Instarecon v-0.1.0 released – Basic automated digital reconnaissance.

HoChi-Minh / June 18, 2015 / Comments Off / Networking, Penetration Test, Scanner

Change v-0.1.0: Shodan key provided – <shodan_key>

Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do:
– DNS (direct, PTR, MX, NS) lookups
– Whois (domains and IP) lookups
– Google dorks in search of subdomains
– Shodan lookups
– Reverse DNS lookups on entire CIDRs
…all printed nicely on your console or csv file.
InstaRecon will never scan a target directly. Information is retrieved from DNS/Whois servers, Google, and Shodan.

Example Querying Shodan for open ports

Requirement :
+ argparse==1.2.1
+ click==3.3
+ colorama==0.3.3
+ dnspython==1.12.0
+ ipaddr==2.1.11
+ ipaddress==1.0.7
+ ipwhois==0.10.1
+ pythonwhois==2.4.3
+ requests==2.5.3
+ shodan==1.2.6
+ simplejson==3.6.5
+ wsgiref==0.1.2

instarecon.py Code:

#!/usr/bin/env python
import argparse
import csv
import logging
import os
import sys

import ipaddress as ipa  # https://docs.python.org/3/library/ipaddress.html
import dns.resolver

from src.ip import IP
from src.host import Host
from src.network import Network
from src import lookup

class InstaRecon(object):
    """
    Holds all Host entries and manages scans, interpret user input, threads and outputs.
    Keyword arguments:
    nameserver -- Str DNS server to be used for lookups (consumed by dns.resolver module).
    targets -- Set of Hosts or Networks that will be scanned.
    bad_targets -- Set of user inputs that could not be understood or resolved.
    versobe -- Bool flag for verbose output printing. Passed to logs.
    shodan_key -- Str key used for Shodan lookups. Passed to lookups.
    """
    __version__ = '0.1.0'
    entry_banner = '# InstaRecon v' + __version__ + ' - by Luis Teixeira (teix.co)'
    exit_banner = '# Done'

    def __init__(self, nameserver=None, timeout=None, shodan_key=None, verbose=0, dns_only=False):
        
        self.dns_only = dns_only
        self.targets = set()
        self.bad_targets = set()

        if nameserver:
            lookup.dns_resolver.nameservers = [nameserver]
        if timeout:
            lookup.dns_resolver.timeout = timeout
            lookup.dns_resolver.lifetime = timeout
        if shodan_key:
            lookup.shodan_key = shodan_key

        # https://docs.python.org/2/library/logging.html#logging-levels
        logging_level = 40 # ERROR
        log_format = '[-] %(levelname)s:%(message)s'
        if verbose == 1:
            logging_level = 30 # WARNING
        elif verbose == 2:
            logging_level = 20 # INFO
        elif verbose > 2:
            logging_level = 10 # DEBUG
            log_format = '[-] %(levelname)s:%(module)s:%(funcName)s:%(lineno)d:%(message)s'

        logging.basicConfig(format=log_format, level=logging_level)

    def populate(self, user_supplied_list):
        for user_supplied in user_supplied_list:
            self.add_host(user_supplied)

        if not self.targets:
            print '# No hosts to scan'
        else:
            print '# Scanning', str(len(self.targets)) + '/' + str(len(user_supplied_list)), 'hosts'

            if not self.dns_only:
                if not lookup.shodan_key:
                    print '# No Shodan key provided'
                else:
                    print'# Shodan key provided -', lookup.shodan_key

    def add_host(self, user_supplied):
        """
        Add string passed by user to self.targets as proper Host/Network objects
        For this, it attempts to create these objects and moves on if got a ValueError.
        """
        # Test if user_supplied is an IP?
        try:
            self.targets.add(Host(ips=[user_supplied]))
            return
        except ValueError as e:
            pass

        try:
            self.targets.add(Network(user_supplied))
            return
        except ValueError as e:
            pass

        # Test if user_supplied is a valid DNS?
        try:
            self.targets.add(Host(domain=user_supplied))
            return
        except ValueError as e:
            logging.critical('Couldn\'t resolve or understand ' + user_supplied)
            pass

        self.bad_targets.add(user_supplied)

    def scan_targets(self):
        for target in self.targets:
            if type(target) is Host:
                if self.dns_only:
                    self.scan_host_dns_only(target)
                else:
                    self.scan_host(target)
            elif type(target) is Network:
                self.scan_network(target)

    def scan_host(self, host):
        """Does all possible scans for host"""

        print ''
        print '# ____________________ Scanning {} ____________________ #'.format(str(host))

        # DNS and Whois lookups
        print ''
        print '# DNS lookups'

        host.lookup_dns()
        if host.domain:
            print '[*] Domain: ' + host.domain

        # IPs and reverse domains
        if host.ips:
            print ''
            print '[*] IPs & reverse DNS: '
            print host.print_all_ips()

        host.lookup_dns_ns()
        # NS records
        if host.ns:
            print ''
            print '[*] NS records:'
            print host.print_all_ns()

        host.lookup_dns_mx()
        # MX records
        if host.mx:
            print ''
            print '[*] MX records:'
            print host.print_all_mx()

        print ''
        print '# Whois lookups'

        host.lookup_whois_domain()
        if host.whois_domain:
            print ''
            print '[*] Whois domain:'
            print host.whois_domain

        host.lookup_whois_ip_all()
        m = host.print_all_whois_ip()
        if m:
            for result in m:
                print ''
                print '[*] Whois IP for ' + result

        # Shodan lookup
        if lookup.shodan_key:

            print ''
            print '# Querying Shodan for open ports'

            host.lookup_shodan_all()

            m = host.print_all_shodan()
            if m:
                print '[*] Shodan:'
                print m

        # Google subdomains lookup
        if host.domain:
            print ''
            print '# Querying Google for subdomains and Linkedin pages, this might take a while'

            host.google_lookups()

            if host.linkedin_page:
                print '[*] Possible LinkedIn page: ' + host.linkedin_page

            if host.google_subdomains:
                print '[*] Subdomains:' + '\n' + host.print_google_subdomains()
            else:
                logging.error('No subdomains found in Google. If you are scanning a lot, Google might be blocking your requests.')

        # DNS lookups on entire CIDRs taken from host.lookup_whois_ip_all()
        if host.cidrs:
            print ''
            print '# Reverse DNS lookup on range {}'.format(', '.join([str(cidr) for cidr in host.cidrs]))
            self.reverse_dns_on_cidr(host)
    
    def scan_host_dns_only(self, host):
        """Does only direct and reverse DNS lookups for host"""

        print ''
        print '# _________________ DNS lookups on {} _________________ #'.format(str(host))

        host.lookup_dns()
        if host.domain:
            print ''
            print host.print_dns_only()

    def scan_network(self, network):
        """Scan a network object"""
        print ''
        print '# _____________ Reverse DNS lookups on {} _____________ #'.format(str(network))
        self.reverse_dns_on_cidr(network)

    @staticmethod
    def reverse_dns_on_cidr(target):
        """Does reverse dns lookups on a target, and saves results to target using target.add_related_host"""
        cidrs = set()
        if isinstance(target, Host):
            [cidrs.add(cidr) for cidr in target.cidrs]
        elif isinstance(target, Network):
            cidrs.add(target.cidr)
        else:
            raise ValueError

        for cidr in cidrs:

            for ip, reverse_domains in lookup.rev_dns_on_cidr(cidr):

                    new_host = Host(ips=[ip], reverse_domains=reverse_domains)
                    target.add_related_host(new_host)
                    print new_host.print_all_ips()

        if not target.related_hosts:
            print '# No results for this range'

    def test_output_csv(self, filename=None):
        """Test if file is writable before running any scan"""
        if filename:
            with open(filename, 'wb') as f:
                # If file isn't writable this raises an IOError, which is caught in main
                pass

    def write_output_csv(self, filename=None):
        """Writes output for each target as csv in filename"""
        if filename:
            filename = os.path.expanduser(filename)

            print '# Saving output csv file'

            output_as_lines = []

            for host in self.targets:
                for line in host.print_as_csv_lines():
                    output_as_lines.append(line)
                output_as_lines.append(['\n'])

                with open(filename, 'wb') as f:
                    writer = csv.writer(f)

                    for line in output_as_lines:
                        writer.writerow(line)

                    output_written = True

if __name__ == '__main__':
    parser = argparse.ArgumentParser(
        description=InstaRecon.entry_banner,
        usage='%(prog)s [options] target1 [target2 ... targetN]',
        epilog=argparse.SUPPRESS,
    )

    parser.add_argument('targets', nargs='+', help='targets to be scanned - can be a domain (google.com), an IP (8.8.8.8) or a network range (8.8.8.0/24)')
    parser.add_argument('-o', '--output', required=False, nargs='?', help='output filename as csv')
    parser.add_argument('-n', '--nameserver', required=False, nargs='?', help='alternative DNS server to query')
    parser.add_argument('-s', '--shodan_key', required=False, nargs='?', help='shodan key for automated port/service information (SHODAN_KEY environment variable also works for this')
    parser.add_argument('-t', '--timeout', required=False, nargs='?', type=float, help='timeout for DNS lookups (default is 2s)')
    parser.add_argument('-v', '--verbose', action='count', default=0, help='verbose errors (-vv or -vvv for extra verbosity)')
    parser.add_argument('-d', '--dns_only', action='store_true', help='direct and reverse DNS lookups only')

    args = parser.parse_args()

    targets = sorted(set(args.targets))

    if args.shodan_key:
        shodan_key = args.shodan_key
    else:
        shodan_key = os.getenv('SHODAN_KEY')

    scan = InstaRecon(
        nameserver=args.nameserver,
        shodan_key=shodan_key,
        timeout=args.timeout,
        verbose=args.verbose,
        dns_only=args.dns_only,
    )

    try:
        print scan.entry_banner
        scan.test_output_csv(args.output)
        scan.populate(targets)
        scan.scan_targets()

    except KeyboardInterrupt:
        logging.error('Scan interrupted')

    except (lookup.NoInternetAccess):
        logging.critical('Something went wrong. Sure you got internet connection?')
        sys.exit()

    except IOError:
        logging.critical('Can\'t write to file.. Better not start scanning anything, right?')
        sys.exit()

    scan.write_output_csv(args.output)
    print scan.exit_banner

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

#!/usr/bin/env python

import argparse

import csv

import logging

import os

import sys

import ipaddress as ipa # https://docs.python.org/3/library/ipaddress.html

import dns.resolver

from src.ip import IP

from src.host import Host

from src.network import Network

from src import lookup

class InstaRecon(object):

"""

Holds all Host entries and manages scans, interpret user input, threads and outputs.

Keyword arguments:

nameserver -- Str DNS server to be used for lookups (consumed by dns.resolver module).

targets -- Set of Hosts or Networks that will be scanned.

bad_targets -- Set of user inputs that could not be understood or resolved.

versobe -- Bool flag for verbose output printing. Passed to logs.

shodan_key -- Str key used for Shodan lookups. Passed to lookups.

"""

__version__ = '0.1.0'

entry_banner = '# InstaRecon v' + __version__ + ' - by Luis Teixeira (teix.co)'

exit_banner = '# Done'

def __init__(self, nameserver=None, timeout=None, shodan_key=None, verbose=0, dns_only=False):

self.dns_only = dns_only

self.targets = set()

self.bad_targets = set()

if nameserver:

lookup.dns_resolver.nameservers = [nameserver]

if timeout:

lookup.dns_resolver.timeout = timeout

lookup.dns_resolver.lifetime = timeout

if shodan_key:

lookup.shodan_key = shodan_key

# https://docs.python.org/2/library/logging.html#logging-levels

logging_level = 40 # ERROR

log_format = '[-] %(levelname)s:%(message)s'

if verbose == 1:

logging_level = 30 # WARNING

elif verbose == 2:

logging_level = 20 # INFO

elif verbose > 2:

logging_level = 10 # DEBUG

log_format = '[-] %(levelname)s:%(module)s:%(funcName)s:%(lineno)d:%(message)s'

logging.basicConfig(format=log_format, level=logging_level)

def populate(self, user_supplied_list):

for user_supplied in user_supplied_list:

self.add_host(user_supplied)

if not self.targets:

print '# No hosts to scan'

else:

print '# Scanning', str(len(self.targets)) + '/' + str(len(user_supplied_list)), 'hosts'

if not self.dns_only:

if not lookup.shodan_key:

print '# No Shodan key provided'

else:

print'# Shodan key provided -', lookup.shodan_key

def add_host(self, user_supplied):

"""

Add string passed by user to self.targets as proper Host/Network objects

For this, it attempts to create these objects and moves on if got a ValueError.

"""

# Test if user_supplied is an IP?

try:

self.targets.add(Host(ips=[user_supplied]))

return

except ValueError as e:

pass

try:

self.targets.add(Network(user_supplied))

return

except ValueError as e:

pass

# Test if user_supplied is a valid DNS?

try:

self.targets.add(Host(domain=user_supplied))

return

except ValueError as e:

logging.critical('Couldn\'t resolve or understand ' + user_supplied)

pass

self.bad_targets.add(user_supplied)

def scan_targets(self):

for target in self.targets:

if type(target) is Host:

if self.dns_only:

self.scan_host_dns_only(target)

else:

self.scan_host(target)

elif type(target) is Network:

self.scan_network(target)

def scan_host(self, host):

"""Does all possible scans for host"""

print ''

print '# ____________________ Scanning {} ____________________ #'.format(str(host))

# DNS and Whois lookups

print ''

print '# DNS lookups'

host.lookup_dns()

if host.domain:

print '[*] Domain: ' + host.domain

# IPs and reverse domains

if host.ips:

print ''

print '[*] IPs & reverse DNS: '

print host.print_all_ips()

host.lookup_dns_ns()

# NS records

if host.ns:

print ''

print '[*] NS records:'

print host.print_all_ns()

host.lookup_dns_mx()

# MX records

if host.mx:

print ''

print '[*] MX records:'

print host.print_all_mx()

print ''

print '# Whois lookups'

host.lookup_whois_domain()

if host.whois_domain:

print ''

print '[*] Whois domain:'

print host.whois_domain

host.lookup_whois_ip_all()

m = host.print_all_whois_ip()

if m:

for result in m:

print ''

print '[*] Whois IP for ' + result

# Shodan lookup

if lookup.shodan_key:

print ''

print '# Querying Shodan for open ports'

host.lookup_shodan_all()

m = host.print_all_shodan()

if m:

print '[*] Shodan:'

print m

# Google subdomains lookup

if host.domain:

print ''

print '# Querying Google for subdomains and Linkedin pages, this might take a while'

host.google_lookups()

if host.linkedin_page:

print '[*] Possible LinkedIn page: ' + host.linkedin_page

if host.google_subdomains:

print '[*] Subdomains:' + '\n' + host.print_google_subdomains()

else:

logging.error('No subdomains found in Google. If you are scanning a lot, Google might be blocking your requests.')

# DNS lookups on entire CIDRs taken from host.lookup_whois_ip_all()

if host.cidrs:

print ''

print '# Reverse DNS lookup on range {}'.format(', '.join([str(cidr) for cidr in host.cidrs]))

self.reverse_dns_on_cidr(host)

def scan_host_dns_only(self, host):

"""Does only direct and reverse DNS lookups for host"""

print ''

print '# _________________ DNS lookups on {} _________________ #'.format(str(host))

host.lookup_dns()

if host.domain:

print ''

print host.print_dns_only()

def scan_network(self, network):

"""Scan a network object"""

print ''

print '# _____________ Reverse DNS lookups on {} _____________ #'.format(str(network))

self.reverse_dns_on_cidr(network)

@staticmethod

def reverse_dns_on_cidr(target):

"""Does reverse dns lookups on a target, and saves results to target using target.add_related_host"""

cidrs = set()

if isinstance(target, Host):

[cidrs.add(cidr) for cidr in target.cidrs]

elif isinstance(target, Network):

cidrs.add(target.cidr)

else:

raise ValueError

for cidr in cidrs:

for ip, reverse_domains in lookup.rev_dns_on_cidr(cidr):

new_host = Host(ips=[ip], reverse_domains=reverse_domains)

target.add_related_host(new_host)

print new_host.print_all_ips()

if not target.related_hosts:

print '# No results for this range'

def test_output_csv(self, filename=None):

"""Test if file is writable before running any scan"""

if filename:

with open(filename, 'wb') as f:

# If file isn't writable this raises an IOError, which is caught in main

pass

def write_output_csv(self, filename=None):

"""Writes output for each target as csv in filename"""

if filename:

filename = os.path.expanduser(filename)

print '# Saving output csv file'

output_as_lines = []

for host in self.targets:

for line in host.print_as_csv_lines():

output_as_lines.append(line)

output_as_lines.append(['\n'])

with open(filename, 'wb') as f:

writer = csv.writer(f)

for line in output_as_lines:

writer.writerow(line)

output_written = True

if __name__ == '__main__':

parser = argparse.ArgumentParser(

description=InstaRecon.entry_banner,

usage='%(prog)s [options] target1 [target2 ... targetN]',

epilog=argparse.SUPPRESS,

)

parser.add_argument('targets', nargs='+', help='targets to be scanned - can be a domain (google.com), an IP (8.8.8.8) or a network range (8.8.8.0/24)')

parser.add_argument('-o', '--output', required=False, nargs='?', help='output filename as csv')

parser.add_argument('-n', '--nameserver', required=False, nargs='?', help='alternative DNS server to query')

parser.add_argument('-s', '--shodan_key', required=False, nargs='?', help='shodan key for automated port/service information (SHODAN_KEY environment variable also works for this')

parser.add_argument('-t', '--timeout', required=False, nargs='?', type=float, help='timeout for DNS lookups (default is 2s)')

parser.add_argument('-v', '--verbose', action='count', default=0, help='verbose errors (-vv or -vvv for extra verbosity)')

parser.add_argument('-d', '--dns_only', action='store_true', help='direct and reverse DNS lookups only')

args = parser.parse_args()

targets = sorted(set(args.targets))

if args.shodan_key:

shodan_key = args.shodan_key

else:

shodan_key = os.getenv('SHODAN_KEY')

scan = InstaRecon(

nameserver=args.nameserver,

shodan_key=shodan_key,

timeout=args.timeout,

verbose=args.verbose,

dns_only=args.dns_only,

)

try:

print scan.entry_banner

scan.test_output_csv(args.output)

scan.populate(targets)

scan.scan_targets()

except KeyboardInterrupt:

logging.error('Scan interrupted')

except (lookup.NoInternetAccess):

logging.critical('Something went wrong. Sure you got internet connection?')

sys.exit()

except IOError:

logging.critical('Can\'t write to file.. Better not start scanning anything, right?')

sys.exit()

scan.write_output_csv(args.output)

print scan.exit_banner

Example Output :

$ ./instarecon.py -s <shodan_key> -o ~/Desktop/github.com.csv github.com
# InstaRecon v0.1 - by Luis Teixeira (teix.co)
# Scanning 1/1 hosts
# Shodan key provided - <shodan_key>

# ____________________ Scanning github.com ____________________ #

# DNS lookups
[*] Domain: github.com

[*] IPs & reverse DNS: 
192.30.252.130 - github.com

[*] NS records:
ns4.p16.dynect.net
    204.13.251.16 - ns4.p16.dynect.net
ns3.p16.dynect.net
    208.78.71.16 - ns3.p16.dynect.net
ns2.p16.dynect.net
    204.13.250.16 - ns2.p16.dynect.net
ns1.p16.dynect.net
    208.78.70.16 - ns1.p16.dynect.net

[*] MX records:
ALT2.ASPMX.L.GOOGLE.com
    173.194.64.27 - oa-in-f27.1e100.net
ASPMX.L.GOOGLE.com
    74.125.203.26
ALT3.ASPMX.L.GOOGLE.com
    64.233.177.26
ALT4.ASPMX.L.GOOGLE.com
    173.194.219.27
ALT1.ASPMX.L.GOOGLE.com
    74.125.25.26 - pa-in-f26.1e100.net

# Whois lookups

[*] Whois domain:
Domain Name: github.com
Registry Domain ID: 1264983250_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2015-01-08T04:00:18-0800
Creation Date: 2007-10-09T11:20:50-0700
Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Registry Registrant ID: 
Registrant Name: GitHub Hostmaster
Registrant Organization: GitHub, Inc.
Registrant Street: 88 Colin P Kelly Jr St, 
Registrant City: San Francisco
Registrant State/Province: CA
Registrant Postal Code: 94107
Registrant Country: US
Registrant Phone: +1.4157354488
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: hostmaster@github.com
Registry Admin ID: 
Admin Name: GitHub Hostmaster
Admin Organization: GitHub, Inc.
Admin Street: 88 Colin P Kelly Jr St, 
Admin City: San Francisco
Admin State/Province: CA
Admin Postal Code: 94107
Admin Country: US
Admin Phone: +1.4157354488
Admin Phone Ext: 
Admin Fax: 
Admin Fax Ext: 
Admin Email: hostmaster@github.com
Registry Tech ID: 
Tech Name: GitHub Hostmaster
Tech Organization: GitHub, Inc.
Tech Street: 88 Colin P Kelly Jr St, 
Tech City: San Francisco
Tech State/Province: CA
Tech Postal Code: 94107
Tech Country: US
Tech Phone: +1.4157354488
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: hostmaster@github.com
Name Server: ns1.p16.dynect.net
Name Server: ns2.p16.dynect.net
Name Server: ns4.p16.dynect.net
Name Server: ns3.p16.dynect.net
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2015-05-04T06:48:47-0700

[*] Whois IP:
asn: 36459
asn_cidr: 192.30.252.0/24
asn_country_code: US
asn_date: 2012-11-15
asn_registry: arin
net 0:
    cidr: 192.30.252.0/22
    range: 192.30.252.0 - 192.30.255.255
    name: GITHUB-NET4-1
    description: GitHub, Inc.
    handle: NET-192-30-252-0-1

    address: 88 Colin P Kelly Jr Street
    city: San Francisco
    state: CA
    postal_code: 94107
    country: US

    abuse_emails: abuse@github.com
    tech_emails: hostmaster@github.com

    created: 2012-11-15 00:00:00
    updated: 2013-01-05 00:00:00

# Querying Shodan for open ports
[*] Shodan:
IP: 192.30.252.130
Organization: GitHub
ISP: GitHub

Port: 22
Banner: SSH-2.0-libssh-0.6.0
    Key type: ssh-rsa
    Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PH
    kccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETY
    P81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoW
    f9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lG
    HSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
    Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48
Port: 80
Banner: HTTP/1.1 301 Moved Permanently
    Content-length: 0
    Location: https://192.30.252.130/
    Connection: close

# Querying Google for subdomains and Linkedin pages, this might take a while
[*] Possible LinkedIn page: https://au.linkedin.com/company/github
[*] Subdomains:
blueimp.github.com
    199.27.75.133
bounty.github.com
    199.27.75.133
designmodo.github.com
    199.27.75.133
developer.github.com
    199.27.75.133
digitaloxford.github.com
    199.27.75.133
documentcloud.github.com
    199.27.75.133
education.github.com
    50.19.229.116 - ec2-50-19-229-116.compute-1.amazonaws.com
    50.17.253.231 - ec2-50-17-253-231.compute-1.amazonaws.com
    54.221.249.148 - ec2-54-221-249-148.compute-1.amazonaws.com
enterprise.github.com
    54.243.192.65 - ec2-54-243-192-65.compute-1.amazonaws.com
    54.243.49.169 - ec2-54-243-49-169.compute-1.amazonaws.com
erkie.github.com
    199.27.75.133
eternicode.github.com
    199.27.75.133
facebook.github.com
    199.27.75.133
fortawesome.github.com
    199.27.75.133
gist.github.com
    192.30.252.141 - gist.github.com
guides.github.com
    199.27.75.133
h5bp.github.com
    199.27.75.133
harvesthq.github.com
    199.27.75.133
help.github.com
    199.27.75.133
hexchat.github.com
    199.27.75.133
hubot.github.com
    199.27.75.133
ipython.github.com
    199.27.75.133
janpaepke.github.com
    199.27.75.133
jgilfelt.github.com
    199.27.75.133
jobs.github.com
    54.163.15.207 - ec2-54-163-15-207.compute-1.amazonaws.com
kangax.github.com
    199.27.75.133
karlseguin.github.com
    199.27.75.133
kouphax.github.com
    199.27.75.133
learnboost.github.com
    199.27.75.133
liferay.github.com
    199.27.75.133
lloyd.github.com
    199.27.75.133
mac.github.com
    199.27.75.133
mapbox.github.com
    199.27.75.133
matplotlib.github.com
    199.27.75.133
mbostock.github.com
    199.27.75.133
mdo.github.com
    199.27.75.133
mindmup.github.com
    199.27.75.133
mrdoob.github.com
    199.27.75.133
msysgit.github.com
    199.27.75.133
nativescript.github.com
    199.27.75.133
necolas.github.com
    199.27.75.133
nodeca.github.com
    199.27.75.133
onedrive.github.com
    199.27.75.133
pages.github.com
    199.27.75.133
panrafal.github.com
    199.27.75.133
parquet.github.com
    199.27.75.133
pnts.github.com
    199.27.75.133
raw.github.com
    199.27.75.133
rg3.github.com
    199.27.75.133
rosedu.github.com
    199.27.75.133
schacon.github.com
    199.27.75.133
scottjehl.github.com
    199.27.75.133
shop.github.com
    192.30.252.129 - github.com
shopify.github.com
    199.27.75.133
status.github.com
    184.73.218.119 - ec2-184-73-218-119.compute-1.amazonaws.com
    107.20.225.214 - ec2-107-20-225-214.compute-1.amazonaws.com
thoughtbot.github.com
    199.27.75.133
tomchristie.github.com
    199.27.75.133
training.github.com
    199.27.75.133
try.github.com
    199.27.75.133
twbs.github.com
    199.27.75.133
twitter.github.com
    199.27.75.133
visualstudio.github.com
    54.192.134.13 - server-54-192-134-13.syd1.r.cloudfront.net
    54.230.135.112 - server-54-230-135-112.syd1.r.cloudfront.net
    54.192.134.21 - server-54-192-134-21.syd1.r.cloudfront.net
    54.230.134.194 - server-54-230-134-194.syd1.r.cloudfront.net
    54.192.133.169 - server-54-192-133-169.syd1.r.cloudfront.net
    54.192.133.193 - server-54-192-133-193.syd1.r.cloudfront.net
    54.230.134.145 - server-54-230-134-145.syd1.r.cloudfront.net
    54.240.176.208 - server-54-240-176-208.syd1.r.cloudfront.net
wagerfield.github.com
    199.27.75.133
webcomponents.github.com
    199.27.75.133
webpack.github.com
    199.27.75.133
weheart.github.com
    199.27.75.133

# Reverse DNS lookup on range 192.30.252.0/22
192.30.252.80 - ns1.github.com
192.30.252.81 - ns2.github.com
192.30.252.86 - live.github.com
192.30.252.87 - live.github.com
192.30.252.88 - live.github.com
192.30.252.97 - ops-lb-ip1.iad.github.com
192.30.252.98 - ops-lb-ip2.iad.github.com
192.30.252.128 - github.com
192.30.252.129 - github.com
192.30.252.130 - github.com
192.30.252.131 - github.com
192.30.252.132 - assets.github.com
192.30.252.133 - assets.github.com
192.30.252.134 - assets.github.com
192.30.252.135 - assets.github.com
192.30.252.136 - api.github.com
192.30.252.137 - api.github.com
192.30.252.138 - api.github.com
192.30.252.139 - api.github.com
192.30.252.140 - gist.github.com
192.30.252.141 - gist.github.com
192.30.252.142 - gist.github.com
192.30.252.143 - gist.github.com
192.30.252.144 - codeload.github.com
192.30.252.145 - codeload.github.com
192.30.252.146 - codeload.github.com
192.30.252.147 - codeload.github.com
192.30.252.148 - ssh.github.com
192.30.252.149 - ssh.github.com
192.30.252.150 - ssh.github.com
192.30.252.151 - ssh.github.com
192.30.252.152 - pages.github.com
192.30.252.153 - pages.github.com
192.30.252.154 - pages.github.com
192.30.252.155 - pages.github.com
192.30.252.156 - githubusercontent.github.com
192.30.252.157 - githubusercontent.github.com
192.30.252.158 - githubusercontent.github.com
192.30.252.159 - githubusercontent.github.com
192.30.252.192 - github-smtp2-ext1.iad.github.net
192.30.252.193 - github-smtp2-ext2.iad.github.net
192.30.252.194 - github-smtp2-ext3.iad.github.net
192.30.252.195 - github-smtp2-ext4.iad.github.net
192.30.252.196 - github-smtp2-ext5.iad.github.net
192.30.252.197 - github-smtp2-ext6.iad.github.net
192.30.252.198 - github-smtp2-ext7.iad.github.net
192.30.252.199 - github-smtp2-ext8.iad.github.net
192.30.253.1 - ops-puppetmaster1-cp1-prd.iad.github.com
192.30.253.2 - janky-nix101-cp1-prd.iad.github.com
192.30.253.3 - janky-nix102-cp1-prd.iad.github.com
192.30.253.4 - janky-nix103-cp1-prd.iad.github.com
192.30.253.5 - janky-nix104-cp1-prd.iad.github.com
192.30.253.6 - janky-nix105-cp1-prd.iad.github.com
192.30.253.7 - janky-nix106-cp1-prd.iad.github.com
192.30.253.8 - janky-nix107-cp1-prd.iad.github.com
192.30.253.9 - janky-nix108-cp1-prd.iad.github.com
192.30.253.10 - gw.internaltools-esx1-cp1-prd.iad.github.com
192.30.253.11 - janky-chromium101-cp1-prd.iad.github.com
192.30.253.12 - gw.internaltools-esx2-cp1-prd.iad.github.com
192.30.253.13 - github-mon2ext-cp1-prd.iad.github.net
192.30.253.16 - github-smtp2a-ext-cp1-prd.iad.github.net
192.30.253.17 - github-smtp2b-ext-cp1-prd.iad.github.net
192.30.253.23 - ops-bastion1-cp1-prd.iad.github.com
192.30.253.30 - github-slowsmtp1-ext-cp1-prd.iad.github.net
192.30.254.1 - github-lb3a-cp1-prd.iad.github.com
192.30.254.2 - github-lb3b-cp1-prd.iad.github.com
192.30.254.3 - github-lb3c-cp1-prd.iad.github.com
192.30.254.4 - github-lb3d-cp1-prd.iad.github.com
# Saving output csv file
# Done

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

$ ./instarecon.py -s <shodan_key> -o ~/Desktop/github.com.csv github.com

# InstaRecon v0.1 - by Luis Teixeira (teix.co)

# Scanning 1/1 hosts

# Shodan key provided - <shodan_key>

# ____________________ Scanning github.com ____________________ #

# DNS lookups

[*] Domain: github.com

[*] IPs & reverse DNS:

192.30.252.130 - github.com

[*] NS records:

ns4.p16.dynect.net

204.13.251.16 - ns4.p16.dynect.net

ns3.p16.dynect.net

208.78.71.16 - ns3.p16.dynect.net

ns2.p16.dynect.net

204.13.250.16 - ns2.p16.dynect.net

ns1.p16.dynect.net

208.78.70.16 - ns1.p16.dynect.net

[*] MX records:

ALT2.ASPMX.L.GOOGLE.com

173.194.64.27 - oa-in-f27.1e100.net

ASPMX.L.GOOGLE.com

74.125.203.26

ALT3.ASPMX.L.GOOGLE.com

64.233.177.26

ALT4.ASPMX.L.GOOGLE.com

173.194.219.27

ALT1.ASPMX.L.GOOGLE.com

74.125.25.26 - pa-in-f26.1e100.net

# Whois lookups

[*] Whois domain:

Domain Name: github.com

Registry Domain ID: 1264983250_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.markmonitor.com

Registrar URL: http://www.markmonitor.com

Updated Date: 2015-01-08T04:00:18-0800

Creation Date: 2007-10-09T11:20:50-0700

Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700

Registrar: MarkMonitor, Inc.

Registrar IANA ID: 292

Registrar Abuse Contact Email: abusecomplaints@markmonitor.com

Registrar Abuse Contact Phone: +1.2083895740

Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)

Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)

Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)

Registry Registrant ID:

Registrant Name: GitHub Hostmaster

Registrant Organization: GitHub, Inc.

Registrant Street: 88 Colin P Kelly Jr St,

Registrant City: San Francisco

Registrant State/Province: CA

Registrant Postal Code: 94107

Registrant Country: US

Registrant Phone: +1.4157354488

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: hostmaster@github.com

Registry Admin ID:

Admin Name: GitHub Hostmaster

Admin Organization: GitHub, Inc.

Admin Street: 88 Colin P Kelly Jr St,

Admin City: San Francisco

Admin State/Province: CA

Admin Postal Code: 94107

Admin Country: US

Admin Phone: +1.4157354488

Admin Phone Ext:

Admin Fax:

Admin Fax Ext:

Admin Email: hostmaster@github.com

Registry Tech ID:

Tech Name: GitHub Hostmaster

Tech Organization: GitHub, Inc.

Tech Street: 88 Colin P Kelly Jr St,

Tech City: San Francisco

Tech State/Province: CA

Tech Postal Code: 94107

Tech Country: US

Tech Phone: +1.4157354488

Tech Phone Ext:

Tech Fax:

Tech Fax Ext:

Tech Email: hostmaster@github.com

Name Server: ns1.p16.dynect.net

Name Server: ns2.p16.dynect.net

Name Server: ns4.p16.dynect.net

Name Server: ns3.p16.dynect.net

DNSSEC: unsigned

URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

>>> Last update of WHOIS database: 2015-05-04T06:48:47-0700

[*] Whois IP:

asn: 36459

asn_cidr: 192.30.252.0/24

asn_country_code: US

asn_date: 2012-11-15

asn_registry: arin

net 0:

cidr: 192.30.252.0/22

range: 192.30.252.0 - 192.30.255.255

name: GITHUB-NET4-1

description: GitHub, Inc.

handle: NET-192-30-252-0-1

address: 88 Colin P Kelly Jr Street

city: San Francisco

state: CA

postal_code: 94107

country: US

abuse_emails: abuse@github.com

tech_emails: hostmaster@github.com

created: 2012-11-15 00:00:00

updated: 2013-01-05 00:00:00

# Querying Shodan for open ports

[*] Shodan:

IP: 192.30.252.130

Organization: GitHub

ISP: GitHub

Port: 22

Banner: SSH-2.0-libssh-0.6.0

Key type: ssh-rsa

Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PH

kccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETY

P81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoW

f9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lG

HSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48

Port: 80

Banner: HTTP/1.1 301 Moved Permanently

Content-length: 0

Location: https://192.30.252.130/

Connection: close

# Querying Google for subdomains and Linkedin pages, this might take a while

[*] Possible LinkedIn page: https://au.linkedin.com/company/github

[*] Subdomains:

blueimp.github.com

199.27.75.133

bounty.github.com

199.27.75.133

designmodo.github.com

199.27.75.133

developer.github.com

199.27.75.133

digitaloxford.github.com

199.27.75.133

documentcloud.github.com

199.27.75.133

education.github.com

50.19.229.116 - ec2-50-19-229-116.compute-1.amazonaws.com

50.17.253.231 - ec2-50-17-253-231.compute-1.amazonaws.com

54.221.249.148 - ec2-54-221-249-148.compute-1.amazonaws.com

enterprise.github.com

54.243.192.65 - ec2-54-243-192-65.compute-1.amazonaws.com

54.243.49.169 - ec2-54-243-49-169.compute-1.amazonaws.com

erkie.github.com

199.27.75.133

eternicode.github.com

199.27.75.133

facebook.github.com

199.27.75.133

fortawesome.github.com

199.27.75.133

gist.github.com

192.30.252.141 - gist.github.com

guides.github.com

199.27.75.133

h5bp.github.com

199.27.75.133

harvesthq.github.com

199.27.75.133

help.github.com

199.27.75.133

hexchat.github.com

199.27.75.133

hubot.github.com

199.27.75.133

ipython.github.com

199.27.75.133

janpaepke.github.com

199.27.75.133

jgilfelt.github.com

199.27.75.133

jobs.github.com

54.163.15.207 - ec2-54-163-15-207.compute-1.amazonaws.com

kangax.github.com

199.27.75.133

karlseguin.github.com

199.27.75.133

kouphax.github.com

199.27.75.133

learnboost.github.com

199.27.75.133

liferay.github.com

199.27.75.133

lloyd.github.com

199.27.75.133

mac.github.com

199.27.75.133

mapbox.github.com

199.27.75.133

matplotlib.github.com

199.27.75.133

mbostock.github.com

199.27.75.133

mdo.github.com

199.27.75.133

mindmup.github.com

199.27.75.133

mrdoob.github.com

199.27.75.133

msysgit.github.com

199.27.75.133

nativescript.github.com

199.27.75.133

necolas.github.com

199.27.75.133

nodeca.github.com

199.27.75.133

onedrive.github.com

199.27.75.133

pages.github.com

199.27.75.133

panrafal.github.com

199.27.75.133

parquet.github.com

199.27.75.133

pnts.github.com

199.27.75.133

raw.github.com

199.27.75.133

rg3.github.com

199.27.75.133

rosedu.github.com

199.27.75.133

schacon.github.com

199.27.75.133

scottjehl.github.com

199.27.75.133

shop.github.com

192.30.252.129 - github.com

shopify.github.com

199.27.75.133

status.github.com

184.73.218.119 - ec2-184-73-218-119.compute-1.amazonaws.com

107.20.225.214 - ec2-107-20-225-214.compute-1.amazonaws.com

thoughtbot.github.com

199.27.75.133

tomchristie.github.com

199.27.75.133

training.github.com

199.27.75.133

try.github.com

199.27.75.133

twbs.github.com

199.27.75.133

twitter.github.com

199.27.75.133

visualstudio.github.com

54.192.134.13 - server-54-192-134-13.syd1.r.cloudfront.net

54.230.135.112 - server-54-230-135-112.syd1.r.cloudfront.net

54.192.134.21 - server-54-192-134-21.syd1.r.cloudfront.net

54.230.134.194 - server-54-230-134-194.syd1.r.cloudfront.net

54.192.133.169 - server-54-192-133-169.syd1.r.cloudfront.net

54.192.133.193 - server-54-192-133-193.syd1.r.cloudfront.net

54.230.134.145 - server-54-230-134-145.syd1.r.cloudfront.net

54.240.176.208 - server-54-240-176-208.syd1.r.cloudfront.net

wagerfield.github.com

199.27.75.133

webcomponents.github.com

199.27.75.133

webpack.github.com

199.27.75.133

weheart.github.com

199.27.75.133

# Reverse DNS lookup on range 192.30.252.0/22

192.30.252.80 - ns1.github.com

192.30.252.81 - ns2.github.com

192.30.252.86 - live.github.com

192.30.252.87 - live.github.com

192.30.252.88 - live.github.com

192.30.252.97 - ops-lb-ip1.iad.github.com

192.30.252.98 - ops-lb-ip2.iad.github.com

192.30.252.128 - github.com

192.30.252.129 - github.com

192.30.252.130 - github.com

192.30.252.131 - github.com

192.30.252.132 - assets.github.com

192.30.252.133 - assets.github.com

192.30.252.134 - assets.github.com

192.30.252.135 - assets.github.com

192.30.252.136 - api.github.com

192.30.252.137 - api.github.com

192.30.252.138 - api.github.com

192.30.252.139 - api.github.com

192.30.252.140 - gist.github.com

192.30.252.141 - gist.github.com

192.30.252.142 - gist.github.com

192.30.252.143 - gist.github.com

192.30.252.144 - codeload.github.com

192.30.252.145 - codeload.github.com

192.30.252.146 - codeload.github.com

192.30.252.147 - codeload.github.com

192.30.252.148 - ssh.github.com

192.30.252.149 - ssh.github.com

192.30.252.150 - ssh.github.com

192.30.252.151 - ssh.github.com

192.30.252.152 - pages.github.com

192.30.252.153 - pages.github.com

192.30.252.154 - pages.github.com

192.30.252.155 - pages.github.com

192.30.252.156 - githubusercontent.github.com

192.30.252.157 - githubusercontent.github.com

192.30.252.158 - githubusercontent.github.com

192.30.252.159 - githubusercontent.github.com

192.30.252.192 - github-smtp2-ext1.iad.github.net

192.30.252.193 - github-smtp2-ext2.iad.github.net

192.30.252.194 - github-smtp2-ext3.iad.github.net

192.30.252.195 - github-smtp2-ext4.iad.github.net

192.30.252.196 - github-smtp2-ext5.iad.github.net

192.30.252.197 - github-smtp2-ext6.iad.github.net

192.30.252.198 - github-smtp2-ext7.iad.github.net

192.30.252.199 - github-smtp2-ext8.iad.github.net

192.30.253.1 - ops-puppetmaster1-cp1-prd.iad.github.com

192.30.253.2 - janky-nix101-cp1-prd.iad.github.com

192.30.253.3 - janky-nix102-cp1-prd.iad.github.com

192.30.253.4 - janky-nix103-cp1-prd.iad.github.com

192.30.253.5 - janky-nix104-cp1-prd.iad.github.com

192.30.253.6 - janky-nix105-cp1-prd.iad.github.com

192.30.253.7 - janky-nix106-cp1-prd.iad.github.com

192.30.253.8 - janky-nix107-cp1-prd.iad.github.com

192.30.253.9 - janky-nix108-cp1-prd.iad.github.com

192.30.253.10 - gw.internaltools-esx1-cp1-prd.iad.github.com

192.30.253.11 - janky-chromium101-cp1-prd.iad.github.com

192.30.253.12 - gw.internaltools-esx2-cp1-prd.iad.github.com

192.30.253.13 - github-mon2ext-cp1-prd.iad.github.net

192.30.253.16 - github-smtp2a-ext-cp1-prd.iad.github.net

192.30.253.17 - github-smtp2b-ext-cp1-prd.iad.github.net

192.30.253.23 - ops-bastion1-cp1-prd.iad.github.com

192.30.253.30 - github-slowsmtp1-ext-cp1-prd.iad.github.net

192.30.254.1 - github-lb3a-cp1-prd.iad.github.com

192.30.254.2 - github-lb3b-cp1-prd.iad.github.com

192.30.254.3 - github-lb3c-cp1-prd.iad.github.com

192.30.254.4 - github-lb3d-cp1-prd.iad.github.com

# Saving output csv file

# Done

Usage :

$ ./instarecon.py -v -s <shodan_key> -o ~/github.com.csv github.com 
# InstaRecon v0.1.0 - by Luis Teixeira (teix.co)
# Scanning 1/1 hosts
# Shodan key provided - <shodan_key>

# ____________________ Scanning github.com ____________________ #

# DNS lookups
[*] Domain: github.com

[*] IPs & reverse DNS: 
192.30.252.129 - github.com

[*] NS records:
ns4.p16.dynect.net
    204.13.251.16 - ns4.p16.dynect.net
ns3.p16.dynect.net
    208.78.71.16 - ns3.p16.dynect.net
ns2.p16.dynect.net
    204.13.250.16 - ns2.p16.dynect.net
ns1.p16.dynect.net
    208.78.70.16 - ns1.p16.dynect.net

[*] MX records:
ASPMX.L.GOOGLE.com
    74.125.203.26 - th-in-f26.1e100.net
ALT2.ASPMX.L.GOOGLE.com
    64.233.168.26 - oj-in-f26.1e100.net
ALT3.ASPMX.L.GOOGLE.com
    173.194.219.27 - ya-in-f27.1e100.net
ALT4.ASPMX.L.GOOGLE.com
    173.194.219.27 - ya-in-f27.1e100.net
ALT1.ASPMX.L.GOOGLE.com
    74.125.25.27 - pa-in-f27.1e100.net

# Whois lookups

[*] Whois domain:
Domain Name: github.com
Registry Domain ID: 1264983250_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.markmonitor.com
Registrar URL: http://www.markmonitor.com
Updated Date: 2015-01-08T04:00:18-0800
Creation Date: 2007-10-09T11:20:50-0700
Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700
Registrar: MarkMonitor, Inc.
Registrar IANA ID: 292
Registrar Abuse Contact Email: abusecomplaints@markmonitor.com
Registrar Abuse Contact Phone: +1.2083895740
Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)
Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)
Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)
Registry Registrant ID: 
Registrant Name: GitHub Hostmaster
Registrant Organization: GitHub, Inc.
Registrant Street: 88 Colin P Kelly Jr St, 
Registrant City: San Francisco
Registrant State/Province: CA
Registrant Postal Code: 94107
Registrant Country: US
Registrant Phone: +1.4157354488
Registrant Phone Ext: 
Registrant Fax: 
Registrant Fax Ext: 
Registrant Email: hostmaster@github.com
Registry Admin ID: 
Admin Name: GitHub Hostmaster
Admin Organization: GitHub, Inc.
Admin Street: 88 Colin P Kelly Jr St, 
Admin City: San Francisco
Admin State/Province: CA
Admin Postal Code: 94107
Admin Country: US
Admin Phone: +1.4157354488
Admin Phone Ext: 
Admin Fax: 
Admin Fax Ext: 
Admin Email: hostmaster@github.com
Registry Tech ID: 
Tech Name: GitHub Hostmaster
Tech Organization: GitHub, Inc.
Tech Street: 88 Colin P Kelly Jr St, 
Tech City: San Francisco
Tech State/Province: CA
Tech Postal Code: 94107
Tech Country: US
Tech Phone: +1.4157354488
Tech Phone Ext: 
Tech Fax: 
Tech Fax Ext: 
Tech Email: hostmaster@github.com
Name Server: ns2.p16.dynect.net
Name Server: ns1.p16.dynect.net
Name Server: ns4.p16.dynect.net
Name Server: ns3.p16.dynect.net
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2015-06-17T19:49:18-0700

[*] Whois IP for 192.30.252.129:
asn: 36459
asn_cidr: 192.30.252.0/24
asn_country_code: US
asn_date: 2012-11-15
asn_registry: arin
net 0:
    cidr: 192.30.252.0/22
    range: 192.30.252.0 - 192.30.255.255
    name: GITHUB-NET4-1
    description: GitHub, Inc.
    handle: NET-192-30-252-0-1

    address: 88 Colin P Kelly Jr Street
    city: San Francisco
    state: CA
    postal_code: 94107
    country: US

    abuse_emails: abuse@github.com
    tech_emails: hostmaster@github.com

    created: 2012-11-15 00:00:00
    updated: 2013-01-05 00:00:00

# Querying Shodan for open ports
[*] Shodan:
IP: 192.30.252.129
Organization: GitHub
ISP: GitHub

Port: 80
Banner: HTTP/1.1 301 Moved Permanently
    Content-length: 0
    Location: https://192.30.252.129/
    Connection: close
Port: 22
Banner: SSH-2.0-libssh-0.6.0
    Key type: ssh-rsa
    Key: AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PH
    kccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETY
    P81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoW
    f9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lG
    HSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
    Fingerprint: 16:27:ac:a5:76:28:2d:36:63:1b:56:4d:eb:df:a6:48

# Querying Google for subdomains and Linkedin pages, this might take a while
[*] Possible LinkedIn page: https://au.linkedin.com/company/github
[*] Subdomains:
ajaxorg.github.com
    103.245.222.133
    http://ajaxorg.github.com/ace/
almende.github.com
    103.245.222.133
    http://almende.github.com/chap-links-library/graph.html
    http://almende.github.com/chap-links-library/graph3d.html
benmmurphy.github.com
    103.245.222.133
    http://benmmurphy.github.com/blog/2015/06/09/redis-hot-patch
daid.github.com
    103.245.222.133
    http://daid.github.com/Cura/
designmodo.github.com
    103.245.222.133
    http://designmodo.github.com/Flat-UI/
devbootcamp.github.com
    103.245.222.133
    http://devbootcamp.github.com/
developer.github.com
    103.245.222.133
    https://developer.github.com/
    https://developer.github.com/guides/managing-deploy-keys/
    https://developer.github.com/program/
    https://developer.github.com/v3/
    https://developer.github.com/v3/oauth/
    https://developer.github.com/v3/repos/
education.github.com
    54.221.249.148 - ec2-54-221-249-148.compute-1.amazonaws.com
    54.243.102.92 - ec2-54-243-102-92.compute-1.amazonaws.com
    23.21.251.243 - ec2-23-21-251-243.compute-1.amazonaws.com
    https://education.github.com/
    https://education.github.com/pack
eightmedia.github.com
    103.245.222.133
    http://eightmedia.github.com/hammer.js/
enterprise.github.com
    54.225.131.5 - ec2-54-225-131-5.compute-1.amazonaws.com
    54.243.192.65 - ec2-54-243-192-65.compute-1.amazonaws.com
    https://enterprise.github.com/features
    https://enterprise.github.com/releases/2.1.8
    https://enterprise.github.com/releases/2.2.4
    https://enterprise.github.com/trial
eonasdan.github.com
    103.245.222.133
    https://eonasdan.github.com/bootstrap-datetimepicker/
eternicode.github.com
    103.245.222.133
    http://eternicode.github.com/bootstrap-datepicker/
exacttarget.github.com
    103.245.222.133
    http://exacttarget.github.com/fuelux/
fezvrasta.github.com
    103.245.222.133
    http://fezvrasta.github.com/bootstrap-material-design/bootstrap-elements.html
fgnass.github.com
    103.245.222.133
    http://fgnass.github.com/spin.js/
filosottile.github.com
    103.245.222.133
    http://filosottile.github.com/making-system-calls-from-assembly-in-mac-os-x/
firebase.github.com
    103.245.222.133
    http://firebase.github.com/
flightjs.github.com
    103.245.222.133
    http://flightjs.github.com/
fontforge.github.com
    103.245.222.133
    http://fontforge.github.com/
fortawesome.github.com
    103.245.222.133
    http://fortawesome.github.com/Font-Awesome/
    http://fortawesome.github.com/Font-Awesome/design.html
    http://fortawesome.github.com/Font-Awesome/examples/
    http://fortawesome.github.com/Font-Awesome/get-started/
    http://fortawesome.github.com/Font-Awesome/icons/
gabrielecirulli.github.com
    103.245.222.133
    http://gabrielecirulli.github.com/2048/
geonode.github.com
    103.245.222.133
    http://geonode.github.com/admin_features.html
gist.github.com
    192.30.252.140 - gist.github.com
    https://gist.github.com/
    https://gist.github.com/1508ca289f9ea71646a8
    https://gist.github.com/1600028
    https://gist.github.com/3b95f35d43284a29d25c
    https://gist.github.com/3lvis/9e15d42fa70092213802
    https://gist.github.com/501fa4653745f2190acd
    https://gist.github.com/881345d5d3d68e6fb2c2
    https://gist.github.com/AlastairTaft/d28b79e6523fe817be82
    https://gist.github.com/FoggyF/453bab43ed74d3a3cb1e
    https://gist.github.com/Garog/30183d5a0e93740e23fe
    https://gist.github.com/Indradwi22/0bbee88e032c1494bca0
    https://gist.github.com/RickDB/d2ed54937a5f821e709a
    https://gist.github.com/Sokng/68a182ce14445f3bbc6b
    https://gist.github.com/akisute/291170b50ad87ce95a47
    https://gist.github.com/athkalia/d50ecfaac0b4241c0bef
    https://gist.github.com/d8888a24a215a4ef8d92
    https://gist.github.com/davegomez/5510c9e0f8477d8e438e
    https://gist.github.com/dc0879952de9f344c984
    https://gist.github.com/dhimmel/7760d3eecb447972f836
    https://gist.github.com/dustymabe/ad4be48c948c2e601b85
    https://gist.github.com/eeeeeta/13ec3775a4253b2127ab
    https://gist.github.com/emepyc/a31e032f74df90328901
    https://gist.github.com/f3f69a377252cceac71f
    https://gist.github.com/fb39141ab30b1efa8048
    https://gist.github.com/fsjoyti/e0c259b4183d56aead74
    https://gist.github.com/fupfin/c354f8773fbbcc55124e
    https://gist.github.com/jessedc/837916
    https://gist.github.com/jmoore24/54ebc399546f4da567d7
    https://gist.github.com/jsanz/bcd7d6ae7f8e2c2ee3d7
    https://gist.github.com/jstefek/e6f72c8cee55f0daeb60
    https://gist.github.com/jvarellano/978623ef51b0bbdd00a4
    https://gist.github.com/langner/7820246
    https://gist.github.com/linc01n/29cf02c3c8d295776289
    https://gist.github.com/lucamartinetti/b64ad9daee266b368169
    https://gist.github.com/maddesigns/14acf2436b1432be1520
    https://gist.github.com/maslevx/d28547da804ba79776a4
    https://gist.github.com/mattsah/9198bb5d350c79af3c90
    https://gist.github.com/megabitus98/1b10d95c07d8a98bae4d
    https://gist.github.com/michaelerne/9801fb848cf46add74f8
    https://gist.github.com/michaelsarduino/67d0f793bcee34ffaea4
    https://gist.github.com/noelmace/94cdd8efc54e520a154f
    https://gist.github.com/pastokes/1b1b0c8f290db9cfec84
    https://gist.github.com/pescobar/5600555fa574017ecd26
    https://gist.github.com/philiprbrenan/d955a9c42edd5344353f
    https://gist.github.com/puffstream/be141e41e43a992360ae
    https://gist.github.com/rahatarmanahmed/48c7438f4a90ce122f3e
    https://gist.github.com/riririaan/2e215c397588a619cd4d
    https://gist.github.com/rmsr/d216c86f51ce34f48fa5
    https://gist.github.com/sarigopiram/540ed4a951fe4fc304ba
    https://gist.github.com/sensugaz/1f54678e0fb0285ad9b3
    https://gist.github.com/simonszu/21bf5b504fa18824eecf
    https://gist.github.com/srajagop/4c6d1fe0d887c8de4564
    https://gist.github.com/stephenpardy/c67db785da02e62a8d67
    https://gist.github.com/stevemart/585f932a5c526c375396
    https://gist.github.com/sutezo/38bb1474f5ce29c37dcc
    https://gist.github.com/terrycojones/2b18f23247903fd5213b
    https://gist.github.com/tpoechtrager/d0440d44592f48b099f8
    https://gist.github.com/tranthecoder/b163b64fdfa4bd79e4da
    https://gist.github.com/westernmonster/ea961d95e4689979a4f2
    https://gist.github.com/wjaspers/0919eeb89e0f378c9cdb
    https://gist.github.com/yhuang/435d7418da1b8f29b9a7
guides.github.com
    103.245.222.133
    https://guides.github.com/
    https://guides.github.com/features/mastering-markdown/
    https://guides.github.com/introduction/flow/
    https://guides.github.com/introduction/getting-your-project-on-github/
hanklords.github.com
    103.245.222.133
    http://hanklords.github.com/flickraw/
help.github.com
    103.245.222.133
    https://help.github.com/
    https://help.github.com/articles/adding-links-to-wikis/
    https://help.github.com/articles/be-social/
    https://help.github.com/articles/caching-your-github-password-in-git/
    https://help.github.com/articles/changing-a-remote-s-url/
    https://help.github.com/articles/configuring-a-remote-for-a-fork/
    https://help.github.com/articles/create-a-repo/
    https://help.github.com/articles/creating-pages-with-the-automatic-generator/
    https://help.github.com/articles/creating-releases/
    https://help.github.com/articles/fork-a-repo/
    https://help.github.com/articles/markdown-basics/
    https://help.github.com/articles/set-up-git/
    https://help.github.com/articles/syncing-a-fork/
    https://help.github.com/articles/user-organization-and-project-pages/
    https://help.github.com/articles/using-jekyll-with-pages/
    https://help.github.com/articles/using-pull-requests/
    https://help.github.com/articles/which-remote-url-should-i-use/
    https://help.github.com/articles/writing-on-github/
hubot.github.com
    103.245.222.133
    https://hubot.github.com/
    https://hubot.github.com/docs/
ipython.github.com
    103.245.222.133
    http://ipython.github.com/download.html
    http://ipython.github.com/ipython-doc
ivaynberg.github.com
    103.245.222.133
    http://ivaynberg.github.com/select2/
jakewharton.github.com
    103.245.222.133
    http://jakewharton.github.com/butterknife/
janpaepke.github.com
    103.245.222.133
    http://janpaepke.github.com/ScrollMagic
jgilfelt.github.com
    103.245.222.133
    http://jgilfelt.github.com/android-actionbarstylegenerator/
jobs.github.com
    54.163.15.207 - ec2-54-163-15-207.compute-1.amazonaws.com
    https://jobs.github.com/
    https://jobs.github.com/companies/Trustpilot
    https://jobs.github.com/positions
    https://jobs.github.com/positions%3Fdescription%3DJavaScript
    https://jobs.github.com/positions/1a5cf3c8-139b-11e5-9145-e1c5bb7ec7a9
    https://jobs.github.com/positions/aca57740-1374-11e5-92ea-f56b9efdc6a1
    https://jobs.github.com/positions/cd2fbdde-150b-11e5-90b9-4ee0ac71990f
    https://jobs.github.com/positions/db785c4e-1500-11e5-9251-0079eaacb490
    https://jobs.github.com/positions/f332ea88-1466-11e5-817e-61f408951a63
johnpolacek.github.com
    103.245.222.133
    http://johnpolacek.github.com/superscrollorama/
jsdoc3.github.com
    103.245.222.133
    http://jsdoc3.github.com/
kangax.github.com
    103.245.222.133
    http://kangax.github.com/compat-table/es7
    http://kangax.github.com/es5-compat-table/
karpathy.github.com
    103.245.222.133
    http://karpathy.github.com/2015/05/21/rnn-effectiveness/
mac.github.com
    103.245.222.133
    https://mac.github.com/
mapbox.github.com
    103.245.222.133
    http://mapbox.github.com/wax
matplotlib.github.com
    103.245.222.133
    http://matplotlib.github.com/api/pyplot_api.html
    http://matplotlib.github.com/api/pyplot_summary.html
    http://matplotlib.github.com/gallery.html
mbostock.github.com
    103.245.222.133
    http://mbostock.github.com/
    http://mbostock.github.com/d3/
    http://mbostock.github.com/d3/ex/choropleth.html
    http://mbostock.github.com/d3/ex/population.html
mdboom.github.com
    103.245.222.133
    http://mdboom.github.com/
mgcrea.github.com
    103.245.222.133
    http://mgcrea.github.com/angular-strap/
mrdoob.github.com
    103.245.222.133
    http://mrdoob.github.com/three.js/docs/
msysgit.github.com
    103.245.222.133
    http://msysgit.github.com/
mustache.github.com
    103.245.222.133
    http://mustache.github.com/
mxcl.github.com
    103.245.222.133
    http://mxcl.github.com/homebrew/
nltk.github.com
    103.245.222.133
    http://nltk.github.com/
nodeca.github.com
    103.245.222.133
    http://nodeca.github.com/fontomas/
novus.github.com
    103.245.222.133
    http://novus.github.com/nvd3
    http://novus.github.com/nvd3/ghpages/examples.html
onedrive.github.com
    103.245.222.133
    http://onedrive.github.com/
osxfuse.github.com
    103.245.222.133
    http://osxfuse.github.com/
pages.github.com
    103.245.222.133
    https://pages.github.com/
parquet.github.com
    103.245.222.133
    http://parquet.github.com/
paypal.github.com
    103.245.222.133
    http://paypal.github.com/
pcottle.github.com
    103.245.222.133
    http://pcottle.github.com/learnGitBranching/
pnts.github.com
    103.245.222.133
    http://pnts.github.com/look/happeh-canada-day
    http://pnts.github.com/look/on-stage
    http://pnts.github.com/quote/design-is
    http://pnts.github.com/quote/making-meaning
    http://pnts.github.com/txt/bower-sass-bones
    http://pnts.github.com/txt/color-mixing-with-sass
    http://pnts.github.com/txt/just-say-no-to-unicorns
racker.github.com
    103.245.222.133
    http://racker.github.com/falcon
raw.github.com
    103.245.222.133
    https://raw.github.com/git/git/master/Documentation/RelNotes/2.4.4.txt
    https://raw.github.com/olleota/themes/master/shade/main.html
    https://raw.github.com/pypa/pip/master/contrib/get-pip.py
rg3.github.com
    103.245.222.133
    http://rg3.github.com/youtube-dl/
    http://rg3.github.com/youtube-dl/download.html
rogerdudler.github.com
    103.245.222.133
    http://rogerdudler.github.com/git-guide/
shop.github.com
    192.30.252.128 - github.com
    https://shop.github.com/
    https://shop.github.com/products/invertocat-hoodie
    https://shop.github.com/products/piratocat-shirt
silviomoreto.github.com
    103.245.222.133
    http://silviomoreto.github.com/bootstrap-select/
sinatra.github.com
    103.245.222.133
    http://sinatra.github.com/intro.html
sorich87.github.com
    103.245.222.133
    http://sorich87.github.com/bootstrap-tour/
square.github.com
    103.245.222.133
    http://square.github.com/crossfilter/
    http://square.github.com/cubism/
    http://square.github.com/retrofit/
status.github.com
    107.20.225.214 - ec2-107-20-225-214.compute-1.amazonaws.com
    184.73.218.119 - ec2-184-73-218-119.compute-1.amazonaws.com
    https://status.github.com/
    https://status.github.com/messages
    https://status.github.com/messages/2015-05-24
swarmsim.github.com
    103.245.222.133
    https://swarmsim.github.com/
thehackerwithin.github.com
    103.245.222.133
    http://thehackerwithin.github.com/swinburne/posts/iPython_notebooks
tkf.github.com
    103.245.222.133
    http://tkf.github.com/emacs-ipython-notebook/
tomchristie.github.com
    103.245.222.133
    http://tomchristie.github.com/django-rest-framework/api-guide/serializers
training.github.com
    103.245.222.133
    http://training.github.com/p/branching.html
    https://training.github.com/
    https://training.github.com/kit/downloads/github-git-cheat-sheet.pdf
try.github.com
    103.245.222.133
    http://try.github.com/levels/1/challenges/11
    http://try.github.com/levels/1/challenges/12
    http://try.github.com/levels/1/challenges/16
    http://try.github.com/levels/1/challenges/20
    http://try.github.com/levels/1/challenges/24
    http://try.github.com/levels/1/challenges/25
    http://try.github.com/levels/1/challenges/4
    http://try.github.com/levels/1/challenges/9
    https://try.github.com/
    https://try.github.com/levels/1/challenges/2
twbs.github.com
    103.245.222.133
    http://twbs.github.com/bootstrap/
twitter.github.com
    103.245.222.133
    http://twitter.github.com/bootstrap/
    http://twitter.github.com/typeahead.js/
    http://twitter.github.com/typeahead.js/examples
visionmedia.github.com
    103.245.222.133
    http://visionmedia.github.com/superagent/
vitalets.github.com
    103.245.222.133
    http://vitalets.github.com/x-editable/
voidlinux.github.com
    103.245.222.133
    http://voidlinux.github.com/
wagerfield.github.com
    103.245.222.133
    http://wagerfield.github.com/parallax/
webcomponents.github.com
    103.245.222.133
    http://webcomponents.github.com/
webpack.github.com
    103.245.222.133
    http://webpack.github.com/docs
windows.github.com
    103.245.222.133
    https://windows.github.com/
yui.github.com
    103.245.222.133
    http://yui.github.com/yuicompressor/
zendesk.github.com
    103.245.222.133
    http://zendesk.github.com/

# Reverse DNS lookup on range 192.30.252.0/22
192.30.252.80 - ns1.github.com
192.30.252.81 - ns2.github.com
192.30.252.86 - live.github.com
192.30.252.87 - live.github.com
192.30.252.88 - live.github.com
192.30.252.97 - ops-lb-ip1.iad.github.com
192.30.252.98 - ops-lb-ip2.iad.github.com
192.30.252.128 - github.com
192.30.252.129 - github.com
192.30.252.130 - github.com
192.30.252.131 - github.com
192.30.252.132 - assets.github.com
192.30.252.133 - assets.github.com
192.30.252.134 - assets.github.com
192.30.252.135 - assets.github.com
192.30.252.136 - api.github.com
192.30.252.137 - api.github.com
192.30.252.138 - api.github.com
192.30.252.139 - api.github.com
192.30.252.140 - gist.github.com
192.30.252.141 - gist.github.com
192.30.252.142 - gist.github.com
192.30.252.143 - gist.github.com
192.30.252.144 - codeload.github.com
192.30.252.145 - codeload.github.com
192.30.252.146 - codeload.github.com
192.30.252.147 - codeload.github.com
192.30.252.148 - ssh.github.com
192.30.252.149 - ssh.github.com
192.30.252.150 - ssh.github.com
192.30.252.151 - ssh.github.com
192.30.252.152 - pages.github.com
192.30.252.153 - pages.github.com
192.30.252.154 - pages.github.com
192.30.252.155 - pages.github.com
192.30.252.156 - githubusercontent.github.com
192.30.252.157 - githubusercontent.github.com
192.30.252.158 - githubusercontent.github.com
192.30.252.159 - githubusercontent.github.com
192.30.252.192 - github-smtp2-ext1.iad.github.net
192.30.252.193 - github-smtp2-ext2.iad.github.net
192.30.252.194 - github-smtp2-ext3.iad.github.net
192.30.252.195 - github-smtp2-ext4.iad.github.net
192.30.252.196 - github-smtp2-ext5.iad.github.net
192.30.252.197 - github-smtp2-ext6.iad.github.net
192.30.252.198 - github-smtp2-ext7.iad.github.net
192.30.252.199 - github-smtp2-ext8.iad.github.net
192.30.253.1 - ops-puppetmaster1-cp1-prd.iad.github.com
192.30.253.2 - janky-nix101-cp1-prd.iad.github.com
192.30.253.3 - janky-nix102-cp1-prd.iad.github.com
192.30.253.4 - janky-nix103-cp1-prd.iad.github.com
192.30.253.5 - janky-nix104-cp1-prd.iad.github.com
192.30.253.6 - janky-nix105-cp1-prd.iad.github.com
192.30.253.7 - janky-nix106-cp1-prd.iad.github.com
[-] WARNING:Timeout resolving 192.30.253.8. Retrying.
192.30.253.8 - janky-nix107-cp1-prd.iad.github.com
192.30.253.9 - janky-nix108-cp1-prd.iad.github.com
192.30.253.10 - gw.internaltools-esx1-cp1-prd.iad.github.com
192.30.253.11 - janky-chromium101-cp1-prd.iad.github.com
192.30.253.12 - gw.internaltools-esx2-cp1-prd.iad.github.com
192.30.253.13 - github-mon2ext-cp1-prd.iad.github.net
192.30.253.16 - github-smtp2a-ext-cp1-prd.iad.github.net
192.30.253.17 - github-smtp2b-ext-cp1-prd.iad.github.net
192.30.253.23 - ops-bastion1-cp1-prd.iad.github.com
192.30.253.30 - github-slowsmtp1-ext-cp1-prd.iad.github.net
[-] WARNING:Timeout resolving 192.30.253.150. Retrying.
[-] WARNING:Timeout resolving 192.30.253.174. Retrying.
[-] WARNING:Timeout resolving 192.30.253.188. Retrying.
192.30.254.1 - github-lb3a-cp1-prd.iad.github.com
[-] WARNING:Timeout resolving 192.30.254.2. Retrying.
192.30.254.2 - github-lb3b-cp1-prd.iad.github.com
192.30.254.3 - github-lb3c-cp1-prd.iad.github.com
192.30.254.4 - github-lb3d-cp1-prd.iad.github.com
[-] WARNING:Timeout resolving 192.30.254.230. Retrying.
[-] WARNING:Timeout resolving 192.30.255.61. Retrying.
[-] WARNING:Timeout resolving 192.30.255.99. Retrying.
[-] WARNING:Timeout resolving 192.30.255.136. Retrying.
[-] WARNING:Timeout resolving 192.30.255.174. Retrying.
[-] WARNING:Timeout resolving 192.30.255.211. Retrying.
[-] WARNING:Timeout resolving 192.30.255.247. Retrying.
# Saving output csv file
# Done

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

$ ./instarecon.py -v -s <shodan_key> -o ~/github.com.csv github.com

# InstaRecon v0.1.0 - by Luis Teixeira (teix.co)

# Scanning 1/1 hosts

# Shodan key provided - <shodan_key>

# ____________________ Scanning github.com ____________________ #

# DNS lookups

[*] Domain: github.com

[*] IPs & reverse DNS:

192.30.252.129 - github.com

[*] NS records:

ns4.p16.dynect.net

204.13.251.16 - ns4.p16.dynect.net

ns3.p16.dynect.net

208.78.71.16 - ns3.p16.dynect.net

ns2.p16.dynect.net

204.13.250.16 - ns2.p16.dynect.net

ns1.p16.dynect.net

208.78.70.16 - ns1.p16.dynect.net

[*] MX records:

ASPMX.L.GOOGLE.com

74.125.203.26 - th-in-f26.1e100.net

ALT2.ASPMX.L.GOOGLE.com

64.233.168.26 - oj-in-f26.1e100.net

ALT3.ASPMX.L.GOOGLE.com

173.194.219.27 - ya-in-f27.1e100.net

ALT4.ASPMX.L.GOOGLE.com

173.194.219.27 - ya-in-f27.1e100.net

ALT1.ASPMX.L.GOOGLE.com

74.125.25.27 - pa-in-f27.1e100.net

# Whois lookups

[*] Whois domain:

Domain Name: github.com

Registry Domain ID: 1264983250_DOMAIN_COM-VRSN

Registrar WHOIS Server: whois.markmonitor.com

Registrar URL: http://www.markmonitor.com

Updated Date: 2015-01-08T04:00:18-0800

Creation Date: 2007-10-09T11:20:50-0700

Registrar Registration Expiration Date: 2020-10-09T11:20:50-0700

Registrar: MarkMonitor, Inc.

Registrar IANA ID: 292

Registrar Abuse Contact Email: abusecomplaints@markmonitor.com

Registrar Abuse Contact Phone: +1.2083895740

Domain Status: clientUpdateProhibited (https://www.icann.org/epp#clientUpdateProhibited)

Domain Status: clientTransferProhibited (https://www.icann.org/epp#clientTransferProhibited)

Domain Status: clientDeleteProhibited (https://www.icann.org/epp#clientDeleteProhibited)

Registry Registrant ID:

Registrant Name: GitHub Hostmaster

Registrant Organization: GitHub, Inc.

Registrant Street: 88 Colin P Kelly Jr St,

Registrant City: San Francisco

Registrant State/Province: CA

Registrant Postal Code: 94107

Registrant Country: US

Registrant Phone: +1.4157354488

Registrant Phone Ext:

Registrant Fax:

Registrant Fax Ext:

Registrant Email: hostmaster@github.com

Registry Admin ID:

Admin Name: GitHub Hostmaster

Admin Organization: GitHub, Inc.

Admin Street: 88 Colin P Kelly Jr St,

Admin City: San Francisco

Admin State/Province: CA

Admin Postal Code: 94107

Admin Country: US

Admin Phone: +1.4157354488

Admin Phone Ext:

Admin Fax:

Admin Fax Ext:

Admin Email: hostmaster@github.com

Registry Tech ID:

Tech Name: GitHub Hostmaster

Tech Organization: GitHub, Inc.

Tech Street: 88 Colin P Kelly Jr St,

Tech City: San Francisco

Tech State/Province: CA

Tech Postal Code: 94107

Tech Country: US

Tech Phone: +1.4157354488

Tech Phone Ext:

Tech Fax:

Tech Fax Ext:

Tech Email: hostmaster@github.com

Name Server: ns2.p16.dynect.net

Name Server: ns1.p16.dynect.net

Name Server: ns4.p16.dynect.net

Name Server: ns3.p16.dynect.net

DNSSEC: unsigned

URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/

>>> Last update of WHOIS database: 2015-06-17T19:49:18-0700

[*] Whois IP for 192.30.252.129:

asn: 36459

asn_cidr: 192.30.252.0/24

asn_country_code: US

asn_date: 2012-11-15

asn_registry: arin

net 0:

cidr: 192.30.252.0/22

range: 192.30.252.0 - 192.30.255.255

name: GITHUB-NET4-1

description: GitHub, Inc.

handle: NET-192-30-252-0-1

address: 88 Colin P Kelly Jr Street

city: San Francisco

state: CA

postal_code: 94107

country: US

abuse_emails: abuse@github.com

tech_emails: hostmaster@github.com

created: 2012-11-15 00:00:00

updated: 2013-01-05 00:00:00

# Querying Shodan for open ports

[*] Shodan:

IP: 192.30.252.129

Organization: GitHub

ISP: GitHub

Port: 80

Banner: HTTP/1.1 301 Moved Permanently

Content-length: 0

Location: https://192.30.252.129/