(c) Arnim Eijkhoudt <arnime squiggly kpn-cert.nl>, 2018, KPN-CERT, GPLv2 license
ExitGather is a Python script to generate a list of IP addresses being used as TOR and VPN exit nodes. It takes the online downloads of VPN config files from various providers, grabs the IPv4/IPv6 addresses and hostnames from those files and generates CSV output for matching against other sources. This makes it easy to analyze dumps, threat intel data, etc. for e.g. OPSEC failures.
- Python 3.x
- [required] Python DateUtil: https://pypi.python.org/pypi/python-dateutil/
- A working internet connection
- git clone https://github.com/uforia/exitgather.git
- pip install python-dateutil (or whatever you use for package management)
- Edit any configuration settings/URLs you like in exitgather.py
- Create your DLDIR and OUTPUTDIR
- Run ./exitgather.py
Usage notes:
- ExitGather will automatically resolve hostnames
- Use -q to surpress diagnostic output
- Asynchronous DNS lookups
- More VPN providers
- Create storage and output directories
- Output formats (JSON?)