Penetration Testing: Re: Find out the subnetting of a company

["Volker Tanger" <volker.tanger () detewe de>]

Hi!

> > During an internal black-box penetration test, from a subnet 
> > of a company (with or without DHCP), how do you find out the 
> > structure of the other subnets of network? 
Sometimes it is better/easier to take a purely passive approach. 

Running ARPWATCH will tell you quite a lot about the (physically
attached) networks and devices - especially the hardware vendor IDs
(Vendor-IDs Cisco, Nortel etc. are a dead giveaways for points of
interest). 

Plainly tunning TCPDUMP and filtering for NETBIOS broadcasts will tell
you quite nicely network boundaries of networks where Microsoft systems
are active.

Bye

Volker Tanger
ITK Security