القائمة
Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/uphiago/recon-skills --skill asn-infrastructure-mappingيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | asn-infrastructure-mapping |
| description | Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, dnsx, httpx |
| tags | ["recon","ASN","CIDR","IP-range","TLD","reverse-DNS","infrastructure"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","vhost-enumeration","port-mass-scan"] |
Map an organization's entire IP infrastructure by pivoting from domain to ASN (Autonomous System Number), extracting CIDR ranges, and discovering every hostname and service across all owned IP blocks. Includes TLD expansion to find sibling domains on different top-level domains with separate infrastructure.
terminal whois, dnsx, mapcidr, httpx, and asnmap.# Start: domain → IP → ASN → CIDR ranges
IP=$(dig target.com +short | head -1)
ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
echo "ASN: $ASN"
whois -h whois.radb.net -- "-i origin $ASN" | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u
# asnmap — automated domain → ASN
asnmap -d target.com
# Manual whois approach
IP=$(dig target.com +short | head -1)
whois $IP | grep -iE "origin|OriginAS|route:|descr:" | head -10
# spk — finds all ASNs for a company by name (including subsidiaries)
spk -json -s "Company Name"
# Webtools
# https://bgp.he.net — search by company name
# https://asnlookup.com — search by org name, ASN, or CIDR
# asnmap — direct CIDR extraction
asnmap -a AS33905 -silent > cidr_ranges.txt
# RADB whois — full route objects
whois -h whois.radb.net -- "-i origin AS33905" \
| grep -Eo "([0-9.]+){4}/[0-9]+" \
| sort -u >> cidr_ranges.txt
# metabigor — multi-source IP intelligence
echo "Company Name" | metabigor net --org -o cidr_ranges.txt
echo "ASN33905" | metabigor net --asn -o cidr_ranges.txt
# mapcidr — split CIDR into flat IP list
cat cidr_ranges.txt | mapcidr -silent > all_ips.txt
wc -l all_ips.txt
# prips — alternative IP generator
while read cidr; do prips "$cidr"; done < cidr_ranges.txt >> all_ips.txt
# Scan discovered IPs for live web services
cat all_ips.txt | httpx \
-ports 80,443,8080,8443,3000,5000,8000,8888,9090,9443 \
-status-code -title -web-server -silent \
-o live_ip_services.txt
# dnsx PTR — resolve hostnames from IP blocks
cat cidr_ranges.txt | dnsx -silent -resp-only -ptr > ptr_domains.txt
# Filter for target-related hosts
grep -i "target" ptr_domains.txt > ptr_target.txt
# hakrevdns — reverse DNS at scale
hakrevdns -d target.com -R resolvers.txt
# resolveDomains — check which IPs serve target content
resolveDomains -d all_subs.txt > resolved.txt
awk '{print $3}' resolved.txt | sort -u > unique_ips.txt
# tldbrute — discover all registered TLD variants
tldbrute -d target.com
# Manual IANA TLD list approach
wget -q https://data.iana.org/TLD/tlds-alpha-by-domain.txt
ROOT=$(echo "target.com" | cut -d. -f1)
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| while read tld; do echo "$ROOT.$tld"; done \
| httpx -silent -mc 200 > tlds_alive.txt
# Apply to all known subdomains
cat all_subs.txt | while read sub; do
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| sed "s/^/$sub./"
done | dnsx -silent > subs_tld_expanded.txt
# Map which domains belong to which IP
cat unique_ips.txt | while read ip; do
echo -n "$ip: "
grep -l "$ip" resolved.txt 2>/dev/null | tr '\n' ' '
echo
done > ip_to_domain_map.txt
# Identify shared infrastructure (one IP serving multiple domains — CDN or reverse proxy)
awk '{if (NF > 2) print}' ip_to_domain_map.txt > shared_infra.txt
# Scan non-web ports on ALL discovered IPs
naabu -l all_ips.txt -p - -rate 1000 -c 50 -exclude-ports 80,443 -o all_services.txt
# Extract all company/organization names from whois
cat all_ips.txt | while read ip; do
whois $ip 2>/dev/null | grep -iE "OrgName|org-name|descr:" | head -1
done | sort -u > subsidiary_names.txt
# For each subsidiary, repeat the ASN → CIDR pipeline
cat subsidiary_names.txt | while read org; do
metabigor net --org "$org" >> expanded_cidr.txt
done
subdomain-enumeration — Generate the initial subdomain list before expanding to IP infrastructure.origin-ip-discovery — Once CIDR ranges are known, identify which IPs are origins behind CDN.vhost-enumeration — Scan discovered IPs for hidden virtual hosts.port-mass-scan — Scan all discovered IPs for exposed services.