The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet.

Right out of the gate you know your IP, gateway, and subnet mask, and you can do an ARP scan to identify hosts on the immediate subnet. What about other internal subnets that you may have access to now that you didn't from the internet?

I am looking for what kinds of tools or technologies you could use to identify these networks.

Some ideas:

  • passively listen for any broadcasted traffic that happens to go to a different subnet (this seems unlikely on a switched network).

  • check the publicly known ARIN blocks to see if any are reachable internally that were firewalled from an external perspective.

  • zone transfer may be allowed internally that could identify other servers on other internal subnets.

What did I miss? Of the above strategies, what works best in your experience?

  • 2
    A simple tracert / traceroute can come in handy sometimes
    – cutrightjm
    Sep 9, 2016 at 19:15
  • 1
    Yup - traceroute to an external site can give you interesting info about network topology. If the IP address you get is an IANA internal one (arin.net/knowledge/address_filters.html) you can traceroute to each one in the range. nmap is also a handy tool - you can use it to scan each host in the same ranges. Doing any of this on a network you don't control can get you in an insane amount of trouble, mind you.
    – crovers
    Sep 9, 2016 at 19:57
  • Yeah, I understand that. I am a pentester looking for how other people deal with this situation. Fair enough to make the disclaimer though. Also, traceroute makes sense as a suggestion, I could see that working in some cases for sure.
    – Gray
    Sep 9, 2016 at 19:58
  • @dandavis I dunno, dude. I was looking for other suggestions. Obviously, I shared what I did know. Do you have something to add? I have more of a development background, so I know more about web apps than networking... just looking to learn more.
    – Gray
    Sep 9, 2016 at 20:03
  • github.com/robertdavidgraham/masscan is pretty good when you just arrive
    – dandavis
    Sep 9, 2016 at 20:06

2 Answers 2


Those are pretty solid ideas. However, I think you're overthinking this. I'd start with something like nmap, angry IP, or some other network scanner against internal (non-routable) address blocks. Zone transfer or scripting rDNS is also worth a shot. You can get a lot of info out of DNS.

  • So scanning would take quite a while and be incredibly noisy, I'd think. I am generally doing blackbox testing, where IR is not supposed to know we are there. Might be able to get away with scanning the other ranges, at least parts of them. Thanks for your answer - good to know I am not missing something obvious.
    – Gray
    Sep 9, 2016 at 20:21
  • You are entirely accurate, but that wasn't part of the question. There are also settings to throttle the scope of such scans to reduce noise and improve speed, but that may still not meet your needs. Zone transfer shouldn't be allowed in a well secured DNS configuration, but unless you hit a flooding protection limit, you can run a lot of queries.
    – Jesse K
    Sep 9, 2016 at 20:25
  • Yeah, you are right - stealth was not really part of the question. Definitely still good info for people in different situations, but it is worth mentioning the drawbacks too. Good point about overdoing the DNS queries. There's definitely a lot you can get from DNS that are tricky to automate too, like similarly named workstations/servers that may exist on other subnets.
    – Gray
    Sep 9, 2016 at 20:31

Sniffing can be very fruitful.

Some other ideas:

  • Nmap sweep scan. Often a simple ICMP ping works on an internal network. Otherwise, use common ports like 139 and 22.
  • Identify patterns in host names - if you're on wks-1234, try wks-1235
  • Brute force DNS for common names
  • Scan adjacent subnets. If you're on 192.168.3.xx then try 192.168.4.xx
  • Find the domain controllers (may just be your DNS servers). Think you can extract a list of computer accounts, but not done this recently
  • There are some service location protocols (some based on DNS)

More hostile:

  • Sniffing on a switched network with ARP spoofing
  • Compromise hosts and escalate around the network (as my comment mentioned).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.