kpcyrd/sn0int

Failed to download GeoIP database

DRiberoP opened this issue · 5 comments

I tried to run snoint by running ./snoint and it gets stuck on 'Downloading "GeoLite2-City.mmdb"...' says there is an error in the connection and specifically spews out the following:

Error: Failed to download GeoIP database
Because: http request failed
Because: error trying to connect: Connection timed out (os error 110)

Is it related to this? https://blog.maxmind.com/2019/04/12/important-updates-about-tls-v1-0-v1-1-unencrypted-http-requests-and-the-legacy-minfraud-soap-api/

Versions

  • rustc --version: rustc 1.38.0
  • cargo --version: cargo 1.38.0
  • sn0int --version: 0.13.0
  • uname -a: Linux ubuntu 4.15.0-65-generic #74-Ubuntu SMP Tue Sep 17 17:06:04 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Environment

  • Operating System/Distro: Ubuntu 18.04 LTS on vmware workstation 15
  • Installed from (source/apt/pacman/brew/docker): apt

Thanks for reporting this. The download still works on my end, I've tested it with an empty container:

% docker run -it --rm kpcyrd/sn0int

                   ___/           .
     ____ , __   .'  /\ ` , __   _/_
    (     |'  `. |  / | | |'  `.  |
    `--.  |    | |,'  | | |    |  |
   \___.' /    | /`---' / /    |  \__/

        osint | recon | security
      irc.hackint.org:6697/#sn0int

[+] Connecting to database
[+] Downloading public suffix list
[+] Downloading "GeoLite2-City.mmdb"
[+] Downloading "GeoLite2-ASN.mmdb"
[+] Loaded 0 modules
[*] No modules found, run quickstart to install default modules
[sn0int][default] > 

Can you check if you're able to download the file inside the VM with:

wget 'https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz'

Thanks!

Can you check if you're able to download the file inside the VM with:

wget 'https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz'

Thanks!

It downloaded/saved it successfully.
I ran sn0int again and get the same error. Is there somewhere I can place the file so that it skips the downloading? I'll admit I am not familiar with rust nor have I really looked at the code.

Thanks!

You can try this to install the files manually:

wget https://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz \
     https://geolite.maxmind.com/download/geoip/database/GeoLite2-ASN.tar.gz
cargo run --example maxmind -- dl -e GeoLite2-City.tar.gz GeoLite2-City.mmdb GeoLite2-City.mmdb
cargo run --example maxmind -- dl -e GeoLite2-ASN.tar.gz GeoLite2-ASN.mmdb GeoLite2-ASN.mmdb

Let me know if executing modules that do http requests works.

I ran the commands and it returned this error:
Compiling tokio-rustls v0.10.2 Running rustc --crate-name tokio_rustls /home/dev/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-rustls-0.10.2/src/lib.rs --color always --crate-type lib --emit=dep-info,metadata,link -C opt-level=3 -C metadata=7caf9bb32e4f3804 -C extra-filename=-7caf9bb32e4f3804 --out-dir /home/dev/Desktop/sn0int/target/release/deps -L dependency=/home/dev/Desktop/sn0int/target/release/deps --extern bytes=/home/dev/Desktop/sn0int/target/release/deps/libbytes-b06b8463d809fb19.rlib --extern futures=/home/dev/Desktop/sn0int/target/release/deps/libfutures-bdcb6eb9ab962515.rlib --extern iovec=/home/dev/Desktop/sn0int/target/release/deps/libiovec-3d6020aaa5c99564.rlib --extern rustls=/home/dev/Desktop/sn0int/target/release/deps/librustls-4b03f94ca79664b4.rlib --extern tokio_io=/home/dev/Desktop/sn0int/target/release/deps/libtokio_io-5f536393236b111f.rlib --extern webpki=/home/dev/Desktop/sn0int/target/release/deps/libwebpki-ca714907668aa13a.rlib --cap-lints allow -L native=/home/dev/Desktop/sn0int/target/release/build/ring-d7c127d144da426b/out`
error: enum variants on type aliases are experimental
--> /home/dev/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-rustls-0.10.2/src/lib.rs:260:9
|
260 | Self::Client(s)
| ^^^^^^^^^^^^

error: enum variants on type aliases are experimental
--> /home/dev/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-rustls-0.10.2/src/lib.rs:266:9
|
266 | Self::Server(s)
| ^^^^^^^^^^^^

error: aborting due to 2 previous errors

error: failed to compile sn0int v0.13.0 (/home/dev/Desktop/sn0int), intermediate artifacts can be found at /home/dev/Desktop/sn0int/target

Caused by:
Could not compile tokio-rustls.

Caused by:
process didn't exit successfully: rustc --crate-name tokio_rustls /home/dev/.cargo/registry/src/github.com-1ecc6299db9ec823/tokio-rustls-0.10.2/src/lib.rs --color always --crate-type lib --emit=dep-info,metadata,link -C opt-level=3 -C metadata=7caf9bb32e4f3804 -C extra-filename=-7caf9bb32e4f3804 --out-dir /home/dev/Desktop/sn0int/target/release/deps -L dependency=/home/dev/Desktop/sn0int/target/release/deps --extern bytes=/home/dev/Desktop/sn0int/target/release/deps/libbytes-b06b8463d809fb19.rlib --extern futures=/home/dev/Desktop/sn0int/target/release/deps/libfutures-bdcb6eb9ab962515.rlib --extern iovec=/home/dev/Desktop/sn0int/target/release/deps/libiovec-3d6020aaa5c99564.rlib --extern rustls=/home/dev/Desktop/sn0int/target/release/deps/librustls-4b03f94ca79664b4.rlib --extern tokio_io=/home/dev/Desktop/sn0int/target/release/deps/libtokio_io-5f536393236b111f.rlib --extern webpki=/home/dev/Desktop/sn0int/target/release/deps/libwebpki-ca714907668aa13a.rlib --cap-lints allow -L native=/home/dev/Desktop/sn0int/target/release/build/ring-d7c127d144da426b/out (exit code: 1)
`

I was unable to fix this. I spun up a new ubuntu 18.04 vm and re-did the steps and it worked. I'm not sure what happened during the installation or why it did not work previously on the other vm I had.
Thanks

I spun up a new ubuntu 18.04 vm and re-did the steps and it worked.

Was it able to download the geoip files on its own in the new vm or did you have to use the cargo run --example maxmind -- dl -e command? Does everything else work after that, like running investigations?

I'm not sure what happened during the installation or why it did not work previously on the other vm I had.

I assume your rust compiler was outdated and by redoing the steps in a new vm you got the most recent one. You can update rust with rustup update.

Thanks

You're welcome!