In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.
You can ping someone's website and grab their IP. I can scan that box of course for vulnerabilities. However, most public facing web servers are locked down. How would I go about looking for additional IPs that would be open to the outside in their DMZ? How do you discover additional boxes? I have Backtrack 5. Anything specific to backtrack is obviously welcomed.