Re: Find out the subnetting of a company

From: David M. Zendzian (dmz_at_dmzs.com)
Date: 07/20/04

  • Next message: Rob J Meijer: "RE: Find out the subnetting of a company" 
    Date: Tue, 20 Jul 2004 12:53:43 -0400
To: dsr@ascure.com
To: il.prof@virgilio.it
To: pen-test@securityfocus.com

    Isn't there some icmp or ip based packet that can be sent to most devices querying the subnet theyare in? I am on vacation with only blackberry and can't google it, but someone out there must be familiar with that??
    -----Original Message-----
    From: "Dieter Sarrazyn" <dsr@ascure.com>
    Date: Tue, 20 Jul 2004 08:38:42
    To:<il.prof@virgilio.it>, <pen-test@securityfocus.com>
    Subject: RE: Find out the subnetting of a company

    Hi,

    You can find lot's of the subnet structure with ping & traceroute scans
    already. First, you can use the ping functionality of nmap (nmap -sP)
    which should give you information about network and broadcast addresses.
    If you found these parts, you already know how the subnetting is done.
    With traceroute, you'll find out how these subnets are connected to
    eachother.

    Of course, if there's a router that has snmp enabled, try to find one of
    the community strings & dump the routing table of this router...

    Hope this helps.

    regards,
    Dieter

    > -----Original Message-----
    > From: il.prof@virgilio.it [mailto:il.prof@virgilio.it]
    > Sent: donderdag 15 juli 2004 10:17
    > To: pen-test@securityfocus.com
    > Subject: Find out the subnetting of a company
    >
    > During an internal black-box penetration test, from a subnet
    > of a company (with or without DHCP), how do you find out the
    > structure of the other subnets of network? In particular, how
    > do you determine/discover the subnetting of the IP space of a company?
    >
    > An example:
    >
    > - IP network of the company XYZ: 10.0.0.0/8 (I use a private
    > class to avoid the use of a real address space)
    > - I?m in the subnet 10.0.0.0/24
    >
    > How do you find out the structure of other subnets that are
    > part of the network 10.0.0.0/8?
    >
    > Il Prof.
    >
    >
    >
    >

    /--------------------------------------\
     David M. Zendzian * dmz@dmzs.com
     (415) 867-7812 - phone
      -------------
      Imagination is greater than knowledge * Albert Einstein
     Every day is a good day, whether you like it or not! *

  • Next message: Rob J Meijer: "RE: Find out the subnetting of a company"

    Relevant Pages

    • Re: 291 IP Addressing Help
      ... My problem is that I cannot see, understand, the uses for subnetting. ... then I keep on trying to make sense of it all on my home network ... IP addressing and that was my lowest. ... I can go to get extra material to help me study for the exam again by ...
      (microsoft.public.cert.exam.mcsa)
    • Re: subnetting
      ... subnetting the network. ... agree that vlan subnetting has it's advantages(i.e reducing broadcast ... on a 400 node network. ...
      (comp.dcom.sys.cisco)
    • Re: subnetting (helps security)
      ... I am studying subnetting and I have a few question, ... I will take as an example the network address, ... If I borrow 1 bit the result is: ... 16 combinations or 2 to the power of 4 ...
      (alt.computer.security)
    • Re: Find out the subnetting of a company
      ... request is a very unreliable method to discover IP subnetting, ... subnetting of a network, is to look for broadcast addresses. ... also treat the network address as a broadcast, ...
      (Pen-Test)
    • Re: Can I subnet my network like this ?
      ... > I would like to verify my knowledge ... > sure whether it's impossible for subnetting ... "all zeros" or "all ones" network treatment, ... but I don't think any kit behaves like that in these CIDR days. ...
      (freebsd-questions)