RE: FW: Mapping Class A network ( any easy trick?)

["Navin Johnson" <printerscanner () hotmail com>]

Here is how I attack this problem:
- Use DNS first to get a list of potentially live IPs
 - Try doing a zone transfer to get a list of IPs
 - Try resolving the IPs to hostnames and look for PTR records (perl works 
well for this, Michael Fuhr wrote a script called mresolv.pl that does this)
- Traceroute to the live IPs to get a list of all the network device IPs
  - If they use a standard like all routers are at .254 or .1 or .100, make 
a list of potential IPs for routers and ping those.
- Take a listing of all the live addresses you have at this point and break 
them into class C ranges.
- Ping the class C range

If you can get access to a router, you can then do a 'show ip route' to see 
if you missed any ranges.


> -----Original Message-----
> From: John Thomas [mailto:mjohn2000_99 () yahoo com]
> Sent: Tuesday, February 08, 2005 11:42 AM
> To: pen-test () securityfocus com
> Subject: Mapping Class A network ( any easy trick?)
>
>
>
>
> I am about to do a penetration testing on a "Class A
> network" and wondering how I can map the network
> without pinging 17 million IPs.(nmap -Sp 10.0.0.0/8)
>
> I did some research and the best information I got is
> from one of the earlier post on this
> list(http://seclists.org/lists/pen-test/2004/Jul/0067.html)
> . It was to use broadcast IPs for pings. But it may miss some subnets.
>
> Is that the best way to it? If not, please advise
>
>
> The information contained in this communication and its attachment(s) is 
> intended only for the use of the individual to whom it is addressed and may 
> contain information that is privileged, confidential, or exempt from 
> disclosure. If the reader of this message is not the intended recipient, 
> you are hereby notified that any dissemination, distribution, or copying of 
> this communication is strictly prohibited. If you have received this 
> communication in error, please notify postmaster () owenscorning com and 
> delete the communication without retaining any copies. Thank you.
>
> Translations available: http://www.owenscorning.com/emailfooter.html