orgia 0.1.1

Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.

orgia

Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.

Useful for conducting Recon on a big Organisation.

For example, after running orgia the OG way on "Hilton", I got 96436 v4 IPs.

Installation

pipx

Global installation:

pipx install git+https://github.com/sttlr/orgia
orgia -h

Or run without installing:

pipx run --spec git+https://github.com/sttlr/orgia orgia -h

Docker

git clone https://github.com/sttlr/orgia
cd orgia

docker build -t orgia .
docker run --rm orgia -h

Usage

usage: orgia [-h] [--org ORG_NAME] [--version] [--silent] [--debug] [-c PATH] [--sources SOURCE]
             [--orgs-input-file PATH] [--asns-input-file PATH] [--networks-input-file PATH]
             [--max-enrich] [-o PATH] [--adjacent]
             [--orgs | --asns | --networks | --cidrs | --export-all PATH] [--jsonl] [--ip4-only]

Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.

options:
  -h, --help            show this help message and exit
  --org ORG_NAME        organization name (ex. "Hilton")
  --version             show program's version number and exit
  --silent              display results only (useful for piping to jq)
  --debug               print debug info
  -c PATH, --config PATH
                        path to .yaml config file
  --sources SOURCE      comma separated, possible values: all (default), arin, ripe, apnic,
                        afrinic, lacnic
  --orgs-input-file PATH
                        path to input file with Organisation handles
  --asns-input-file PATH
                        path to input file with ASN handles
  --networks-input-file PATH
                        path to input file with Network handles
  --max-enrich          use level 2 when trying to bruteforce entity name
  -o PATH, --output PATH
                        path to output file (default stdout)
  --adjacent            parse adjacent (dirty): ASNs from Orgs and Orgs from Networks
  --orgs                show only Organisation handles in output
  --asns                show only ASNs in output
  --networks            show only Network handles in output
  --cidrs               show only CIDRs in output
  --export-all PATH     folder to export everything
  --jsonl               show output in jsonl formal
  --ip4-only            show only IPv4 networks in output

by sttlr

Quick

Get CIDRs for specified Orgname:

orgia --org ORGNAME --cidrs

Enriched

Try even more enriched Orgnames when searching.

orgia --org ORGNAME --max-enrich --cidrs

Resolve only

If you have input files with handles, pass them via --asns-input-file, --orgs-input-file, --networks-input-file and orgia will resolve them for you:

orgia --asns-input-file ORGNAME_asn_handles.txt \
  --orgs-input-file ORGNAME_org_handles_.txt \
  --networks-input-file ORGNAME_networks_handles.txt

You can combine it with any of the output options: --cidrs, --orgs, --asns, --networks, --export-all

Specific

Select source

Choose source (arin, ripe, apnic, afrinic, lacnic) - default "all":

orgia --org ORGNAME --sources ripe,arin

IPv4 only

Don't print IPv6 Networks/CIDRs in the output:

orgia --org ORGNAME --ip4-only --cidrs

Pipe to jq

By default, orgia prints handles only (for --orgs, --asns, --networks).

You can pass --jsonl to use JSON as the output format. When piping to jq also use --silent:

orgia --org ORGNAME --asns --silent --jsonl | jq

Use config

Whitelist or blacklist handles, names, emails in output.

When checking, input is lowercased and in is used for comparison (checks if a config string in a test string).

You can create a config file and pass it via --config option:

orgia --org ORGNAME --cidrs --config PATH_TO_CONFIG.yaml

Empty config looks like this:

orgs:
  whitelist-handles: []
  blacklist-handles: []
  whitelist-names: []
  blacklist-names: []
  whitelist-emails: []
  blacklist-emails: []

asns:
  whitelist-handles: []
  blacklist-handles: []
  whitelist-names: []
  blacklist-names: []
  whitelist-emails: []
  blacklist-emails: []
  
networks:
  whitelist-handles: []
  blacklist-handles: []
  whitelist-names: []
  blacklist-names: []
  whitelist-emails: []
  blacklist-emails: []

OG

Comprehensive.

Create handle input files via org_info - parse directly from RIPE, APNIC, AfriNIC WHOIS databases:

./bin/query_asn ORGNAME > ORGNAME_asns_from_org_info.txt
./bin/query_org ORGNAME > ORGNAME_orgs_from_org_info.txt
./bin/query_inetnum ORGNAME > ORGNAME_networks_from_org_info.txt

Then run the OG:

orgia --org ORGNAME \
  --sources all \
  --max-enrich \
  --asns-input-file ORGNAME_asns_from_org_info.txt \
  --orgs-input-file ORGNAME_orgs_from_org_info.txt \
  --networks-input-file ORGNAME_networks_from_org_info.txt \
  --export-all orgia_ORGNAME_export \
  --config orgia_ORGNAME_config.yaml

Folder with results (orgia_ORGNAME_export) will contain:

• cidrs.txt - list of all CIDRs
• asns.jsonl - ASN info in JSONL format
• orgs.jsonl - Organisation info in JSONL format
• networks.jsonl - Network info in JSONL format

Adjacent mode (dirty)

You can use --adjacent option, to also extract ASNs from Orgs and Orgs from Networks. NOTE: It's dirty, and will result in lots of trash results.

API

You can import orgia as a package to use it in your scripts:

from orgia.nics import RIPE, ARIN, LACNIC, APNIC, AFRINIC

Or low-level:

from orgia.nics import RDAP, Engine

NOTE: orgia isn't designed to be used this way.

TODO

Pull requests are welcome ;)

• Implement Async via httpx.AsyncClient()
• Improve upon developer API - get rid of args argument when creating a class
• Add more options in a config file