search

chrismaddalena / Goreport

A Python script to collect campaign data from Gophish and generate a report
BSD 3-Clause "New" or "Revised" License
180 stars 50 forks source link

All reports the location is coming as unknown #35

Closed RafaMonteiro13 closed 1 year ago

RafaMonteiro13 commented 1 year ago

Hello, I'm using the tool to get custom reports. But in all reports the location is coming as unknown and the link was accessed from different places and all locations are as unknown.

image

RafaMonteiro13 commented 1 year ago

Regardless of the test I do, the location always comes up as unknown. image

kpomeroy1979 commented 1 year ago

The location comes up as unknown because you have not set up the ipinfo OR google geolocate APIs which are used to get the geo-location for the IP addresses. Check your gophish.config file in your goreport directory

# more gophish.config [Gophish] gp_host: https://xxxxxxxxxxxxxx.com:65333 api_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[ipinfo.io] ipinfo_token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[Google] geolocate_key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Additional Information

Gophish performs it's own geolocation lookups with IP addresses and returns latitude and longitude. This works alright, but ma y fail and return coordinates of 0,0 or may return old information.

Goreport has two options that might be used to improve location results. The first, and recommended option, is the ipinfo.io A PI. API access is free as long as you make less than 1,000 queries per 24 hour period. That should not be too difficult for a phishing campaign.

If an ipinfo.io API key is added to the config file Goreport will automatically use ipinfo.io to gather current geolocation in formation for each unique IP address.

The second option is the Google Maps API. Goreport v1.0 used the Maps API when it was free. Google now charges $0.005/request for the Geolocate API (as it is now called). If you would prefer to not use ipinfo.io, activate the Maps Geolocate API on a Go ogle account and add the API key to the Goreport config file. Then add the --google flag to your Goreport command anytime you want Goreport to use the API to lookup Gophish's coordinates to get a formatted address.

RafaMonteiro13 commented 1 year ago

I put the api key and it worked, thank you very much.

kpomeroy1979 commented 1 year ago

Happy to help.

chrismaddalena commented 1 year ago

Thanks for helping them out, @kpomeroy1979 👍🏻

abdullahdevrel commented 1 year ago

I am the DevRel for IPinfo.

@chrismaddalena Thank you for using our service. We really appreciate it. We released some new free databases that might be beneficial to the project as well. Feel free to check them out: https://ipinfo.io/products/free-ip-database

@kpomeroy1979 Thank you very much for the answer. We have quoted your reply in our community post to help users find the answer next time around: https://community.ipinfo.io/t/goreport-all-reports-the-location-is-coming-as-unknown/417?u=supportbot

chrismaddalena commented 1 year ago

Awesome. I'll check it out! Thanks for sharing, @abdullahdevrel.