Penetration Testing: Re: IP Range

[Jason <security () brvenik com>]

One way is you could get the ASN then use some human cycles.

use any of the many public route servers available.

on a cisco you could try

sho ip bgp [dest netblock] <== the last ASN is the target below
sho ip bgp regexp [ASN] <== should show all routes services by that ASN.

and use contact correlation in arin/ripe/apnic whois for netblocks...


John Madden wrote:
> Hello,
>
> Where just about to begin a pentest engagement and the
> client wants us to know if we can find out how many IP
> blocks they have. Is there a way to find out all the
> IP blocks of a company ? You've got the usual e-mail
> domain name to find at least one but what if they have
> 2,3 + IP blocks ?
>
> Any ideas ?
>
> thanks 
>
> __________________________________________________
> Do You Yahoo!?
> Yahoo! Finance - Get real-time stock quotes
> http://finance.yahoo.com
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
> Service. For more information on SecurityFocus' SIA service which
> automatically alerts you to the latest security vulnerabilities please see:
> https://alerts.securityfocus.com/


----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/