As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below.
- Company name: www.testme.com
- IP: 188.8.131.52
- Name server: main.testme.com
- Name server IP: 184.108.40.206
main.testme.com is our main office where all our employees are with our internal network address range is 220.127.116.11/24
During a footprinting stage, how, if possible, do I extract 18.104.22.168/24 address range? Whois, nslookup, dnsenum, Netcraft, or other methods don't seem to get me that far unless I was doing something wrong.
Any help is very much appreciated.