Re: [NSE] Local IP geolocation script

[Philipp Emanuel Weidmann <philipp.weidmann () gmx de>]

Script formatting got screwed up during email transit, here it is again 
as an attachment.

Philipp

-- NOTE: In order for this script to work, you must download the GeoLite Country database from
-- http://www.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip,
-- unpack it, and place it in the Nmap main directory (where the other Nmap data files are, too)

id          = "IP geolocation"

description = "Displays the location of the scanned host (country only), \
taken from the GeoLite Country database.\n\
NO information WHATSOEVER is sent from the scanning machine."

author      = "Philipp E. Weidmann <philipp.weidmann () gmx de>"

license     = "Script: Same as Nmap, see http://nmap.org/book/man-legal.html; \
GeoLite Country database: See http://www.maxmind.com/download/geoip/database/LICENSE.txt";

categories  = {"default", "discovery"}


require "ipOps"


hostrule = function(host)
  return not ipOps.isPrivate(host.ip)
end


action = function(host)
  local ipnumber
  local range_start
  local range_end
  local countrycode
  local countryname
  
  ipnumber = 16777216 * tonumber(string.match(host.ip, '([0-9]+)')) + 
                65536 * tonumber(string.match(host.ip, '[0-9]+\.([0-9]+)')) + 
                  256 * tonumber(string.match(host.ip, '[0-9]+\.[0-9]+\.([0-9]+)')) + 
                        tonumber(string.match(host.ip, '[0-9]+\.[0-9]+\.[0-9]+\.([0-9]+)'))
  
  for line in io.lines(nmap.fetchfile("GeoIPCountryWhois.csv")) do
    range_start = tonumber(string.match(line, '"[0-9\.]+","[0-9\.]+","([0-9]+)"'))
    range_end   = tonumber(string.match(line, '"[0-9\.]+","[0-9\.]+","[0-9]+","([0-9]+)"'))
    countrycode = string.match(line, '"[0-9\.]+","[0-9\.]+","[0-9]+","[0-9]+","([^"]+)"')
    countryname = string.match(line, '"[0-9\.]+","[0-9\.]+","[0-9]+","[0-9]+","[^"]+","([^"]+)"')
    
    if (ipnumber >= range_start) and (ipnumber <= range_end) then
      return countryname .. " (" .. countrycode .. ")"
    end
  end
  
  return
end


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org