Menu
Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/uphiago/recon-skills --skill asn-infrastructure-mappingThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | asn-infrastructure-mapping |
| description | Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, dnsx, httpx |
| tags | ["recon","ASN","CIDR","IP-range","TLD","reverse-DNS","infrastructure"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","vhost-enumeration","port-mass-scan"] |
Map an organization's entire IP infrastructure by pivoting from domain to ASN (Autonomous System Number), extracting CIDR ranges, and discovering every hostname and service across all owned IP blocks. Includes TLD expansion to find sibling domains on different top-level domains with separate infrastructure.
terminal whois, dnsx, mapcidr, httpx, and asnmap.# Start: domain → IP → ASN → CIDR ranges
IP=$(dig target.com +short | head -1)
ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
echo "ASN: $ASN"
whois -h whois.radb.net -- "-i origin $ASN" | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u
# asnmap — automated domain → ASN
asnmap -d target.com
# Manual whois approach
IP=$(dig target.com +short | head -1)
whois $IP | grep -iE "origin|OriginAS|route:|descr:" | head -10
# spk — finds all ASNs for a company by name (including subsidiaries)
spk -json -s "Company Name"
# Webtools
# https://bgp.he.net — search by company name
# https://asnlookup.com — search by org name, ASN, or CIDR
# asnmap — direct CIDR extraction
asnmap -a AS33905 -silent > cidr_ranges.txt
# RADB whois — full route objects
whois -h whois.radb.net -- "-i origin AS33905" \
| grep -Eo "([0-9.]+){4}/[0-9]+" \
| sort -u >> cidr_ranges.txt
# metabigor — multi-source IP intelligence
echo "Company Name" | metabigor net --org -o cidr_ranges.txt
echo "ASN33905" | metabigor net --asn -o cidr_ranges.txt
# mapcidr — split CIDR into flat IP list
cat cidr_ranges.txt | mapcidr -silent > all_ips.txt
wc -l all_ips.txt
# prips — alternative IP generator
while read cidr; do prips "$cidr"; done < cidr_ranges.txt >> all_ips.txt
# Scan discovered IPs for live web services
cat all_ips.txt | httpx \
-ports 80,443,8080,8443,3000,5000,8000,8888,9090,9443 \
-status-code -title -web-server -silent \
-o live_ip_services.txt
# dnsx PTR — resolve hostnames from IP blocks
cat cidr_ranges.txt | dnsx -silent -resp-only -ptr > ptr_domains.txt
# Filter for target-related hosts
grep -i "target" ptr_domains.txt > ptr_target.txt
# hakrevdns — reverse DNS at scale
hakrevdns -d target.com -R resolvers.txt
# resolveDomains — check which IPs serve target content
resolveDomains -d all_subs.txt > resolved.txt
awk '{print $3}' resolved.txt | sort -u > unique_ips.txt
# tldbrute — discover all registered TLD variants
tldbrute -d target.com
# Manual IANA TLD list approach
wget -q https://data.iana.org/TLD/tlds-alpha-by-domain.txt
ROOT=$(echo "target.com" | cut -d. -f1)
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| while read tld; do echo "$ROOT.$tld"; done \
| httpx -silent -mc 200 > tlds_alive.txt
# Apply to all known subdomains
cat all_subs.txt | while read sub; do
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| sed "s/^/$sub./"
done | dnsx -silent > subs_tld_expanded.txt
# Map which domains belong to which IP
cat unique_ips.txt | while read ip; do
echo -n "$ip: "
grep -l "$ip" resolved.txt 2>/dev/null | tr '\n' ' '
echo
done > ip_to_domain_map.txt
# Identify shared infrastructure (one IP serving multiple domains — CDN or reverse proxy)
awk '{if (NF > 2) print}' ip_to_domain_map.txt > shared_infra.txt
# Scan non-web ports on ALL discovered IPs
naabu -l all_ips.txt -p - -rate 1000 -c 50 -exclude-ports 80,443 -o all_services.txt
# Extract all company/organization names from whois
cat all_ips.txt | while read ip; do
whois $ip 2>/dev/null | grep -iE "OrgName|org-name|descr:" | head -1
done | sort -u > subsidiary_names.txt
# For each subsidiary, repeat the ASN → CIDR pipeline
cat subsidiary_names.txt | while read org; do
metabigor net --org "$org" >> expanded_cidr.txt
done
subdomain-enumeration — Generate the initial subdomain list before expanding to IP infrastructure.origin-ip-discovery — Once CIDR ranges are known, identify which IPs are origins behind CDN.vhost-enumeration — Scan discovered IPs for hidden virtual hosts.port-mass-scan — Scan all discovered IPs for exposed services.Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
Based on SOC occupation classification
