In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question.

My Question

You can ping someone's website and grab their IP. I can scan that box of course for vulnerabilities. However, most public facing web servers are locked down. How would I go about looking for additional IPs that would be open to the outside in their DMZ? How do you discover additional boxes? I have Backtrack 5. Anything specific to backtrack is obviously welcomed.

  • 2
    You just attempt every IP within the network mask. If you don't know the netwok mask try some standard network masks like 0xffffff00 or 0xffff0000. Try to find out who their ISP is and see if you can identify IP allocations for their ISP. Use automated IP range scanners, look for example DMZ configurations (Cisco, Microsoft, Red Hat, etc) sometimes the layout will be exactly the same as in the example.
    – this.josh
    Commented Jun 30, 2011 at 6:38

2 Answers 2


Check out The Penetration Testing Execution Standard (PTES).
And in particular: Intelligence gathering

This video may interest you as well: Finding general information about an organization via the web (from the show notes he covers how to use Backtrack 5 to do a lot of reconnaissance type work)

Popular tools for quick (i.e. just interested in IPs) reconnaissance:

  • whois
  • nslookup, dig
  • dns recon tools -> dnsenum, dnsmap, fierce + more ("DNS Analysis" folder in Backtrack)
  • nmap
  • Thanks, tate. I've been using nmap, but didn't realize it could scan blocks of IPs. The previous steps you gave me are perfect for guessing the range. Much obliged.
    – k to the z
    Commented Jun 30, 2011 at 12:57
  • ping sweep the subnet
  • nmap the DMZ's network block
  • Carefully inspect your firewall rules and make sure to manually check the boundaries of each rule

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .