GitLocker: The Coding Marketplace

Description:

orgia 0.1

orgia
Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.
Useful for conducting Recon on a big Organisation.
For example, after running orgia the OG way on "Hilton", I got 96436 v4 IPs.
Installation
pipx
Global installation:
pipx install git+https://github.com/sttlr/orgia
orgia -h

Or run without installing:
pipx run --spec git+https://github.com/sttlr/orgia orgia -h

Docker
git clone https://github.com/sttlr/orgia
cd orgia

docker build -t orgia .
docker run --rm orgia -h

Usage
usage: orgia [-h] [--org ORG_NAME] [--version] [--silent] [--debug] [-c PATH] [--sources SOURCE]
[--orgs-input-file PATH] [--asns-input-file PATH] [--networks-input-file PATH]
[--max-enrich] [-o PATH] [--adjacent]
[--orgs | --asns | --networks | --cidrs | --export-all PATH] [--jsonl] [--ip4-only]

Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.

options:
-h, --help show this help message and exit
--org ORG_NAME organization name (ex. "Hilton")
--version show program's version number and exit
--silent display results only (useful for piping to jq)
--debug print debug info
-c PATH, --config PATH
path to .yaml config file
--sources SOURCE comma separated, possible values: all (default), arin, ripe, apnic,
afrinic, lacnic
--orgs-input-file PATH
path to input file with Organisation handles
--asns-input-file PATH
path to input file with ASN handles
--networks-input-file PATH
path to input file with Network handles
--max-enrich use level 2 when trying to bruteforce entity name
-o PATH, --output PATH
path to output file (default stdout)
--adjacent parse adjacent (dirty): ASNs from Orgs and Orgs from Networks
--orgs show only Organisation handles in output
--asns show only ASNs in output
--networks show only Network handles in output
--cidrs show only CIDRs in output
--export-all PATH folder to export everything
--jsonl show output in jsonl formal
--ip4-only show only IPv4 networks in output

by sttlr

Quick
Get CIDRs for specified Orgname:
orgia --org ORGNAME --cidrs

Enriched
Try even more enriched Orgnames when searching.
orgia --org ORGNAME --max-enrich --cidrs

Resolve only
If you have input files with handles, pass them via --asns-input-file, --orgs-input-file, --networks-input-file and orgia will resolve them for you:
orgia --asns-input-file ORGNAME_asn_handles.txt \
--orgs-input-file ORGNAME_org_handles_.txt \
--networks-input-file ORGNAME_networks_handles.txt

You can combine it with any of the output options: --cidrs, --orgs, --asns, --networks, --export-all
Specific
Select source
Choose source (arin, ripe, apnic, afrinic, lacnic) - default "all":
orgia --org ORGNAME --sources ripe,arin

IPv4 only
Don't print IPv6 Networks/CIDRs in the output:
orgia --org ORGNAME --ip4-only --cidrs

Pipe to jq
By default, orgia prints handles only (for --orgs, --asns, --networks).
You can pass --jsonl to use JSON as the output format. When piping to jq also use --silent:
orgia --org ORGNAME --asns --silent --jsonl | jq

Use config
Whitelist or blacklist handles, names, emails in output.
When checking, input is lowercased and in is used for comparison (checks if a config string in a test string).
You can create a config file and pass it via --config option:
orgia --org ORGNAME --cidrs --config PATH_TO_CONFIG.yaml

Empty config looks like this:
orgs:
whitelist-handles: []
blacklist-handles: []
whitelist-names: []
blacklist-names: []
whitelist-emails: []
blacklist-emails: []

asns:
whitelist-handles: []
blacklist-handles: []
whitelist-names: []
blacklist-names: []
whitelist-emails: []
blacklist-emails: []

networks:
whitelist-handles: []
blacklist-handles: []
whitelist-names: []
blacklist-names: []
whitelist-emails: []
blacklist-emails: []

OG
Comprehensive.
Create handle input files via org_info - parse directly from RIPE, APNIC, AfriNIC WHOIS databases:
./bin/query_asn ORGNAME > ORGNAME_asns_from_org_info.txt
./bin/query_org ORGNAME > ORGNAME_orgs_from_org_info.txt
./bin/query_inetnum ORGNAME > ORGNAME_networks_from_org_info.txt

Then run the OG:
orgia --org ORGNAME \
--sources all \
--max-enrich \
--asns-input-file ORGNAME_asns_from_org_info.txt \
--orgs-input-file ORGNAME_orgs_from_org_info.txt \
--networks-input-file ORGNAME_networks_from_org_info.txt \
--export-all orgia_ORGNAME_export \
--config orgia_ORGNAME_config.yaml

Folder with results (orgia_ORGNAME_export) will contain:

cidrs.txt - list of all CIDRs
asns.jsonl - ASN info in JSONL format
orgs.jsonl - Organisation info in JSONL format
networks.jsonl - Network info in JSONL format

Adjacent mode (dirty)
You can use --adjacent option, to also extract ASNs from Orgs and Orgs from Networks.
NOTE: It's dirty, and will result in lots of trash results.
API
You can import orgia as a package to use it in your scripts:
from orgia.nics import RIPE, ARIN, LACNIC, APNIC, AFRINIC

Or low-level:
from orgia.nics import RDAP, Engine

NOTE: orgia isn't designed to be used this way.
TODO
Pull requests are welcome ;)

Implement Async via httpx.AsyncClient()
Improve upon developer API - get rid of args argument when creating a class
Add more options in a config file