Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.

My Question

You can ping someone's website and grab their IP. I can scan that box of course for vulnerabilities. However, most public facing web servers are locked down. How would I go about looking for additional IPs that would be open to the outside in their DMZ? How do you discover additional boxes? I have Backtrack 5. Anything specific to backtrack is obviously welcomed.

share|improve this question
2  
You just attempt every IP within the network mask. If you don't know the netwok mask try some standard network masks like 0xffffff00 or 0xffff0000. Try to find out who their ISP is and see if you can identify IP allocations for their ISP. Use automated IP range scanners, look for example DMZ configurations (Cisco, Microsoft, Red Hat, etc) sometimes the layout will be exactly the same as in the example. –  this.josh Jun 30 '11 at 6:38

2 Answers 2

up vote 9 down vote accepted

Check out The Penetration Testing Execution Standard (PTES).
And in particular: http://www.pentest-standard.org/index.php/Intelligence_Gathering

This video may interest you as well: http://www.irongeek.com/i.php?page=videos/osint-cyberstalking-footprinting-recon#DNS,_Whois_and_Domain_Tools_Finding_general_Information_about_an_organization_via_the_web (from the show notes he covers how to use backtrack 5 to do a lot of reconnaissance type work)

Popular tools for quick (i.e. just interested in IPs) reconnaissance:

  • whois
  • nslookup, dig
  • dns recon tools -> dnsenum, dnsmap, fierce, +more ("DNS Analysis" folder in backtrack)
  • nmap
share|improve this answer
    
+1 for nmap, it'll get the job done. –  DKGasser Jun 30 '11 at 12:33
    
Thanks, tate. I've been using nmap, but didn't realize it could scan blocks of IPs. The previous steps you gave me are perfect for guessing the range. Much obliged. –  k to the z Jun 30 '11 at 12:57
  • ping sweep the subnet
  • nmap the DMZ's network block
  • Carefully inspect your firewall rules and make sure to manually check the boundaries of each rule
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.