Find out the subnetting of a company

[il.prof () virgilio it]

During an internal black-box penetration test, from a subnet of a company
(with or without DHCP), how do you find out the structure of the other subnets
of network? In particular, how do you determine/discover the subnetting
of the IP space of a company?

An example:

- IP network of the company XYZ: 10.0.0.0/8 (I use a private class to avoid
the use of a real address space)
- I?m in the subnet 10.0.0.0/24

How do you find out the structure of other subnets that are part of the
network 10.0.0.0/8?

Il Prof.