Classy Inter-Domain Routing Enumeration

During the information gathering phase of a penetration test, we want to discover the netblocks, or ranges, owned by the target organization. This allows us to produce a list of potential hosts for further enumeration. For very large organizations, or ones that have been around since the birth of the Internet, it is possible that they are unaware of what they own or have lost track of it over time. They will often request discovery of their netblocks and hosts for internal documentation or validation of in-scope systems for testing. In an effort to automate this process, I created a script to query the various entities for this information. Before we get into the operational details, let’s take a look at some background information and who it is that we need to ask for this information. Background The primary organization responsible for the distribution of IP addresses and Autonomous Systems Numbers (ASNs) on the Internet is Internet Assigned Numbers Authority (IANA). They in turn assign blocks of addresses to Regional Internet Registries (RIRs). The RIRs then further distribute address blocks to National Internet Registries (NIRs) in some regions, but mostly down to Local Internet Registries (LIRs). LIRs are primarily Internet Service Providers (ISPs), but can also be large enterprises or academic institutions. A breakdown of the IP addresses assigned to each RIR can be found on IANA's website: https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtmlhttps://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xhtml We are interested in querying the RIRs, each of which maintains a database of the address allocations, along with contact information and potentially re-allocation/delegation. There are five (5) RIRs responsible for IP address allocation around the world. A map of their respective regions and any associated NIRs is listed below: Courtesy of https://www.caida.org/In addition to netblocks and IP addresses, Autonomous System Numbers (ASNs) are also of interest. ASNs are used as part of the Border Gateway Protocol (BGP) for uniquely identifying each network on the Internet. Target organizations may have their own ASNs due to the size of their network or as a result of redundant service paths from peered service providers. These ASNs will reveal additional netblocks owned by the organization. Preparation In order to construct our queries, we need to know what is available from each of the RIRs. At the outset of this project, I primarily focused on ARIN, mainly because we are located within the United States. Of the five RIRs, ARIN's RESTful API is the most extensive and is available via HTTP queries. The hierarchy of information is also not directly linked between the addressable resources. The primary resources that we are interested in are the Organization Name, Organization Handle, Customer Handle, and Point-of-Contact (PoC) Handle. Additionally, we are able to search for the email domain of the PoC, to further expand the possible allocations. Each of these will allow us to locate associated netblocks. The addressable resources and their relationships can be found on ARIN's API website: https://www.arin.net/resources/whoisrws/whois_api.html The other four RIRs have varying degrees of available information, ranging from an API to simple queries against netblocks or ASNs. The information is also not consistent between RIRs, where field names vary or even the listing of PoCs. Information for the other RIRs can be found on their respective websites: RIPE: https://github.com/RIPE-NCC/whois/wiki/WHOIS-REST-API-search APNIC: https://wq.apnic.net/whois-search/static/search.html LACNIC: https://lacnic.net/cgi-bin/lacnic/whois AfriNIC: http://www.afrinic.net/fr/services/whois-query The ASN information is best performed against BGP route servers. There are several publically accessible servers to performing these queries via Telnet on port TCP/23. The Script With the necessary information, I set out to build a script to do all the dirty work. As previously stated, it was initially for querying ARIN, but expanded to the remaining RIRs as needs arose from working with international organizations. So 'hardCIDR.sh' was born. A note on LACNIC before diving into the usage. LACNIC only allows query of either network range, ASN, Org Handle, or PoC Handle. This does not help us in locating these values based upon the organization name. They do however publish a list of all assigned ranges on a publically accessible FTP server, along with their rate-limiting thresholds. So, there is an accompanying data file, which the script checks for, used to perform LACNIC queries locally. The script includes an update option [-r], that can be used to update this data on an interval of your choosing. Approximate run time is just shy of 28 hours. hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime. The '-h' option lists the help: The options may be used in any combination, all, or none. Unfortunately, none of the "other" RIRs note the actual CIDR notation of the range, so 'ipcalc' is used to perform this function. If it is not installed on your system, the script will install it for you. At the prompts, enter the organization name, the email domain, and whether country codes are used as part of the email. If answered 'Y' to country codes, you will be prompted as to whether they precede the domain name or are appended to the TLD. A directory will be created for the output files. If the directory is found to exist, you will be prompted whether to overwrite. If answered 'N', a time stamp will be appended to the directory name. The script queries each RIR, as well as a BGP route server, prompting along the way as to whether records were located. Upon completion, three files will be generated: a CSV based on Org Handle, a CSV based on PoC Handle, and a line delimited file of all located CIDRs. Cancelling the script at any time will remove any temporary working files and the directory created for the resultant output files. It should be noted that, due to similarity in some organization names, you could get back results not related to the target. The CSV files will provide the associated handles and URLs for further validation where necessary. It is also possible that employees of the target organization used their corporate email address to register their own domains. These will be found within the results as well. The script can be found at the TrustedSec GitHub page: https://github.com/trustedsec/hardcidr Hope you find as much benefit in this script as we have :-)