asn-infrastructure-mapping

1# ASN Infrastructure Mapping
2 
3Map an organization's entire IP infrastructure by pivoting from domain to ASN (Autonomous System Number), extracting CIDR ranges, and discovering every hostname and service across all owned IP blocks. Includes TLD expansion to find sibling domains on different top-level domains with separate infrastructure.
4 
5## When to Use
6 
7- You have a target domain and want to discover EVERY IP owned by the organization.
8- Passive subdomain enumeration found only a few hosts — the rest may be on sibling TLDs or different IP ranges.
9- The target has a known ASN that can be expanded to full CIDR blocks.
10- Services on non-standard ports are invisible to web-only recon.
11- Acquired subsidiaries or international domains may sit on different ASNs with weaker security.
12 
13## Prerequisites
14 
15- `terminal` whois, dnsx, mapcidr, httpx, and asnmap.
16- The target domain and/or a known IP belonging to the organization.
17- Shodan API key (optional, for deeper OSINT).
18 
19## How to Run
20 
21```bash
22# Start: domain → IP → ASN → CIDR ranges
23IP=$(dig target.com +short | head -1)
24ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
25echo "ASN: $ASN"
26whois -h whois.radb.net -- "-i origin $ASN" | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u
27```
28 
29## Quick Detection
30 
31```bash
32# Start: domain → IP → ASN → CIDR ranges
33IP=$(dig target.com +short | head -1)
34ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
35echo "ASN: $ASN"
36…