Some packages are required for full functionality: * **Debian 10 / Ubuntu 20.04 (or newer):** ``` apt -y install curl whois bind9-host mtr-tiny jq ipcalc grepcidr nmap ncat aha ``` * **Debian 9 / Ubuntu 18.04 (or older):** ``` apt -y install curl whois bind9-host mtr-tiny jq ipcalc grepcidr nmap git gcc make && \ git clone https://github.com/theZiz/aha.git && \ make install -C aha/ ``` * **CentOS / RHEL / Rocky Linux 9:** ``` dnf -y install epel-release && \ dnf -y install curl whois bind-utils mtr jq nmap nmap-ncat ipcalc aha grepcidr ``` * **CentOS / RHEL / Rocky Linux 8:** *(thanks [Robert Scheck](https://github.com/robert-scheck))* ``` dnf -y install epel-release 'dnf-command(copr)' && \ dnf -y copr enable robert/ipcalc && \ dnf -y install curl whois bind-utils mtr jq nmap nmap-ncat ipcalc aha grepcidr ``` * **CentOS / RHEL 7:** *(thanks [Robert Scheck](https://github.com/robert-scheck))* ``` yum -y install epel-release yum-plugin-copr && \ yum -y copr enable robert/ipcalc && \ yum -y install curl whois bind-utils mtr jq nmap nmap-ncat ipcalc aha grepcidr && \ hash -d ipcalc ``` * **Fedora:** ``` dnf -y install curl whois bind-utils mtr jq nmap nmap-ncat ipcalc aha grepcidr ``` * **openSUSE Leap 15.5 (or newer), openSUSE Tumbleweed** ``` zypper in -y curl whois bind-utils mtr jq nmap ncat ipcalc aha grepcidr ``` * **FreeBSD**: ``` env ASSUME_ALWAYS_YES=YES pkg install bash coreutils curl whois mtr jq ipcalc grepcidr nmap aha ``` * **Windows**: * **using [WSL2](https://docs.microsoft.com/en-us/windows/wsl/about) (recommended):** Install Windows Subsystem for Linux (v2) by following Microsoft's [guide](https://docs.microsoft.com/en-us/windows/wsl/install-win10#manual-installation-steps). On step 6, choose one of the Linux distributions listed above (Ubuntu 20.04 LTS is recommended). Once your WSL2 system is up and running, open a Linux terminal and follow the prerequisite installation instructions above for your distribution of choice. > *Note for WSL2 users: Check [this](https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/) page for details on how to activate **systemd** if you plan to install the [asn service](#optional-installing-the-asn-server-as-a-system-service).* * **using [Cygwin](https://cygwin.com/index.html):** Most of the prerequisite packages listed above for *Debian 10 / Ubuntu 20.04 (or newer)* are obtainable directly with Cygwin's own Setup wizard (or through scripts like *apt-cyg*). You will still have to manually compile (or find a suitable third-party precompiled binary) the *mtr*, *grepcidr* and *aha* tools. Instructions on how to do so can be found directly on the respective projects homepages.
Afterwards, to install the **asn** script from your shell to **/usr/bin**: `curl "https://raw.githubusercontent.com/nitefood/asn/master/asn" > /usr/bin/asn && chmod 0755 /usr/bin/asn`
* **Debian-based:** *(thanks [Marcos Rodrigues de Carvalho](https://github.com/odaydebian))* > *Debian 13 / Sid*\ > *Ubuntu 24.04 (or newer)*\ > *Kali (rolling)*\ > *Raspbian (testing)* ``` sudo apt update && sudo apt install asn ``` * **Manjaro / Arch Linux:** *(thanks [Worty](https://github.com/worty))* ``` yay -S asn-git ``` * **Alpine Linux 3.18 (or newer)** *(thanks [Francesco Colista](https://github.com/fcolista))* ``` apk add -X https://dl-cdn.alpinelinux.org/alpine/v3.19/community asn ``` * **NixOS** *(thanks [devhell](https://github.com/devhell))* * Package [here](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/networking/asn) * **MacOS** *(using [Homebrew](https://formulae.brew.sh/formula/asn), thanks [filippovitale](https://github.com/filippovitale))* ``` brew install asn ``` >*Note for MacOS users:* > > *Homebrew has a [policy](https://github.com/Homebrew/homebrew-core/issues/35085#issuecomment-447184214) not to install any binary with the **setuid** bit, and mtr (or actually, the mtr-packet helper binary that comes with it) requires to elevate to root to perform traces (good explanations for this can be found [here](https://github.com/traviscross/mtr/issues/204#issuecomment-723961118) and [here](https://github.com/traviscross/mtr/blob/master/SECURITY)). If mtr (and therefore `asn`) traces are not working on your system, you should either run `asn` as root using **sudo**, or set the proper SUID permission bit on the mtr (or better, on the mtr-packet) binary.*
The geolocation provider of choice for single lookups (i.e. when not running bulk geolocation queries with the `-g` option) is **ipinfo.io**.
By default, the script uses the free (no API key) tier that supports up to **1,000** geolocation requests per day. In order to boost this limit (for free) to **50,000** requests per month, an API key token is required.
In order to obtain an API token, after [signing up](https://ipinfo.io/signup), the API token can be found in the [token section](https://ipinfo.io/account/token) of your reserved area. Once copied, the token should be written to one of the following files (parsed in that order):
`$HOME/.asn/ipinfo_token` or
`/etc/asn/ipinfo_token`
The `/etc`-based file should be used when running asn in **server mode**. The `$HOME`-based file takes precedence if both files exist, and is ideal for **user mode** (that is, running `asn` interactively from the command line).
In order to do so, you can use the following command:
***User mode:***
`TOKEN="
The script will perform first-level IPv4/v6 reputation lookups using [StopForumSpam](https://www.stopforumspam.com/), and in case of a match it will perform a second-level, in-depth threat analysis for targets and trace hops using the [IPQualityScore](https://www.ipqualityscore.com/) API. The StopForumSpam API is free and requires no sign-up, and the service aggregates a [huge](https://www.stopforumspam.com/contributors) amount of blacklist feeds.
Still, in order to use the IPQualityScore API for in-depth threat reporting, it's necessary to [sign up](https://www.ipqualityscore.com/create-account) for their service (it's free) and get an API token (it will be emailed to you on sign-up), which will entitle you to 5000 free lookups per month.
Once obtained, the api token should be written to one of the following files (parsed in that order):
`$HOME/.asn/iqs_token` or
`/etc/asn/iqs_token`
The `/etc`-based file should be used when running asn in **server mode**. The `$HOME`-based file takes precedence if both files exist, and is ideal for **user mode** (that is, running `asn` interactively from the command line).
In order to do so, you can use the following command:
***User mode:***
`TOKEN="
When this token is available, an additional lookup will be enabled for **autonomous system** targets, in order to enumerate the BGP incidents (both **BGP hijacks** and **BGP route leaks**) involving the target ASN.
The script will use the [Cloudfare Radar](https://radar.cloudflare.com/) API to retrieve the amount of incidents involving the target ASN in the past 12 months. Additionally, it will report how many incidents saw the target ASN as a **hijacker** or as a **victim**.
The Cloudflare Radar API is **free** to use, but requires a registration. The steps are:
1. [Sign up](https://dash.cloudflare.com/sign-up) for a free Cloudflare account and **validate your email**
2. From the [Cloudflare dashboard](https://dash.cloudflare.com/profile/api-tokens/), go to **My Profile > API Tokens**.
3. Select **Create Token**
4. Choose the "*Read Cloudflare Radar data*" template
5. Click **Continue to summary** (the default values are fine)
6. Click **Create token**
Once obtained, the api token should be written to one of the following files (parsed in that order):
`$HOME/.asn/cloudflare_token` or
`/etc/asn/cloudflare_token`
The `/etc`-based file should be used when running asn in **server mode**. The `$HOME`-based file takes precedence if both files exist, and is ideal for **user mode** (that is, running `asn` interactively from the command line).
In order to do so, you can use the following command:
***User mode:***
`TOKEN="
##### Command: `asn -J 8.8.8.8` ##### Output: ```json { "target": "8.8.8.8", "target_type": "ipv4", "result": "ok", "reason": "success", "version": "0.78.0", "request_time": "2024-08-20T02:50:28", "request_duration": 5, "api_tokens": { "ipqualityscore": true, "ipinfo": true, "cloudflare": true }, "result_count": 1, "results": [ { "ip": "8.8.8.8", "ip_version": "4", "reverse": "dns.google", "org_name": "Google LLC", "net_range": "8.8.8.0/24", "net_name": "GOGL", "abuse_contacts": [ "network-abuse@google.com" ], "routing": { "is_announced": true, "as_number": "15169", "as_name": "GOOGLE, US", "as_rank": "1788", "route": "8.8.8.0/24", "route_name": "", "roa_count": "1", "roa_validity": "valid" }, "type": { "is_bogon": false, "is_anycast": true, "is_mobile": false, "is_proxy": false, "is_dc": true, "dc_details": { "dc_name": "Google LLC" }, "is_ixp": false }, "geolocation": { "city": "Mountain View", "region": "California", "country": "United States", "cc": "US" }, "reputation": { "status": "good", "is_known_good": true, "known_as": "Google Public DNS" }, "fingerprinting": { "ports": [ 53, 443 ] } } ] } ```
##### Command: `asn -J 5505` ##### Output: ```json { "target": "5505", "target_type": "asn", "result": "ok", "reason": "success", "version": "0.78.0", "request_time": "2024-08-20T02:50:46", "request_duration": 17, "api_tokens": { "ipqualityscore": true, "ipinfo": true, "cloudflare": true }, "result_count": 1, "results": [ { "asn": "5505", "asname": "VADAVO, ES", "asrank": 4448, "org": "VDV-VLC-RED06 VDV-VLC-RED06 - CLIENTES TELECOM", "holder": "VADAVO SOLUCIONES SL", "abuse_contacts": [ "abuse@vadavo.com" ], "registration_date": "2016-12-13T08:28:07", "ixp_presence": [ "DE-CIX Madrid: DE-CIX Madrid Peering LAN", "ESpanix Madrid Lower LAN" ], "prefix_count_v4": 8, "prefix_count_v6": 1, "bgp_peer_count": 36, "bgp_hijack_incidents": { "total": 0, "as_hijacker": 0, "as_victim": 0 }, "bgp_leak_incidents": { "total": 0 }, "bgp_peers": { "upstream": [ "1299", "6939", "59432", "174", "34549", "25091", "35625", "33891", "48348", "13030", "8218", "41327", "3303", "4455", "6424", "6057", "34927", "9498", "35280", "1239" ], "downstream": [ "48952", "208248", "205086", "202054" ], "uncertain": [ "24482", "51185", "41047", "29680", "212483", "198150", "14840", "49544", "39384", "37721", "36236", "25160" ] }, "announced_prefixes": { "v4": [ "185.210.225.0/24", "188.130.247.0/24", "185.210.227.0/24", "185.123.205.0/24", "185.123.207.0/24", "185.210.226.0/24", "185.123.206.0/24", "185.123.204.0/24" ], "v6": [ "2a03:9320::/32" ] }, "inetnums": { "v4": [ "185.123.204.0/22", "185.210.225.0/24", "185.210.226.0/24", "185.210.227.0/24", "188.130.247.0/24" ], "v6": [ "2a03:9320::/32" ] }, "inetnums_announced_by_other_as": { "v4": [ { "prefix": "188.130.254.0/24", "origin_asn": "", "origin_org": "", "is_announced": false } ], "v6": [] } } ] } ```
##### Command: `asn -j www.google.com | jq '[.results[].abuse_contacts[]] | unique[]'` ##### Output: ``` "network-abuse@google.com" "ripe-contact@google.com" ```
##### Command: `asn -j 45.67.34.100 | jq '.results[].fingerprinting.vulns[]'` ##### Output: ``` "CVE-2017-15906" "CVE-2018-15919" ```
##### Command: `asn -Ju 72.17.119.201` ##### Output: ```json { "target": "72.17.119.201", "target_type": "ipv4", "result": "ok", "reason": "success", "version": "0.78.0", "request_time": "2024-08-20T02:54:03", "request_duration": 4, "api_tokens": { "ipqualityscore": true, "ipinfo": true, "cloudflare": true }, "result_count": 1, "results": [ { "prefix": "72.17.0.0/17", "origin_as": "33363", "origin_as_name": "BHN-33363, US", "origin_as_rank": 441, "upstreams_count": 1, "upstreams": [ { "asn": "7843", "asname": "TWC-7843-BB, US", "probability": 100, "is_tier1": false } ], "multiple_upstreams": false } ] } ```
##### Command: `asn -j AS5505 | jq -r '.results[].inetnums_announced_by_other_as.v4[] | select(.is_announced==false) | .prefix'` ##### Output: ``` 188.130.254.0/24 ```
##### Command: `asn -j AS8860 | jq '.results[].bgp_hijack_incidents'` ##### Output: ``` { "total": 18, "as_hijacker": 11, "as_victim": 7 } ```
ASN Lookup Server Report | ||||
---|---|---|---|---|
Lookup Target | Client IP | Lookup Server ASN | Lookup Server Hostname | Date and time |
$host | $NCAT_REMOTE_ADDR | $found_asn ($found_asname
|
$HOSTNAME | $reportdatetime |
$message |
---|