Penetration Testing: Re: Find out the subnetting of a company

[Tim <tim-security () sentinelchicken org>]

> During an internal black-box penetration test, from a subnet of a company
> (with or without DHCP), how do you find out the structure of the other subnets
> of network? In particular, how do you determine/discover the subnetting
> of the IP space of a company?
I just ran across this today, while trying to figure out what ICMP
requests I wanted to let through my firewall.

http://www.networksorcery.com/enp/protocol/icmp/msg17.htm

Perhaps by doing traceroutes to various IPs, followed by a subnet
request to the routers that show up would be helpful.  I don't know how
well it is even supported, but would save you lots of work if it worked.

Needless to say, I didn't allow this one through the ol' firewall... ;-)

tim