{"id":3928,"date":"2015-06-14T03:46:33","date_gmt":"2015-06-13T19:46:33","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3928"},"modified":"2015-09-09T19:36:36","modified_gmt":"2015-09-09T11:36:36","slug":"just-metadata-gathers-analyse-ip-address-metadata","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/06\/just-metadata-gathers-analyse-ip-address-metadata\/","title":{"rendered":"Just-Metadata &#8211; Gathers &#038; Analyse IP Address Metadata"},"content":{"rendered":"<p>Just-Metadata is a tool that can be used to gather IP address metadata passively about a large number of IP addresses, and attempt to extrapolate relationships that might not otherwise be seen. Just-Metadata has &#8220;gather&#8221; modules which are used to gather metadata about IPs loaded into the framework across multiple resources on the internet. Just-Metadata also has &#8220;analysis&#8221; modules. These are used to analyze the data loaded Just-Metadata and perform various operations that can identify potential relationships between the loaded systems.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"http:\/\/farm1.staticflickr.com\/405\/18154793734_c189414aab.jpg\" alt=\"Just-Metadata - Gathers &amp; Analyse IP Address Metadata\" \/><\/p>\n<p>Just-Metadata will allow you to quickly find the Top &#8220;X&#8221; number of states, cities, timezones, etc. that the loaded IP addresses are located in. It will allow you to search for IP addresses by country. You can search all IPs to find which ones are used in callbacks as identified by VirusTotal. Want to see if any IPs loaded have been documented as taking part of attacks via the Animus Project, Just-Metadata can do it.<\/p>\n<p>Additionally, it is easy to create new analysis modules to let people find other relationships between IPs loaded based on the available data. New intel gathering modules can be easily added in just as easily.<\/p>\n<h3>Features<\/h3>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Just-Metadata gathers various publicly available IP address metadata such as:<\/p>\n<ul>\n<li>Geo-location information\n<ul>\n<li>Country<\/li>\n<li>City<\/li>\n<li>Timezone<\/li>\n<li>GPS Coordinates<\/li>\n<\/ul>\n<\/li>\n<li>ISP<\/li>\n<li>Is it a known attacker documented by the<span class=\"Apple-converted-space\">\u00a0<\/span><a href=\"https:\/\/github.com\/animus-project\/threat_data\">Animus Project<\/a>?<\/li>\n<li>Do the attacking IP addresses share any common traits\n<ul>\n<li>SSH Keys<\/li>\n<li>HTTPS Certificates<\/li>\n<li>Certificate Chains<\/li>\n<\/ul>\n<\/li>\n<li>What common ports are open across the attacking IPs?<\/li>\n<li>Are any of the IPs known by VirusTotal?<\/li>\n<li><a href=\"https:\/\/www.darknet.org.uk\/2014\/06\/shodan-internet-computer-search-engine\/\">Shodan<\/a> information (Ports, keys, certificates, etc.)<\/li>\n<\/ul>\n<h3>Requirements<\/h3>\n<p>Ideally, you should be able to run the setup script, and it will install everything you need.<\/p>\n<p>For the Shodan information gathering module, YOU WILL NEED a Shodan API key. This costs like $9 bucks, come on now, it&#8217;s worth it :).<\/p>\n<p>I&#8217;ll be looking forwards to future versions with cli based input and output for scripting and chaining this with other tools, with a bit of data crunching and pattern matching\/machine learning it could be turned into a fairly intelligent attack pre-warning system.<\/p>\n<p>You can download Just-Metadata v1.0 here:<\/p>\n<p><a href=\"https:\/\/github.com\/ChrisTruncer\/Just-Metadata\/archive\/1.0.zip\">Just-Metadata-1.0.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/ChrisTruncer\/Just-Metadata\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just-Metadata is a tool that can be used to gather IP address metadata passively about a large number of IP addresses, and attempt to extrapolate relationships that might not otherwise be seen. Just-Metadata has &#8220;gather&#8221; modules which are used to gather metadata about IPs loaded into the framework across multiple resources on the internet. Just-Metadata [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Just-Metadata is a tool that can be used to gather IP address metadata passively about a large number of IP addresses.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,5,11],"tags":[2438,284,7282],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3928"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3928"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3928\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3928"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3928"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3928"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}