> <limit>

Known Issues

  • Table output: Column values get truncated if length > 24 chars
  • Low performance: The script takes ~20s for single IP

Considerations

This is quite an old tool used for a brief initial recon of an IP Addresses from a defensive perspective. While it still does its work, it's quite slow and needs some major performance improvement in order to be effective.