As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below.

  • Company name: www.testme.com
  • IP:
  • Name server: main.testme.com
  • Name server IP:

main.testme.com is our main office where all our employees are with our internal network address range is

During a footprinting stage, how, if possible, do I extract address range? Whois, nslookup, dnsenum, Netcraft, or other methods don't seem to get me that far unless I was doing something wrong.

Any help is very much appreciated.

  • 1
    internal network IPs will not be found in external DNS - you need to be inside the network and query the internal DNS – schroeder Jan 21 '16 at 4:38
  • Isn't a typo? Shoukdn't it be instead? – ott-- Jan 21 '16 at 8:18

Like most other businesses in the world, this target network is likely using Port Address Translation (PAT aka "overloaded NAT") whereby internal addresses get translated into the public IP (or an IP from the public pool) on egress into the Internet when making connections. This means that the private space ( is used on the local LAN inside the company network, but any communications to/from the Internet use the public IP ( Usually, you are unable to tell what the internal space is from the outside. Even guessing won't get you anywhere, since the firewall will block unwarranted requests from the Internet to on the external interface.

There have been known some information leakage vulnerabilities that expose private internal address space:

  • I personally found internal address space addresses among HeartBleed audits performed against a friend's external-facing web server. Memory leaks can expose private information like this, especially from servers in a company's DMZ that also talk inbound (many companies allow MS domain traffic to/from DMZ to LAN for management purposes).
  • Emails from the Exchange server within your target network will stamp each SMTP message with 'message headers' that include the LAN IPs and hostnames of any internal Exchange servers the message was processed by on its way out of the target organization. It's possible for a company to scrub these, but most don't, and RFC 2821 says you shouldn't. More info on that here.
  • There are common ways to misconfigure DNS to expose private internal addresses. Here is an example.
  • If you can be on the same network as an asset from the target network elsewhere (Bob from Victim Corp. is on the same WiFi as you in a coffee shop), you can possibly sniff the traffic for RARP, SMB, and other requests that leak this info in hopes that (A) Bob is using a company VPN, and (B) the VPN client is configured for split tunneling, which is relatively common.

If you have physical access to/near the victim network, however, there are far easier ways to obtain this data from plugging into a conference room port, cracking the WiFi, etc. You could even spear phish with malware designed to perform some network reconnaissance and exfiltrate back to your server if you feel someone will open your malicious email attachment (hint: they always do). Otherwise, NAT/PAT prevails and there is no standard or common way to reveal the internal IP range.

| improve this answer | |
  • I would like to add mis-configured load balancers where cookies can be decoded and reveal the internal IP address of the web server(s). Examples are BigIP F5 and Netscaler LB's. – Jeroen Jan 21 '16 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.