Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.

My Question

You can ping someone's website and grab their IP. I can scan that box of course for vulnerabilities. However, most public facing web servers are locked down. How would I go about looking for additional IPs that would be open to the outside in their DMZ? How do you discover additional boxes? I have Backtrack 5. Anything specific to backtrack is obviously welcomed.

share|improve this question
2  
You just attempt every IP within the network mask. If you don't know the netwok mask try some standard network masks like 0xffffff00 or 0xffff0000. Try to find out who their ISP is and see if you can identify IP allocations for their ISP. Use automated IP range scanners, look for example DMZ configurations (Cisco, Microsoft, Red Hat, etc) sometimes the layout will be exactly the same as in the example. – this.josh Jun 30 '11 at 6:38
up vote 9 down vote accepted

Check out The Penetration Testing Execution Standard (PTES).
And in particular: Intelligence gathering

This video may interest you as well: Finding general information about an organization via the web (from the show notes he covers how to use Backtrack 5 to do a lot of reconnaissance type work)

Popular tools for quick (i.e. just interested in IPs) reconnaissance:

  • whois
  • nslookup, dig
  • dns recon tools -> dnsenum, dnsmap, fierce + more ("DNS Analysis" folder in Backtrack)
  • nmap
share|improve this answer
    
Thanks, tate. I've been using nmap, but didn't realize it could scan blocks of IPs. The previous steps you gave me are perfect for guessing the range. Much obliged. – k to the z Jun 30 '11 at 12:57
  • ping sweep the subnet
  • nmap the DMZ's network block
  • Carefully inspect your firewall rules and make sure to manually check the boundaries of each rule
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.