FDNS 3.0

I think this will be final improvement. 

I did notice that the fdns2.2.py can only connect to whois.arin.net on port 43 (whois). It doesn't perform the follow up on the whois referring by arin.net.

With the new code, it should:

• Resolve DNS name to IP address
• Perform the reverse DNS based on the IP addess (above).
• Perform whois DB checking based on the IP address (above), and shows the OrgName(netname).

#!/usr/bin/python
import os, sys, re, socket, argparse
import json
name = who = "" 

def whois_orgname(ipaddr):
    try:
        #data = []
        orgname = netname = desrc = ''
        whoisinfo = os.popen('whois %s' % ipaddr, 'r').readlines()
        ee = json.dumps(whoisinfo)
        dd = json.loads(ee)
        for line in dd:
            p1 = re.match('(orgname):\s*(.*)', line, re.I)
            p2 = re.match('(netname):\s*(.*)', line, re.I)
            #p3 = re.match('(descr):\s*(.*)', line, re.I)
            if p1 != None:
                orgname = p1.group(2)
            if p2 != None:
                netname = p2.group(2)
            #if p3 != None:
            #    descr = p3.group(2)
    except Exception, e:
        pass
    finally:
        orgnetname = orgname + "(" + netname + ")"
        return orgnetname 

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Fast DNS Resolver for domain list', version='%(prog)s 3.0')
    parser.add_argument('-w', '--whois', dest='whois', action='store_true', default=True, help='whois')
    parser.add_argument('-R', dest='rdns', action='store_true', default=False, help='reverse dns')
    parser.add_argument('infile', nargs='+', type=str, help='list of input files')
    args = parser.parse_args()

    domains = []
    for f in args.infile:
        with open(f, 'rt') as data:
            for line in data.readlines():
                domains.append(line.strip())
    for domain in domains:
        try:
            host =  socket.gethostbyname(domain)
        except Exception, e:
            host = "-"
        finally:
            if args.rdns or args.whois:
                if args.rdns:
                    try:
                        name, alias, addresslist = socket.gethostbyaddr(host)
                    except Exception, e:
                        name = "-" # reverse dns name
                if args.whois:
                    try:
                        who = whois_orgname(host)
                    except Exception, e:
                        who = "-" # whois owner
                print "%s:%s:%s:%s" %(domain, host, name, who)
            else:
                print "%s:%s" % (domain, host)

FDNS 2.2

I do a little bit of clean up on the code on fdns2.1.py. I notice that the fdns2.1.py does have limitation, where the web site will limit how the number of web request. Thus I just improve it by calling the whois.arin.net and parse the output.

Below is the new code:

#!/usr/bin/python
import os, sys, re, socket, argparse
name = who = ""
def whois_orgname(ipaddr):
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect(("whois.arin.net", 43))
        s.send(ipaddr + "\r\n")
        response = ''
        while True:
            d = s.recv(4096)
            response += d
            if d == '':
                break
        s.close()
    except Exception, e:
        pass
    if len(response):
        return re.search(r'OrgName:\s*(.*)', "".join(response)).group(1)
    else:
        return ""
if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Fast DNS Resolver for domain list', version='%(prog)s 2.0')
    parser.add_argument('-w', '--whois', dest='whois', action='store_true', default=False, help='whois')
    parser.add_argument('-R', dest='rdns', action='store_true', default=False, help='reverse dns')
    parser.add_argument('infile', nargs='+', type=str, help='list of input files')
    args = parser.parse_args()
    domains = []
    for f in args.infile:
        with open(f, 'rt') as data:
            for line in data.readlines():
                domains.append(line.strip())
    for domain in domains:
        try:
            host =  socket.gethostbyname(domain)
        except Exception, e:
            host = "-"
        finally:
            if args.rdns or args.whois:
                if args.rdns:
                    try:
                        name, alias, addresslist = socket.gethostbyaddr(host)
                    except Exception, e:
                        name = "-" # reverse dns name
                if args.whois:
                    try:
                        who = whois_orgname(host)
                    except Exception, e:
                        who = "-" # whois owner
                print "%s:%s:%s:%s" %(domain, host, name, who)
            else:
                print "%s:%s" % (domain, host)

FDNS 2.1

Remember the Geolocator last year? I improve the FDNS by adding in the whois info. Below is the new code:

#!/usr/bin/python
import os, sys, re
import argparse
from socket import getaddrinfo
import urllib2
import BeautifulSoup
name = who = "" 

def whois_orgname(ipaddr):
  website = "http://www.findip-address.com/" + ipaddr + "/whois"
  try:
      html_page = urllib2.urlopen(website).read()
      soup = BeautifulSoup.BeautifulSoup(html_page)
      for script in soup(["script", "style"]):
          script.extract()
      text = soup.getText()
      lines = (line.strip() for line in text.splitlines())
      chunks = (phrase.strip() for line in lines for phrase in line.split("  "))
      text = '\n'.join(chunk for chunk in chunks if chunk)
      #if re.search('OrgName(.+?)OrgId', text):
      #    print 'found', re.search('OrgName:(.+?)OrgId', text).group(1)
      orgname = re.search('OrgName:(.+?)OrgId', text).group(1)
  except Exception, e:
      orgname = ""
  finally:
      return orgname 

def whois_orgname2(query):
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect(("whois.arin.net", 43))
  s.send(sys.argv[1] + "\r\n")
  response = ''
  while True:
      d = s.recv(4096)
      response += d
      if d == '':
          break
  s.close()
  print response
  #return response
  return "" 

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Fast DNS Resolver for domain list', version='%(prog)s 2.1')
    #parser.add_argument('-w', '--whois', dest='whois', action='store_true', default=False, help='whois')
    parser.add_argument('-o', '--orgname', dest='orgname', action='store_true', default=False, help='whois')
    parser.add_argument('-R', dest='rdns', action='store_true', default=False, help='reverse dns')
    parser.add_argument('infile', nargs='+', type=str, help='list of input files')
    args = parser.parse_args()
    domains = []
    for f in args.infile:
        with open(f, 'rt') as data:
            for line in data.readlines():
                domains.append(line.strip())
    for domain in domains:
        try:
            host =  socket.gethostbyname(domain)
        except Exception, e:
            host = "-"
        finally:
            if args.rdns or args.orgname:
                if args.rdns:
                    try:
                        name, alias, addresslist = socket.gethostbyaddr(host)
                    except Exception, e:
                        name = "-" # reverse dns name
                '''
                if args.whois:
                    try:
                        #who = "whois function"
                        #who = "http://www.findip-address.com/" + host + "/whois"
                        #who = geoip.country(host)
                        who = whois_orgname(host)
                    except Exception, e:
                        who = "-" # whois owner
'''
                if args.orgname:
                    try:
                        orgname = whois_orgname2(host)
                    except Exception, e:
                        orgname = ""
                    finally:
                        who = orgname
                print "%s:%s:%s:%s" %(domain, host, name, who)
            else:
                print "%s:%s" % (domain, host)

IP Geolocator (Python Script)

Here's the 1st modified python script to perform geolocation checking on whois. By supplying an IP address, it will locate the country and the whois[OrgName].

import re
import sys
import urllib2
import BeautifulSoup 

usage = "Run the script: ./geolocate.py IPAddress"
if len(sys.argv)!=2:
    print(usage)
    sys.exit(0)
if len(sys.argv) > 1:
    ipaddr = sys.argv[1] 

geody = "http://www.geody.com/geoip.php?ip=" + ipaddr
html_page = urllib2.urlopen(geody).read()
soup = BeautifulSoup.BeautifulSoup(html_page)
# Filter paragraph containing geolocation info.
paragraph = soup('p')[3]
# Remove html tags using regex.
geo_txt = re.sub(r'<.*?>', '', str(paragraph))
print geo_txt[32:].strip()