research Archives - Shabinx.com

March 28, 2019June 4, 2019

How to use Maxmind GeoLite2 to obtain GeoIP data from the command line

Today let’s talk about how to use Maxmind’s Geolite2 to get geoip data from the command line in Linux. This post is an update to the original “using GeoIP data from the command line” post from September. Maxmind GeoLite legacy databases were discontinued on January 2, 2019 and have moved to the new GeoLite2 format and makes the original article obsolete. The new format requires new tools and scripts so I will treat it as a new article from a technical perspective, however the practical use is still the same from a security analyst’s perspective. So let’s dive right in and get the new format setup and ready to use.

March 25, 2019June 4, 2019

Use a SSH tunnel to hide your true IP address

It is important to hide your true IP address when performing open source research or an investigation so no one is the wiser, but how can you do this? The simple solution is to setup a SSH tunnel and tunnel your traffic through the non attributable system you built. The non attributable VPS is an important tool in any security analysts kit and in this example we will use it for a jump point so we can hide our true location.

September 9, 2018June 4, 2019

Using GeoIP data from the command line

Today’s topic is using GeoIP data from the command line. Security analysts often find they need to ascertain an IP addresses geographic location in order to make decisions. The most obvious use would be around geofencing, i.e. blocking IP’s from certain countries or regions. GeoIP information is simple to acquire from the Linux command line with the tool geoiplookup and the Maxmind dat files. Here is an updated post and video on how to use Maxmind’s GeoLite2 database. How to use GeoLite2 on the command line.