As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below.
- Company name: www.testme.com
- IP: 18.104.22.168
- Name server: main.testme.com
- Name server IP: 22.214.171.124
main.testme.com is our main office where all our employees are with our internal network address range is 126.96.36.199/24
During a footprinting stage, how, if possible, do I extract 188.8.131.52/24 address range? Whois, nslookup, dnsenum, Netcraft, or other methods don't seem to get me that far unless I was doing something wrong.
Any help is very much appreciated.