用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/uphiago/recon-skills --skill asn-infrastructure-mapping命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Full WSTG-aligned web application pentest — 12-phase methodology from information gathering through reporting, with concrete commands, expected outputs, pitfalls, and verification per phase.
Attack SAML SSO via XSW, signature strip, metadata extract.
Use when two or more verified findings may combine into a higher-impact authorized attack path.
基于 SOC 职业分类
正在显示 SKILL.md
| name | asn-infrastructure-mapping |
| description | Map organization IP infrastructure via ASN, CIDR, TLD expansion, and reverse DNS. |
| version | 1.1.0 |
| revision_date | "2026-07-25T00:00:00.000Z" |
| license | MIT |
| platforms | ["linux"] |
| compatibility | Requires curl, dnsx, httpx |
| tags | ["recon","ASN","CIDR","IP-range","TLD","reverse-DNS","infrastructure"] |
| category | recon |
| related_skills | ["subdomain-enumeration","origin-ip-discovery","vhost-enumeration","port-mass-scan"] |
Map an organization's entire IP infrastructure by pivoting from domain to ASN (Autonomous System Number), extracting CIDR ranges, and discovering every hostname and service across all owned IP blocks. Includes TLD expansion to find sibling domains on different top-level domains with separate infrastructure.
terminal whois, dnsx, mapcidr, httpx, and asnmap.# Start: domain → IP → ASN → CIDR ranges
IP=$(dig target.com +short | head -1)
ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
echo "ASN: $ASN"
whois -h whois.radb.net -- "-i origin $ASN" | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u
# asnmap — automated domain → ASN
asnmap -d target.com
# Manual whois approach
IP=$(dig target.com +short | head -1)
whois $IP | grep -iE "origin|OriginAS|route:|descr:" | head -10
# spk — finds all ASNs for a company by name (including subsidiaries)
spk -json -s "Company Name"
# Webtools
# https://bgp.he.net — search by company name
# https://asnlookup.com — search by org name, ASN, or CIDR
# asnmap — direct CIDR extraction
asnmap -a AS33905 -silent > cidr_ranges.txt
# RADB whois — full route objects
whois -h whois.radb.net -- "-i origin AS33905" \
| grep -Eo "([0-9.]+){4}/[0-9]+" \
| sort -u >> cidr_ranges.txt
# metabigor — multi-source IP intelligence
echo "Company Name" | metabigor net --org -o cidr_ranges.txt
echo "ASN33905" | metabigor net --asn -o cidr_ranges.txt
# mapcidr — split CIDR into flat IP list
cat cidr_ranges.txt | mapcidr -silent > all_ips.txt
wc -l all_ips.txt
# prips — alternative IP generator
while read cidr; do prips "$cidr"; done < cidr_ranges.txt >> all_ips.txt
# Scan discovered IPs for live web services
cat all_ips.txt | httpx \
-ports 80,443,8080,8443,3000,5000,8000,8888,9090,9443 \
-status-code -title -web-server -silent \
-o live_ip_services.txt
# dnsx PTR — resolve hostnames from IP blocks
cat cidr_ranges.txt | dnsx -silent -resp-only -ptr > ptr_domains.txt
# Filter for target-related hosts
grep -i "target" ptr_domains.txt > ptr_target.txt
# hakrevdns — reverse DNS at scale
hakrevdns -d target.com -R resolvers.txt
# resolveDomains — check which IPs serve target content
resolveDomains -d all_subs.txt > resolved.txt
awk '{print $3}' resolved.txt | sort -u > unique_ips.txt
# tldbrute — discover all registered TLD variants
tldbrute -d target.com
# Manual IANA TLD list approach
wget -q https://data.iana.org/TLD/tlds-alpha-by-domain.txt
ROOT=$(echo "target.com" | cut -d. -f1)
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| while read tld; do echo "$ROOT.$tld"; done \
| httpx -silent -mc 200 > tlds_alive.txt
# Apply to all known subdomains
cat all_subs.txt | while read sub; do
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
| sed "s/^/$sub./"
done | dnsx -silent > subs_tld_expanded.txt
# Map which domains belong to which IP
cat unique_ips.txt | while read ip; do
echo -n "$ip: "
grep -l "$ip" resolved.txt 2>/dev/null | tr '\n' ' '
echo
done > ip_to_domain_map.txt
# Identify shared infrastructure (one IP serving multiple domains — CDN or reverse proxy)
awk '{if (NF > 2) print}' ip_to_domain_map.txt > shared_infra.txt
# Scan non-web ports on ALL discovered IPs
naabu -l all_ips.txt -p - -rate 1000 -c 50 -exclude-ports 80,443 -o all_services.txt
# Extract all company/organization names from whois
cat all_ips.txt | while read ip; do
whois $ip 2>/dev/null | grep -iE "OrgName|org-name|descr:" | head -1
done | sort -u > subsidiary_names.txt
# For each subsidiary, repeat the ASN → CIDR pipeline
cat subsidiary_names.txt | while read org; do
metabigor net --org "$org" >> expanded_cidr.txt
done
subdomain-enumeration — Generate the initial subdomain list before expanding to IP infrastructure.origin-ip-discovery — Once CIDR ranges are known, identify which IPs are origins behind CDN.vhost-enumeration — Scan discovered IPs for hidden virtual hosts.port-mass-scan — Scan all discovered IPs for exposed services.