domain-and-asn-enumeration

Domain & ASN Enumeration

When to Use

• Phase 1 of External Penetration Tests / Bug Bounty hunting.
• When mapping the Attack Surface of a large enterprise or conglomerate.
• When tracking mergers and acquisitions (discovering newly acquired, potentially insecure infrastructure).
• Before conducting vulnerability scanning, to ensure you know every asset the target owns.

Prerequisites

• Target organization name, domain, or individual identifier
• OSINT framework tools installed (theHarvester, Maltego, Recon-ng)
• Understanding of operational security to avoid alerting the target
• Legal authorization for the intelligence gathering scope

Workflow

Phase 1: ASN (Autonomous System Number) Discovery

# Concept: Large organizations have their own ASNs, representing huge blocks of IP addresses.
# We want to map these to find infrastructure they host themselves vs cloud hosting.

# 1. Start with the main domain or company name via BGPView API or Hurricane Electric (bgp.he.net)
curl -s "https://api.bgpview.io/search?query_term=tesla" | jq

# 2. Extract ASNs provided in the response (e.g., AS394380)

# 3. Use Amass to map ASNs to IP ranges
amass intel -asn 394380

# 4. Alternatively, use whois to lookup the organization name
whois -h whois.radb.net -- '-i origin AS394380' | grep -Eo "([0-9.]+){4}/[0-9]+"

# This gives you the CIDR blocks (e.g., 216.239.32.0/19) owned directly by the company.

Phase 2: Reverse WHOIS and Domain Discovery

# Concept: We have the main domain (target.com). Now we want to find OTHER root domains 
# owned by the same company (target.net, target-holdings.com, acquired-startup.com).

# 1. Extract WHOIS registrant email or organization name from the main domain
whois target.com | grep "Registrant Organization\|Registrant Email"
# Result: Registrant Organization: Target Corp

# 2. Perform Reverse WHOIS (who owns domains matching this Org/Email?)
# Use Amass Intel module
amass intel -org "Target Corp"
amass intel -whois -d target.com

# 3. Use Crunchbase and Wikipedia to manually search for Subsidaries and Acquisitions.
# Add these root domains to your target list.