Giter Club home page Giter Club logo

ipblisted's Introduction

ipblisted

A python script to check an IP against blacklists. Inspired by isthisipbad and adapted to be a little more complete.

Demo

Demo Image

Changelog

2016-09-21

  • Fixed comma separated lists in the --ip flag
  • Added CSV export
  • Added WAN mode

2016-07-19

  • Added threading to the application. By default there are 5 threads, the user can set the number of threads using the --thread flag

Open Tasks

  • Add an option to throttle the checks
  • Add an option to cache DNS A and TXT results to match their TTL

Requirements

ipblisted has a few requirements. I am working to reduce these requirements as much as possible.

  • requests
  • requests_cache
  • netaddr

Usage

ipblisted supports checking a single IP address, a file containing a list of IP addresses, or an entire CIDR block, or a combination of each

Single IP

python ipblisted.py --ip 4.2.2.2

Multiple IP Addresses

The IP flag accepts a comma separated list of IP addresses

python ipblisted.py --ip 4.2.2.2,4.2.2.3,4.2.2.2

Searching a CIDR block

python ipblisted.py --ip 192.168.1.0/24

Searching from a file list

python ipblisted.py --infile ips.txt

Sample Output

brian@securitas:~/Scripts/ipblisted$ python ipblisted.py --ip 202.191.62.113 --good
[*] Searching Blacklist feeds for IP 202.191.62.113
[*] Emerging Threats: No Result
[*] TOR Exit Nodes: Skipped - Disabled
[*] AlienVault: No Result
[*] BlocklistDe: No Result
[*] Dragon Research Group - SSH: No Result
[*] Dragon ResearchGroup - VNC: No Result
[*] OpenBlock: No Result
[*] NoThink- Malware: No Result
[*] NoThink - SSH: No Result
[*] antispam.imp.ch: No Result
[*] Dshield: No Result
[*] malc0de: No Result
[*] MalwareBytes: Found
[*] SpamHaus Drop: No Result
[*] SpamHaus eDrop: No Result
[*] Found on 1/15 lists.

Optional Arguments

There are several optional arguments you can pass to ipblisted

brian@securitas:~/Scripts/ipblisted$ python ipblisted.py -h
Usage: usage ipblisted.py --ip [ip]

Options:
  -h, --help            show this help message and exit
  --proxy=PROXY         Useful for when behind a proxy
  --proxy_user=PROXY_USER
  --proxy_pass=PROXY_PASS
  --good                Displays lists that the IP did NOT show up on.
  --skip-dnsbl          Skips the checking DNS Blacklists
  --skip-bl             Skips the checking of text based blacklists
  --no-cache            This will prevent caching of text based blacklists
  --clear-cache         This will clear the existing cache
  --cache-timeout=CACHE_TIMEOUT
                        Number of seconds before cache results are to expire
  --infile=INFILE       A newline separated list of IP addresses
  --outfile=OUTFILE     The file to write the results to
  --format=FORMAT       The format the outfile should in.  Default CSV
  --ip=IP               A single IP or list of IP addresses to check against blacklists
  --wan                 WAN mode will obtain the current WAN IP and add it to the check list

Disclaimer

This software is provided as is with no support, I am not responsible if you break your system with it or use it in ways outside its original intention.

ipblisted's People

Contributors

n3tsurge avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

ezefernandez93 lefterisgta polidorino thor1982 virusaki97 priyadarsh99

ipblisted's Issues

Use Requests Session()

Should use requests.session() for this instead of a dictionary

# Default settings for requests
        settings = {"url": self.url}

        # If the user supplied a proxy, set the proxy information for requests
        if options.proxy:
            settings["proxies"] = {"http": options.proxy, "https": options.proxy}
            settings["auth"] = HTTPProxyAuth(options.proxy_user, options.proxy_pass)

Valid IP address check

Users can pass invalid IP addresses to the system, it has issues with

Add a new function to validate an IP address in octal before checking it...if it's bad skip it.

CIDR Matches

Currently any lists that use CIDR format don't get matched properly. Need to parse these.

  1. Collect all the blocks on the page
  2. Use the python ip tools to check if the IP is in a listed block
  3. Profit?

Automatic IP Checking

On a schedule check a set of IPs against the black lists and notify if they are listed.

Feed list validator

Provide a function that validates the JSON and all the fields in the feed list to make sure the list is compatible with ipblisted's program logic.

Support for IP list files

Need to add support to search an entire list of IP addresses, supplied by file.

Requirement:
1 IP per line

Output to Slack

If the command is running the background for a long time, shoot the results to a defined Slack channel, so the analyst can look away.

Support for IP blocks

Need to add the ability to search an entire block of IP addresses.

192.168.1.0/24 for example

Caching

Implement requests_cache so that subsequent requests are not taxing or slowing down the application

Parameter --max_cache will set how long we hold the cache locally

Requirements: Now needs Postresql

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.