Package: orgia
orgiaUse RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.Useful for conducting Recon on a big Organisation.For example, after running orgia the OG way on "Hilton", I got96436v4 IPs.InstallationpipxGlobal installation:pipxinstallgit+https://github.com/sttlr/orgia
orgia-hOr run without installing:pipxrun--specgit+https://github.com/sttlr/orgiaorgia-hDockergitclonehttps://github.com/sttlr/orgiacdorgiadockerbuild-torgia.
dockerrun--rmorgia-hUsageusage: orgia [-h] [--org ORG_NAME] [--version] [--silent] [--debug] [-c PATH] [--sources SOURCE]
             [--orgs-input-file PATH] [--asns-input-file PATH] [--networks-input-file PATH]
             [--max-enrich] [-o PATH] [--adjacent]
             [--orgs | --asns | --networks | --cidrs | --export-all PATH] [--jsonl] [--ip4-only]

Use RDAP and WHOIS to find ASNs, Networks, and CIDRs about Organisations.

options:
  -h, --help            show this help message and exit
  --org ORG_NAME        organization name (ex. "Hilton")
  --version             show program's version number and exit
  --silent              display results only (useful for piping to jq)
  --debug               print debug info
  -c PATH, --config PATH
                        path to .yaml config file
  --sources SOURCE      comma separated, possible values: all (default), arin, ripe, apnic,
                        afrinic, lacnic
  --orgs-input-file PATH
                        path to input file with Organisation handles
  --asns-input-file PATH
                        path to input file with ASN handles
  --networks-input-file PATH
                        path to input file with Network handles
  --max-enrich          use level 2 when trying to bruteforce entity name
  -o PATH, --output PATH
                        path to output file (default stdout)
  --adjacent            parse adjacent (dirty): ASNs from Orgs and Orgs from Networks
  --orgs                show only Organisation handles in output
  --asns                show only ASNs in output
  --networks            show only Network handles in output
  --cidrs               show only CIDRs in output
  --export-all PATH     folder to export everything
  --jsonl               show output in jsonl formal
  --ip4-only            show only IPv4 networks in output

by sttlrQuickGet CIDRs for specified Orgname:orgia--orgORGNAME--cidrsEnrichedTry even more enriched Orgnames when searching.orgia--orgORGNAME--max-enrich--cidrsResolve onlyIf you have input files with handles, pass them via--asns-input-file,--orgs-input-file,--networks-input-fileand orgia will resolve them for you:orgia--asns-input-fileORGNAME_asn_handles.txt\--orgs-input-fileORGNAME_org_handles_.txt\--networks-input-fileORGNAME_networks_handles.txtYou can combine it with any of the output options:--cidrs,--orgs,--asns,--networks,--export-allSpecificSelect sourceChoose source (arin, ripe, apnic, afrinic, lacnic) - default "all":orgia--orgORGNAME--sourcesripe,arinIPv4 onlyDon't print IPv6 Networks/CIDRs in the output:orgia--orgORGNAME--ip4-only--cidrsPipe to jqBy default, orgia prints handles only (for--orgs,--asns,--networks).You can pass--jsonlto use JSON as the output format. When piping tojqalso use--silent:orgia--orgORGNAME--asns--silent--jsonl|jqUse configWhitelist or blacklist handles, names, emails in output.When checking, input is lowercased andinis used for comparison (checks if a config stringina test string).You can create a config file and pass it via--configoption:orgia--orgORGNAME--cidrs--configPATH_TO_CONFIG.yamlEmpty config looks like this:orgs:whitelist-handles:[]blacklist-handles:[]whitelist-names:[]blacklist-names:[]whitelist-emails:[]blacklist-emails:[]asns:whitelist-handles:[]blacklist-handles:[]whitelist-names:[]blacklist-names:[]whitelist-emails:[]blacklist-emails:[]networks:whitelist-handles:[]blacklist-handles:[]whitelist-names:[]blacklist-names:[]whitelist-emails:[]blacklist-emails:[]OGComprehensive.Create handle input files viaorg_info- parse directly from RIPE, APNIC, AfriNIC WHOIS databases:./bin/query_asnORGNAME>ORGNAME_asns_from_org_info.txt
./bin/query_orgORGNAME>ORGNAME_orgs_from_org_info.txt
./bin/query_inetnumORGNAME>ORGNAME_networks_from_org_info.txtThen run the OG:orgia--orgORGNAME\--sourcesall\--max-enrich\--asns-input-fileORGNAME_asns_from_org_info.txt\--orgs-input-fileORGNAME_orgs_from_org_info.txt\--networks-input-fileORGNAME_networks_from_org_info.txt\--export-allorgia_ORGNAME_export\--configorgia_ORGNAME_config.yamlFolder with results (orgia_ORGNAME_export) will contain:cidrs.txt- list of all CIDRsasns.jsonl- ASN info in JSONL formatorgs.jsonl- Organisation info in JSONL formatnetworks.jsonl- Network info in JSONL formatAdjacent mode (dirty)You can use--adjacentoption, to also extract ASNs from Orgs and Orgs from Networks.
NOTE: It's dirty, and will result in lots of trash results.APIYou can import orgia as a package to use it in your scripts:fromorgia.nicsimportRIPE,ARIN,LACNIC,APNIC,AFRINICOr low-level:fromorgia.nicsimportRDAP,EngineNOTE: orgia isn't designed to be used this way.TODOPull requests are welcome ;)Implement Async viahttpx.AsyncClient()Improve upon developer API - get rid ofargsargument when creating a classAdd more options in a config file