In this bonus video, we're going to be taking a look at the program, Geo Recon and installing it to
our Trace Labs Linux setup.
Now, Geo Recon is a tool that's going to allow us to take an IP address and get more information about
it, which is obviously going to be pretty useful for Osint investigations.
Now grabbing an IP, we can typically do this sometimes through forums will post IP addresses.
If there's an attacker or a network, we'll typically see an IP address and depending on which email
client they're using, we may be able to get an IP address also or and other avenues, things like.
A Xbox or PlayStation, you might be able to get an IP address depending how the information is coming
through and whatnot.
So let's take a look at the program itself.
Now this is a GitHub page for it at GitHub.com forward slash radio active.
Forward slash G dash recon.
And it's going to be a pretty simple install and this is going to be again a command line interface
tool and it's going to be using Python to install this Python three to be exact.
So if you scroll down, you can actually see the commands here.
And I actually copied and pasted the instructions into the description of this video if you want to
take a look at that.
So the first thing we do is we're going to copy this here.
And I'm going to open the terminal and we're let me see if I can zoom in here and make a little bit
easier for you to see.
Okay, That should be good.
I'm going to paste in.
The command here.
Get space, clone space and then the URL for the GitHub page.
Okay.
And if we go back to the instructions here, we simply need to go recon.
And you could again, either type that in or copy and paste it.
And then we need to make this a.
Executable.
So we're going to do a mod space plus X and then the geo recon dot pi.
So let's copy and paste that in here.
Okay.
Now we should be able to go ahead and install it.
So we're going to use this command here.
Let me go back there.
We're going to do a sudo apt install python three pip because we're going to need the python three pip
to install this.
And we're going to have to type our password.
So if you leave it the default, it's going to be, Oh.
Okay.
And mine's already installed.
You may or may not need to go and install that, but it's always good to run it just in case.
And finally, we're going to go ahead and install all the requirements here.
So since we just installed Pip three, we can do a Pip three space install space dash r space requirements.txt.
Now what this does is the Pip three command takes a look at that Requirements.txt file and whatever
requirements are in there that are not already met on our Linux machine is going to go ahead and install
that.
So let's go ahead and run that.
Okay, Now mine's already installed.
And one of the things that's going to install is Nmap, which is going to be useful for.
Or actually required to go ahead and run the scan.
So once we have everything installed here, let me clear it out.
Clear out the screen.
Okay.
I'm just going to do LZ.
Now we can see Geo Recon Pi right here.
So to run it, we could do Python three.
Python three is all one word space geo dash recon dot pi space and whatever the IP address that we're
going to be checking.
Let me go back there.
Now make sure my num lock is on.
8.8.8.8.
Now let's say this is the IP address that we're that we're scanning.
So we can do a python three geo geo dash recon dot pi space.
One of the IP address is.
And we can hit enter and we can let that run through.
Now, this is going to take a moment.
Just checking if Nmap is installed and installing it.
And once it's done, we can see.
It actually runs.
So it's running geolocation check against the IP address.
We can see the country United States region is Virginia City is Ashburn organization is Google public
DNS.
We can see a latitude and longitude.
We can see the ISP.
So this is all obviously great information and we can see the geo lookup is complete and it runs a reputation
check.
So domain is Google.com.
We can see the hostname DNS Google, we can see usage type data center, web hosting and transit.
We can see the confidence of abuse.
So if it was been reported as a abusive website, it's say a bot site or whatnot, then you're probably
going to see a number of abuse reports in there.
Now, you can see a number of times report it, last, report it.
You can see if it's whitelisted, whitelisted, true and IP address is deemed not malicious in IP reputation
lookup is complete.
So again, really, really handy program when looking up IP addresses, obviously we could use other
tools like who is tools and what not to find more IP info, but this is a really great tool.
I like this because it's we just now install it to our Trace Labs Linux and we don't have to go on a
website, websites go down and whatnot.
However, this is a great tool that's already that we now have installed and useful in our toolbox.
And this is Geo Recon.
Thank you for watching.
I'll see you in the next video.