next »

[Maltego Forum]

Maltego Forum » Development » User Transforms
IP -> Website transform using MSN.com ip: query (msnpawn2.py)

[H]

#
#         msnpawn2.py by h at itsecurity.net - uses Live Search API 2.0
#                                              supports > 50 results and Maltego output
#
# based on msnpawn.py by Richard Moore - first python version
# based on msnpawn.sh by SuRGeoN - original bash script using Live Search API 1.x
#
# This script outputs unique hostnames (vhosts) with web content on a given IP address,
# based on the first 1000 URLs returned by an MSN.com web search using the ip: query option.
#
# If a hostname is provided as input instead of an IP, this is resolved to an IP first.
# 
# This uses the MSN Live Search API 2.0 SOAP web service. WSDL URL:
# http://api.search.live.net/search.wsdl
#
# Please get your own free Live Search API 2.0 key and insert it on the appid = line below
#
# See:  http://search.live.com/developers/createapp.aspx
#       http://search.msn.com/developers/ 
#
# Tested with Python 2.6.2 on Windows

Requires konrads` pymaltego module when using in -maltego mode
(svn checkout http://rogue.smelkovs.com/svn/pymaltego/trunk)

Input entity type: IP
Output: Website
Command: c:\python26\python.exe
Command parameters: "c:\maltego\msnpawn2.py -maltego" (quotes are necessary)

[AndrewMacPherson]

Thanks for another great local transform.

Just a note to the linux users, you will have to modify this transform to force the -maltego as you cannot specify this within the local transform.

[syniack]

Is there any way by using this transform i can search the relation of meta data like mail header it help us to secure mail server through spam email and unnecessary email and then we can block that particular ip and domain

[H]

Not totally sure what you mean...

This transform will take a single IP address or hostname as input.
(if given a hostname, this will first be resolved to an IP address)

The output will be websites hosted on this IP address (based on MSN.com''s web search index).

Not sure how that would help you for any anti-spam purposes.