search

yogeshojha / rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
https://yogeshojha.github.io/rengine/
GNU General Public License v3.0
7.4k stars 1.12k forks source link

feat: get Autonomous System (AS) of IP Address #1266

Open LucianoHanna opened 4 months ago

LucianoHanna commented 4 months ago

Is there an existing feature or issue for this?

Expected feature

Show ASN of an IP Address

Alternative solutions

No response

Anything else?

No response

github-actions[bot] commented 4 months ago

👋 Hi @LucianoHanna, Issues is only for reporting a bug/feature request. Please read documentation before raising an issue https://rengine.wiki For very limited support, questions, and discussions, please join reNgine Discord channel: https://discord.gg/azv6fzhNCE Please include all the requested and relevant information when opening a bug report. Improper reports will be closed without any response.

LucianoHanna commented 4 months ago

Maybe can get this info from httpx, I have never tested how accurate it is.

Or could use some API like BigDataCloud.

yogeshojha commented 1 month ago

@LucianoHanna httpx gives ASN but looks like API key is required. :/

yogeshojha commented 1 month ago

@LucianoHanna I have been thinking about this for a while, where do you think IP - to - asn would be helpful?

And is it that you want ASN info right next to IP?

One use case I can think is to get all domains/hosts associated with ASN during ASN import, this could be a good addition and wont take long time, maybe next immediate release we can have it.

But if its during scan we want to find IP - ASN, this would take a lot of time to develop as we would also want to filter by ASN etc

Would appreciate if you can help me with it.

ncharron commented 2 weeks ago

I will chime in here but it may have to be tracked into another conversation given the structure I have been trying to work on this for a bit.

A use case is when you target an org (or in charge of attack surface management for the org) you typically get your list of subdomains and then you try and do some OSINT on what ip addresses they own. So there are 2 target types in my opinion, a subdomain and an ip. The reason why they are different is that an org may have some ip addresses that do not necessarily have a domain associated to it.

However at the moment the only way to add an ip address to rengine is through adding it as a target. It becomes quite inefficient and impossible to keep track of if you have to manage say even just a /16. You aren't about to add 65k targets to rengine.

I can see that a way to do this would be to have another entity like a domain, same type of info (especially the whois) to track the owner info and what type of addresses can be targeted for a cidr block. That way you can add a /24 or /16 (or whatever else fits in that regard) as a target and you can run the same set of tools against those hosts.

So the individual ip addresses should show up as entities like a subdomain. That way we can track the open ports and services the same way. Scan Engines might have to be customized for IPs but that can be left as an exercise to the operator to know what they can and cannot run against an ip address.

Essentially I am saying that IP addresses would be a great thing to track but not as a target in rengine but rather as a subdomain while having cidr blocks as targets. You can then have overarching ASN covering different CIDR blocks. Which honestly can act as Organizations in the same way. So the structure is kind of already there but naming conventions would need to be changed :)

ncharron commented 5 days ago

@yogeshojha Just tagging you for visibility because this is honestly a feature I think would bring rengine to the next level. The ability to run the same things on ip's instead of just subdomains. However an ip cannot be treated as a target due to the sheer size of some scopes however having a CIDR block as a target and ip's as subs would be a great way forward.

And if you only have 1 ip as a target, you can simply just use the CIDR notation /32 to make it the only ip.