Site hosted by Angelfire.com: Build your free website today!
logo
Discovery Modules

    Discover modules are used to discover hosts or networks using passive and/or active techniques. For example, you can get a complete list of IP addresses in your range with the module arping.

The following is a complete listing of discover modules.  Please not that as of the 0.0.6 release, not all modules are implemented.
hostname Get the host's name
netcraft Query the netcraft database
isnated Check if the target's port is NATed
ipaddr Get the host's IP address
getmac Get the host's MAC address
ispromisc Check if the target is in promiscous mode
arping Send an ARP who has message to discover hosts
externip Get your external IP address (even when using proxies)
ping Ping a host
whois Query whois databse
trace Trace a route to a host(s)
Please note that at any time these modules can be displayed from the Inguma prompt by using show discover

Discovery Module Usage
hostname - Resolves the hostname with a simple call to gethostbyaddr
Example Usage:
inguma> target = "127.0.0.1"
inguma> hostname
('localhost', [], ['127.0.0.1'])


netcraft - Queries the netcraft database.
Example Usage:
inguma> target = "www.google.com"
inguma> netcraft
Netcraft database information

Site: http://www.google.com
Last reboot: unknown
Domain: google.com
Netblock owner: Google Inc.
IP address: 66.102.9.147
Site rank:
Country: US
Nameserver: ns1.google.com
Date first seen: November 1998
DNS admin: dns-admin@google.com
Domain Registry: markmonitor.com
Reverse DNS: lm-in-f147.google.com
Organisation: Google Inc., 94043, United States
Nameserver Organisation: Google Inc., 94043, United States
Check another site:: Netcraft Site Report Gadget


isnated - Check if any of the opened ports at the target is NATed. The module counts the number of packets needed to reach one host's port by changing the TTL.
Example Usage:
inguma> target = "www.xxxxx.yyy"
inguma> port = 80
inguma> isnated
Hops to host (ICMP) www.xxxxx.yyy 18 to port (TCP) 80 14
Port 80 is NATed


ipaddr - Resolve the IP address of a given a hostname.
Example Usage:
inguma> target = "www.google.com"
inguma> ipaddr
72.14.205.104


getmac - Gets the target's MAC address using getmacbyip.
Example Usage:
Not currently supported in the 0.0.6 release

ispromisc - Checks to see if the target is in promiscous mode.
Example Usage:
inguma> target = "192.168.11.3"
inguma> ispromisc
False


arping - Send arp "who has" messages to the broadcast address to discover hosts in a network segment.
Example Usage:
inguma> target = "192.168.1.0/24"
inguma> arping
Adding to discovered hosts 192.168.1.1
Adding to discovered hosts 192.168.1.12

List of discovered hosts
00:XX:XX:XX:XX:XX 192.168.1.1 (Some Corp Communications)
00:YY:YY:YY:YY:YY 192.168.1.12 (EliteHackers System Co. (ECS))


externip - The module sends a web query to the service http://inguma.sourceforge.net/php/ip.php which prints the IP address of the host who made the query. If the host is behind a non anonymous proxy, the IP address returned will be the original IP, not the proxy IP.If the proxy being used is truly an anonymous one you will get the proxy's IP.
Example Usage:
No proxy
$ unset http_proxy
$ ./inguma.py
(...)
inguma> externip
212.XX.YY.ZZ


Non anonymous proxy
$ export http_proxy="http://80.XX.YY.ZZ:3128"
$ ./inguma.py
(...)
inguma> externip
212.XX.YY.ZZ


Anonymous proxy
$ export http_proxy="http://80.XX.YY.ZZ:3128"
$ ./inguma.py
(...)
inguma> externip
80.XX.YY.ZZ


ping - Send ICMP messages to an specified target host or network. By default, the module sends ICMP_ECHO_REQUEST packets but other ICMP packets are supported.
Supported ICMP Packets
ECHO_REPLY = 0
DEST_UNREACH = 3
SOURCE_QUENCH = 4
REDIRECT = 5
ECHO_REQUEST = 8
ROUTER_ADVERTISEMENT = 9
ROUTER_SOLICITATION = 10
TIME_EXCEEDED = 11
PARAMETER_PROBLEM = 12
TIMESTAMP_REQUEST = 13
TIMESTAMP_REPLY = 14
INFORMATION_REQUEST = 15
INFORMATION_RESPONSE = 16
ADDRESS_MASK_REQUEST = 17
ADDRESS_MASK_REPPLY = 18


Example Usage:
inguma> target = "192.168.1.0/24"
inguma> ping
WARNING: Mac address to reach 192.168.1.0 not found
WARNING: Mac address to reach 192.168.1.2 not found
WARNING: Mac address to reach 192.168.1.3 not found
(...)
Discovered hosts
Found host 1 192.168.1.1


Using other ICMP packets
inguma>packetType=10 # Router solicitation
inguma> target = "192.168.1.1"
inguma> ping
Discovered hosts
None

inguma> packetType=8 # ICMP_ECHO_REQUEST
inguma> ping
Discovered hosts
Found host 1 192.168.1.1


whois - Query whois database.
Example Usage:
inguma> target = "internic.net"
inguma> whois

Registrant:
ICANN
   4676 Admiralty Way
   Suite 330
   Marina del Rey, CA 90292
   US
   Domain Name: INTERNIC.NET
   Administrative Contact, Technical Contact:
      IANA              iana@IANA.ORG
      4676 ADMIRALTY WAY STE 330
      MARINA DL REY, CA 90292-6604
      US
      310-823-9358 fax: 310-823-8649

   Record expires on 31-Dec-2010.
   Record created on 01-Jan-1993.
   Database last updated on 19-Jan-2008 16:36:19 EST.

   Domain servers in listed order:
   A.IANA-SERVERS.NET          
   B.IANA-SERVERS.ORG          
   C.IANA-SERVERS.NET          
   NS.ICANN.ORG                
   NS.APNIC.NET                 203.37.255.97
   NS1.CRSNIC.NET               198.41.3.39
   NS2.NSIREGISTRY.NET          198.41.3.108
   SVC00.APNIC.NET              202.12.28.131


trace
 
- Performs a traceroute on the target.
Example Usage:
inguma> target = "www.google.com"
inguma> trace

Trace to target(s)
------------------
hosts 1 192.168.11.3
hosts 2 172.30.32.1
hosts 3 207.229.191.130
hosts 4 207.172.19.15
hosts 5 74.125.48.29
hosts 6 209.85.250.237
hosts 7 216.239.46.12
hosts 8 72.14.232.111
hosts 9 72.14.205.104
hosts 10 72.14.232.66
hosts 11 72.14.205.104
hosts 16 207.172.19.43
hosts 17 72.14.205.104



~Wiki Quick Links
Discovery Modules - Gather Modules - Fuzzing Modules - Brute Force Modules - Exploits
Inguma Documentation Home

Questions and comments regarding application development and collaboration should be directed to joxeankoret[AT]yahoo[DOT]es
Comments and input regarding documentation should be directed to
Andrew.Brooks85[AT]gmail[DOT]com