{"id":4204,"date":"2016-07-12T17:28:22","date_gmt":"2016-07-12T09:28:22","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4204"},"modified":"2016-07-12T17:28:31","modified_gmt":"2016-07-12T09:28:31","slug":"automater-ip-url-osint-analysis","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/07\/automater-ip-url-osint-analysis\/","title":{"rendered":"Automater – IP & URL OSINT Tool For Analysis"},"content":{"rendered":"

Automater is a URL\/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts. Given a target (URL, IP, or HASH) or a file full of targets Automater will return relevant results from sources like the following: IPvoid.com, Robtex.com, Fortiguard.com, unshorten.me, Urlvoid.com, Labs.alienvault.com, ThreatExpert, VxVault, and VirusTotal. <\/p>\n

\"Automater<\/p>\n

By default, if Automater does not find data available it will not submit the target to that site to get data. If you would like Automater to use an HTTP POST to send target data to a source like IPVoid or URLVoid use \u2013p<\/p>\n

There are also new output methods. \u2013o will output to a file in the same format that is printed to screen, -c will output a csv, and \u2013w will output an html file.<\/p>\n

Usage<\/h3>\n

It does take Automater a little longer to run then it used to. That is because a delay of 2 seconds between requests was implemented to ensure sources don’t get overloaded. You can modify this delay with a \u2013d .<\/p>\n

.\/Automater.py -h\r\n\r\nusage: Automater.py [-h] [-o OUTPUT] [-w WEB] [-c CSV] [-d DELAY] [-s SOURCE] [--p] target\r\n\r\nIP, URL, and Hash Passive Analysis tool\r\n\r\nrequired arguments:\r\n\r\n  target                List one IP Addresses, URL or Hash to query or pass\r\n                        the filename of a file containing IP Addresses, URL or\r\n                        Hash to query each separated by a newline.\r\n\r\noptional arguments:\r\n\r\n  -h, --help            show this help message and exit\r\n\r\n  -o OUTPUT, --output OUTPUT This option will output the results to a file.\r\n\r\n  -w WEB, --web WEB     This option will output the results to an HTML file.\r\n\r\n  -c CSV, --csv CSV     This option will output the results to a CSV file.\r\n\r\n  -d DELAY, --delay DELAY This will change the delay to the inputted seconds.\r\n                          Default is 2.\r\n\r\n  -s SOURCE, --source SOURCE This option will only run the target against a\r\n                        specific source engine to pull associated domains.\r\n                        Options are defined in the name attribute of the site\r\n                        element in the XML configuration file\r\n\r\n  --p                   This option tells the program to post information to\r\n                        sites that allow posting. By default the program will\r\n                        NOT post to sites that require a post.  <\/pre>\n

Automater is now very easily extensible even for those that are not familiar with python. All the sources that are queried and what they are queried for are contained in sites.xml. This must be in the same directory as Automater.py and all the other .py\u2019s that Automater ships with.<\/p>\n

You can download Automater here:<\/p>\n

TekDefense-Automater-master.zip<\/a><\/p>\n

Or read more here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Automater is a URL\/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts. Given a target (URL, IP, or HASH) or a file full of targets Automater will return relevant results from sources like the following: IPvoid.com, Robtex.com, Fortiguard.com, unshorten.me, Urlvoid.com, Labs.alienvault.com, ThreatExpert, VxVault, and VirusTotal. By […]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Automater is a URL\/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9,5],"tags":[2345,7385],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4204"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4204"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4204\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}