PRINT
PRINT
SEND MAIL
SEND MAIL

Fire Up Kali & Open a Terminal

The first step, of course, is to fire up our our trusty Kali system, or in this case, any Linux distribution. Then, open a terminal.

Note: Be cautious of the formatting below for commands. The formatting of this article will create big space gaps since it stretches lines out to fit the margins. This is because of long URLs that try to fit themselves on a separate line. Large spaces equals just one space, so keep that in mind. Refer to the screenshots to see how they actually look.

Step 2Download the Database

Now we need to download the database from MaxMind, and we can get it by typing the following.

kali > wget -N -q http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz

Then we need to unzip it.

kali> gzip -d GeoLiteCity.dat.gz

Let’s now check that the database is in place by listing the directory.

kali > ls -alh GeoLiteCity.dat

Step 3Download & Install Pygeoip

Next, we need to install the Python script to read the database, pygeoip. We can download it by typing the following.

kali > wget http://pygeoip.googlecode.com/files/pygeoip-0.1.3.zip

Then, unzip it.

kali > unzip pygeoip-0.1.3.zip

We next need to download some setup tools into the pygeoip directory.

kali > cd /pygeoip-0.1.3

kali > wget http://svn.python.org/projects/sandbox/trunk/setuptools/ez_setup.py

kali > wget http://pypi.python.org/packages/2.5/s/setuptools-0.6c11-py2.5.egg

Let’s now move and then build and install the setup tools.

kali > mv setuptools-0.6c11-py2.5.egg setuptools-0.7a1-py2.5.egg

kali > python setup.py build

kali > python setup.py install

We need to move the database to the pygeoip directory so that script can access it without having to use the full path.

kali > mv GeoLiteCity.dat /pygeoip-0.1.3/GeoLiteCity.dat

Step 4Query the Database

Now that we have the database in place and the pygeoip script downloaded and installed, we can begin to query that database with pygeoip.

First, we need to start a Python shell.

kali > python

Then, you will be greeted will the triple >>> indicating you are now in an interactive python shell. Let’s import the module and instantiate the class.

>>>import pygeoip
>>>gip = pygeopip.GeoIP(‘GeoLiteCity.dat’)

Next, we are ready to begin our query. Let’s see where Google is located.

>>>rec = gip.record_by_addr(‘64.233.161.99’)
>>>for key.val in rec.items():
… print “%s: %s” %(key,val)

Please note that it is critical to indent the “print”. If not, you will throw an error.

As you can see, we were able to locate Google’s IP in Mountain View, CA at area code 650, postal code 94043, longitude -122.0574, and latitude 37.4192. Not bad! Now, let’s try to locate the IP of cnn.com.

Once again, the combination of the database and pygeoip script was able to provide us with key location information on CNN’s IP address.

This little tool is great for locating any IP address in the world, albeit, it is a bit clunky. Maybe someone here in the Null Byte community with good Python skills would like to write an interactive script with a nice user interface where the user can simply enter the IP and get the record information?

2
D4RkN
Author: D4RkN

0 Comments

Leave a reply

Your email address will not be published. Required fields are marked *

*

©2021 By Cyber Sec Labs

   

CONTACT US

We're not around right now. But you can send us an email and we'll get back to you, asap.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account