Asn Infrastructure Mapping

# Start: domain → IP → ASN → CIDR ranges
IP=$(dig target.com +short | head -1)
ASN=$(whois $IP | grep -i "origin\|OriginAS" | awk '{print $NF}' | head -1)
echo "ASN: $ASN"
whois -h whois.radb.net -- "-i origin $ASN" | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -u

# asnmap — automated domain → ASN
asnmap -d target.com

# Manual whois approach
IP=$(dig target.com +short | head -1)
whois $IP | grep -iE "origin|OriginAS|route:|descr:" | head -10

# spk — finds all ASNs for a company by name (including subsidiaries)
spk -json -s "Company Name"

# Webtools
# https://bgp.he.net — search by company name
# https://asnlookup.com — search by org name, ASN, or CIDR
# https://bgp.tools — modern BGP explorer

# asnmap — direct CIDR extraction
asnmap -a AS33905 -silent > cidr_ranges.txt

# RADB whois — full route objects
whois -h whois.radb.net -- "-i origin AS33905" \
  | grep -Eo "([0-9.]+){4}/[0-9]+" \
  | sort -u >> cidr_ranges.txt

# metabigor — multi-source IP intelligence
echo "Company Name" | metabigor net --org -o cidr_ranges.txt
echo "ASN33905" | metabigor net --asn -o cidr_ranges.txt

# mapcidr — split CIDR into flat IP list
cat cidr_ranges.txt | mapcidr -silent > all_ips.txt
wc -l all_ips.txt

# prips — alternative IP generator
while read cidr; do prips "$cidr"; done < cidr_ranges.txt >> all_ips.txt

# Scan discovered IPs for live web services
cat all_ips.txt | httpx \
  -ports 80,443,8080,8443,3000,5000,8000,8888,9090,9443 \
  -status-code -title -web-server -silent \
  -o live_ip_services.txt

# dnsx PTR — resolve hostnames from IP blocks
cat cidr_ranges.txt | dnsx -silent -resp-only -ptr > ptr_domains.txt

# Filter for target-related hosts
grep -i "target" ptr_domains.txt > ptr_target.txt

# hakrevdns — reverse DNS at scale
hakrevdns -d target.com -R resolvers.txt

# resolveDomains — check which IPs serve target content
resolveDomains -d all_subs.txt > resolved.txt
awk '{print $3}' resolved.txt | sort -u > unique_ips.txt

# tldbrute — discover all registered TLD variants
tldbrute -d target.com

# Manual IANA TLD list approach
wget -q https://data.iana.org/TLD/tlds-alpha-by-domain.txt
ROOT=$(echo "target.com" | cut -d. -f1)
cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
  | while read tld; do echo "$ROOT.$tld"; done \
  | httpx -silent -mc 200 > tlds_alive.txt

# Apply to all known subdomains
cat all_subs.txt | while read sub; do
  cat tlds-alpha-by-domain.txt | tr '[:upper:]' '[:lower:]' \
    | sed "s/^/$sub./"
done | dnsx -silent > subs_tld_expanded.txt

# Map which domains belong to which IP
cat unique_ips.txt | while read ip; do
  echo -n "$ip: "
  grep -l "$ip" resolved.txt 2>/dev/null | tr '\n' ' '
  echo
done > ip_to_domain_map.txt

# Identify shared infrastructure (one IP serving multiple domains — CDN or reverse proxy)
awk '{if (NF > 2) print}' ip_to_domain_map.txt > shared_infra.txt

# Scan non-web ports on ALL discovered IPs  
naabu -l all_ips.txt -p - -rate 1000 -c 50 -exclude-ports 80,443 -o all_services.txt

# Extract all company/organization names from whois
cat all_ips.txt | while read ip; do
  whois $ip 2>/dev/null | grep -iE "OrgName|org-name|descr:" | head -1
done | sort -u > subsidiary_names.txt

# For each subsidiary, repeat the ASN → CIDR pipeline
cat subsidiary_names.txt | while read org; do
  metabigor net --org "$org" >> expanded_cidr.txt
done