hacking contest

hacking exploits security forum
hacking
compliance articles
upgrade backup exec
information security consultant

Killaloop
I finally got time to learn coding. started with C++ and Perl 2 days ago. Today I wrote a little script which I always googled for, but never found.
It filters IPs out of a file and writes it back to a new file. Needs some improvement. Just an example but working well (also it doesn't validate the ip).

feel free to show me a better way with perl:

#!/usr/bin/perl -w

$words = ("");
open(INPUT, "<input.txt") || "input.txt not found\n";
open(OUTPUT, ">output.txt") || "Error creating file\n";
chomp(@input = <INPUT>);
$count = 0;

foreach(<@input>)
{
push(@Lines, $_);
}
close(INPUT);

print "\nSearching for IPs: \n\n";
foreach(@Lines)

{
$words++;

if(/^([12]?\d?\d\.){3}[12]?\d?\d$/)

{
print OUTPUT "$_\n";
print "$_\n";
$count++
}

}

if ($count ne '0') {
print "\nFound $count IPs: \n\n";
}
else {
print "\nNo IPs found or file too big: \n\n";
}
print "File has $words words\n" if ($words > 0);

close(OUTPUT);
Thom
Looks good to me but I dont need it atm, good job though.
fivestar
hy i cant make it to exe?
By me it failes the p2x561.dll???
Explained me.

buzzons
u dont compile to an exe
u save it as a PL script and run it in command line

buz
starsky32
Well I made a tool like that but there's a 'long' time and I have 'lost' the source (but if I a have, let's say, 2 or 3 hours of free time I will try to find it...erf)

It's a very simple console tool (4.65 Ko), the only one option is the full path name of the text file, and it display all valid IP founded in the file. You can of course redirect the output to an other text file like that

IPretr text.txt > results.txt

If you can find it usefull...

Starsky32

** Edited: Well not found the source yet, but I found a second version, after searching a bit I found what it was (lol). I remember I found a bug and sometimes some ip were missed. I corrected this little bug in the second version. So I replaced the attachment with the corrected one, sorry for the inconvenient, this version is 100% ok.
poerkel
Nice app, simple and effective wink.gif
fivestar
Thx, makes simpler some things.
Burner
Whieeee works like a charm

greetz
Jurojin
Nice work thanks dude I have looked for something like this before with no luck.
manu
Nice work Killaloop. Must be helpful to many friends here, Thanks a lot.

Manu biggrin.gif
Killaloop
did it all for learning and its really useful.
here is an updated version for bigger logfiles (tested 20mb text file which filtered in 2secs). For bigger files holding everything in one aray is to much so I splitted the filtering process. works nice and speedy on any big files.

#!/usr/bin/perl -w

open(INPUT, "<input.txt") || "input.txt not found\n";
open(OUTPUT, ">output.txt") || "Error creating file\n";
$count = 0;
@input = <INPUT>;

print "\nSearching for IPs: \n\n";
foreach(@input)
{
if(/\b[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\b/)

{
push(@Lines, $_);
}
}
foreach(<@Lines>)
{
if(/\b[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\b/)

{
$count++;
print OUTPUT "$_\n";
print "$_\n";
}
}
close(INPUT);
if ($count ne '0')
{
print "\nFound $count IPs \n\n";
}
else {
print "\nNo IP found \n\n";
}
close(OUTPUT);
Killaloop
oh and for those of you not knowing .. no need to make an exe with it. install active perl copy the code into a pl file in run it from commandline.
on windows you should get two warning because of constants which are needed for *nix only.
ps: it filters big files much faster than grep smile.gif
Uli
find "192.168" c:\scan.txt>>result.txt

FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]

/V Displays all lines NOT containing the specified string.
/C Displays only the count of lines containing the string.
/N Displays line numbers with the displayed lines.
/I Ignores the case of characters when searching for the string.
/OFF[LINE] Do not skip files with offline attribute set.
"string" Specifies the text string to find.
[drive:][path]filename


No broken balls smile.gif
Killaloop
QUOTE (Uli @ May 26 2004, 02:11 PM)
find "192.168" c:\scan.txt>>result.txt

FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]

/V Displays all lines NOT containing the specified string.
/C Displays only the count of lines containing the string.
/N Displays line numbers with the displayed lines.
/I Ignores the case of characters when searching for the string.
/OFF[LINE] Do not skip files with offline attribute set.
"string" Specifies the text string to find.
[drive:][path]filename


No broken balls smile.gif

?
and what does this do to filter ips?
nothing because you search for a specific range in the file.
with the perl script you filter ANY ip out of a file regardles if its 22.22.22.2 or 11.11.11.1
good to filter ips out of firewall or webserver logs .. or any other file

next time read what I write about my scripts please
Miserly
could somebody of you also make a script/exe filtering
ip:port
and
ip port
out of a file?
this would be great, cause there are a few lists in this format in the proxy listings.

but the current tools sure aren't bad if you have scan results with extra data you dotn need smile.gif

with ipretr i have a few problems, often gives me something like 0.0.x.x!
the other i haven't tried until now...
and at my one list with 102 entries it seems somehow to stop i think...
Killaloop
QUOTE (Miserly @ May 26 2004, 02:57 PM)
could somebody of you also make a script/exe filtering
ip:port
and
ip port
out of a file?
this would be great, cause there are a few lists in this format in the proxy listings.

but the current tools sure aren't bad if you have scan results with extra data you dotn need smile.gif

with ipretr i have a few problems, often gives me something like 0.0.x.x!
the other i haven't tried until now...
and at my one list with 102 entries it seems somehow to stop i think...

use my last script for bigger lists. have designed it for it because other tools hold everything in one array which gets full when lists are too big causing the filtering to fail or to filter strange things
for your request I didn't understand it quite well.
you want a script to translate IP:PORT to IP PORT
or do you want a script that filters IP:PORT and IP PORT out of any textfile?
explain it alittle and I will write it tomorrow
Miserly
QUOTE
you want a script that filters IP:PORT and IP PORT out of any textfile?

yes, exactly that, such a script would be nice, thanks in advance smile.gif
by the way, i can't understand waht you didn't understand at my post?
QUOTE
could somebody of you also make a script/exe filtering
ip:port
and
ip port
out of a file?

but doesn't matter anything now wink.gif

i'll also try your script when i need it, currently i'm only in need of one filtering ip:port and ip port smile.gif

translating ip:port to ip port or the other way round would be easy with php.
ok, the other one also wouldn't be so hard, but didn't really learn regex until now \:
Uli
QUOTE (Killaloop @ May 26 2004, 02:19 PM)
QUOTE (Uli @ May 26 2004, 02:11 PM)
find "192.168" c:\scan.txt>>result.txt

FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]

  /V        Displays all lines NOT containing the specified string.
  /C        Displays only the count of lines containing the string.
  /N        Displays line numbers with the displayed lines.
  /I        Ignores the case of characters when searching for the string.
  /OFF[LINE] Do not skip files with offline attribute set.
  "string"  Specifies the text string to find.
  [drive:][path]filename


No broken balls smile.gif

?
and what does this do to filter ips?
nothing because you search for a specific range in the file.
with the perl script you filter ANY ip out of a file regardles if its 22.22.22.2 or 11.11.11.1
good to filter ips out of firewall or webserver logs .. or any other file

next time read what I write about my scripts please

LOL just do find "*.*.*.*" c:\scan.txt>>result.txt

"next time read what I write about my scripts please"

Chill out dude, i bet no one uses that method and it would have saved you a lot of time.. just sharing my 2c. Keep your atitude away, no need.


daguilar01
QUOTE (Miserly @ May 26 2004, 07:57 AM)
could somebody of you also make a script/exe filtering
ip:port
and
ip port
out of a file?
this would be great, cause there are a few lists in this format in the proxy listings.

but the current tools sure aren't bad if you have scan results with extra data you dotn need smile.gif

with ipretr i have a few problems, often gives me something like 0.0.x.x!
the other i haven't tried until now...
and at my one list with 102 entries it seems somehow to stop i think...

im not sure if i completely undrestand you, but i think what you want to do is grab a list of proxies that arei n this format
QUOTE
123.124.125.126:8080
123.124.125.126:8080
123.124.125.126:8080
123.124.125.126:8080
123.124.125.126:8080
123.124.125.126:8080

and put it into this format
QUOTE
123.124.125.126 8080
123.124.125.126 8080
123.124.125.126 8080
123.124.125.126 8080
123.124.125.126 8080
123.124.125.126 8080

if so, this would do that
for /f "tokens=1-3 delims=:" %%a, in (proxy.txt) do echo %%a %%b >> seperate.txt
although i dont see why oyu wouldnt open up the txt file in notepad and repalce the : with a space?
or maybe i misunderstood?
Killaloop
QUOTE (Uli @ May 26 2004, 09:19 PM)
QUOTE (Killaloop @ May 26 2004, 02:19 PM)
QUOTE (Uli @ May 26 2004, 02:11 PM)
find "192.168" c:\scan.txt>>result.txt

FIND [/V] [/C] [/N] [/I] [/OFF[LINE]] "string" [[drive:][path]filename[ ...]]

  /V         Displays all lines NOT containing the specified string.
  /C         Displays only the count of lines containing the string.
  /N         Displays line numbers with the displayed lines.
  /I         Ignores the case of characters when searching for the string.
  /OFF[LINE] Do not skip files with offline attribute set.
  "string"   Specifies the text string to find.
  [drive:][path]filename


No broken balls smile.gif

?
and what does this do to filter ips?
nothing because you search for a specific range in the file.
with the perl script you filter ANY ip out of a file regardles if its 22.22.22.2 or 11.11.11.1
good to filter ips out of firewall or webserver logs .. or any other file

next time read what I write about my scripts please

LOL just do find "*.*.*.*" c:\scan.txt>>result.txt

"next time read what I write about my scripts please"

Chill out dude, i bet no one uses that method and it would have saved you a lot of time.. just sharing my 2c. Keep your atitude away, no need.


my friend if someone talks BS about something I will tell him that its BS what he talks. find doesn't support wildcards nor regex. so "*.*.*.*" is not working because it will look for *.*.*.* in the text file with its real meaning and not as wildcard.
and also find only filters lines and not singe expressions like my script
find will put out "My IP is 11.11.11.11 and all belongs to me" as result and not only 11.11.11.11.
I hate it when people put their shit onto me.
Killaloop
QUOTE
if so, this would do that
for /f "tokens=1-3 delims=:" %%a, in (proxy.txt) do echo %%a %%b >> seperate.txt
although i dont see why oyu wouldnt open up the txt file in notepad and repalce the : with a space?
or maybe i misunderstood?


nope he want's a filtering script like this ip filter but to support the ports aswell.
he said he could have made a translator script for IP:PORT to IP PORT on his own but he needs a filter for any text file to get ip:port out
will start now.
Killaloop
for Miserly hope this is what you want.
filters a list with IP:PORT or IP PORT into IP:PORT format.
usage: port.pl <textfile to filter>


#!/usr/bin/perl -w
#
# portfilter.pl
#
# Filters IP/PORT list from IP:PORT or IP PORT
# into IP:PORT format.
# usage: portfilter.pl <inputfile>

die "Usage: $0 List" if (@ARGV!=1);
open( INPUT, $ARGV[0] ) || die "Can't open file : $!\n";
open(OUTPUT, ">output.txt" );
chomp (@input = <INPUT>);

foreach(@input)
{

if(/\b[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9][ ][0-9]/)

{
push(@form1, $_);
}

elsif(/\b[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9][:][0-9]/)
{
push(@form2, $_);
}
}


close( INPUT );

foreach $form1( @form1 ) {
@parts = split( " ", $form1 );
print OUTPUT "$parts[0]:$parts[1]\n";
}

foreach $form2( @form2 ) {
@partsForm2 = split( ":", $form2 );
print OUTPUT "$partsForm2[0]:$partsForm2[1]\n";
}
close (OUTPUT);
Miserly
@daguilar01:
yes, you missunderstood me wink.gif

@Killaloop:
thx for your script, i'll give it a try later this day! smile.gif

----
edit:
@killaloop:
installed active perl, started it like described with portlist.pl file.txt
so far it works fine, no errors, also gives me output.txt, but here's the problem:

source
QUOTE
501 216.20.117.82:8000 Anonymous 26/7/2003
502 212.7.178.94:8080 Anonymous 26/7/2003
503 212.244.219.21 Anonymous 26/7/2003
504 212.244.219.21:80 Anonymous 26/7/2003
505 proxy-server.711.net:81 Anonymous 26/7/2003
506 proxy-server.711.net:8080 Anonymous 26/7/2003
507 proxy.unionbankph.com:80 Normal 26/7/2003
508 213.190.128.110:80 Normal 26/7/2003
509 168.160.11.11:80 Normal 26/7/2003
510 210.103.80.11 Normal 26/7/2003
511 213.213.71.100 Normal 26/7/2003
512 213.213.71.100:80 Normal 26/7/2003
513 65.215.199.47:80 Normal 26/7/2003


result
QUOTE
501 216.20.117.82:8000 Anonymous 26/7/2003
502 212.7.178.94:8080 Anonymous 26/7/2003
504 212.244.219.21:80 Anonymous 26/7/2003
508 213.190.128.110:80 Normal 26/7/2003
509 168.160.11.11:80 Normal 26/7/2003
512 213.213.71.100:80 Normal 26/7/2003
513 65.215.199.47:80 Normal 26/7/2003


it filters the lines with ip:port, but then it puts out the whole lines, what i ment was, that it outputs ip:port.
second problem (hmm bad thats a little bit more difficult i think and my error, didn't mentioned it): hostname:port or hostname port \:

could you change it, so that it simply outputs ip:port (when it found ip:port or ip port in a line).
hostname is a little bit more difficult i think, or do you maybe have a goog idea for this? wink.gif
Killaloop
I can do this without problem...with one needed condition. it will only work for IP:PORT or IP, but not for IP PORT. because I have to remove the spaces in order to make it work...
if you need the IP PORT format I have to filter complete lines (like I did now) or make a more exact match for the type of input file which wont work for anyother fileformat then.
hope you understood:

source:
501 216.20.117.82:8000 Anonymous 26/7/2003
502 212.7.178.94:8080 Anonymous 26/7/2003
503 212.244.219.21 Anonymous 26/7/2003
504 212.244.219.21:80 Anonymous 26/7/2003
505 proxy-server.711.net:81 Anonymous 26/7/2003

output:
216.20.117.82:8000
212.7.178.94:8080
212.244.219.21
212.244.219.21:80
proxy-server.711.net:81

if your source looks like this:

501 216.20.117.82 8000 Anonymous 26/7/2003
502 212.7.178.94 8080 Anonymous 26/7/2003
it will fail btw I would have to output it in the same format meaning IP PORT and couldn't output IP:PORT
Miserly
if you could one script that does
QUOTE
source:
501 216.20.117.82:8000 Anonymous 26/7/2003
502 212.7.178.94:8080 Anonymous 26/7/2003
503 212.244.219.21 Anonymous 26/7/2003
504 212.244.219.21:80 Anonymous 26/7/2003
505 proxy-server.711.net:81 Anonymous 26/7/2003

output:
216.20.117.82:8000
212.7.178.94:8080
212.244.219.21
212.244.219.21:80
proxy-server.711.net:81


would help me very much smile.gif

QUOTE
if your source looks like this:

501 216.20.117.82 8000 Anonymous 26/7/2003
502 212.7.178.94 8080 Anonymous 26/7/2003
it will fail btw I would have to output it in the same format meaning IP PORT and couldn't output IP:PORT

if you could make a script that outputs ip port i would simply replace the spaces (if there are no spaces behind port or so) or do the rest (adding port) with a simple php script.
woulb be really nice of you if you could do both (think for the second you only have to modify it a little bit and not to rewrite the whole script, don't you?)

thx in advance! smile.gif
Killaloop
for the first part I'm almost done.
one question what the default port with that proxy scanning tool
I mean if you have IP without port whats the port where the proxy listens? so I can add it to the output
Miserly
QUOTE (Killaloop @ May 27 2004, 11:27 AM)
for the first part I'm almost done.
one question what the default port with that proxy scanning tool
I mean if you have IP without port whats the port where the proxy listens? so I can add it to the output

i'm currently using the lists of the proxy listing forum, normally there's a port in it, if not i can add them with a simple php script or with ultraedit, thats no problem!
(so i need the port of the list)
Killaloop
ok
there you go. I made the script the way that you can add a default port into it for those IPs where no port is specified so you don't need to write a php script.
test it if it is working right.

#!/usr/bin/perl -w
# ProxyList filter

die "Usage: $0 List" if (@ARGV!=1);
open( INPUT, $ARGV[0] ) || die "Can't open file : $!\n";
open(OUTPUT, ">output.txt" );
chomp (@input = <INPUT>);
$DefaultPort = 8080; #edit this to your needs


foreach(<@input>)
{

if(/^[a-zA-Z0-9_\.\-]+\.[a-zA-Z0-9\-\.]+:[0-9]/)

{
print OUTPUT "$_\n";
}

elsif(/^[a-zA-Z0-9_\.\-]+\.[a-zA-Z0-9\-\.]+$/)
{
print OUTPUT "$_:$DefaultPort\n";
}


}

close( INPUT );
close (OUTPUT);
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.