Listen to this Post
Introduction:
Traditional subdomain enumeration only reveals what DNS records expose, leaving a vast attack surface of forgotten servers, dev environments, and shadow IT completely hidden. Autonomous System Number (ASN) based reconnaissance bypasses DNS entirely by scanning the actual IP blocks a target legally owns, uncovering assets that have no domain names attached. This article builds a production‑ready reconnaissance pipeline using the ProjectDiscovery stack, turning ASN data into actionable vulnerability findings with minimal manual effort.
Learning Objectives:
- Understand ASNs, BGP, and how to map a target’s owned IP space using public routing databases.
- Build an automated four‑phase scanning workflow with mapcidr, naabu, httpx, and nuclei.
- Identify shadow IT, misconfigured services, and critical vulnerabilities without relying on DNS or brute‑force enumeration.
You Should Know:
1. Understanding Autonomous System Numbers (ASN) and BGP
An Autonomous System (AS) is a collection of IP prefixes under a single technical administration. The ASN uniquely identifies this entity. By discovering a target’s ASN, you obtain all CIDR blocks they announce to the internet – including networks that have no DNS records. Public BGP toolkits like bgp.he.net, whois.radb.net, or CLI tools provide this data.
Step‑by‑step to find a target’s ASN:
- Visit `https://bgp.he.net` and search for the target domain (e.g., “nasa.gov”). Note the ASN (NASA uses AS297).
- From the command line:
whois -h whois.radb.net -- '-i origin AS297' | grep -Eo '([0-9]{1,3}.){3}[0-9]{1,3}/[0-9]+' - Or use `asn` from the `bgptools` package:
asn -o 297
Linux/Windows note: These commands work natively on Linux. On Windows, use WSL or install `whois` via Cygwin. Alternatively, query the REST API of BGP‑looking glasses.
- Phase 1 – IP Range Extraction with mapcidr
Once you have the ASN, you need a clean list of CIDR blocks. `mapcidr` is a lightweight utility that expands ASNs, CIDRs, or IP ranges into individual IPs or formatted output.
Step‑by‑step guide:
1. Install mapcidr:
go install -v github.com/projectdiscovery/mapcidr/cmd/mapcidr@latest
2. Extract all CIDRs for a given ASN:
echo "AS297" | mapcidr -silent > nasa_cidrs.txt
Or using the `-asn` flag:
mapcidr -asn 297 -o nasa_cidrs.txt
3. Verify the output – you should see entries like 192.35.176.0/22, 128.102.0.0/16, etc.
What this does: It queries local ASN databases or public BGP feeds to resolve the ASN to its announced prefixes. The resulting file is your target’s entire legal IPv4 surface.
- Phase 2 – Mass Port Scanning with naabu
With the CIDR list, you now need to discover which IPs have open ports – especially those running web services (80, 443, 3000, 8080, 8443, etc.). `naabu` is a fast port scanner designed for large‑scale infrastructure.
Step‑by‑step guide:
1. Install naabu:
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
2. Run a scan against your CIDR file, focusing on common web ports with high concurrency:
naabu -list nasa_cidrs.txt -p 80,443,3000,8080,8443,8000,8888 -c 500 -o open_ports.txt
– `-list` – input file of CIDRs
– `-p` – ports to scan
– `-c` – concurrency (adjust based on your bandwidth and target tolerance)
– `-o` – output file with `ip:port` format
- For a quicker, less intrusive scan, add `-silent` and `-nmap-cli` to use Nmap’s service detection:
naabu -list nasa_cidrs.txt -top-ports 1000 -silent -nmap-cli 'nmap -sV -sC' > nmap_scan.txt
Linux/Windows: `naabu` binaries are available for both OSes. On Windows, run from Command Prompt or PowerShell after adding the binary to PATH.
-
Phase 3 – Live Service Verification with httpx
An open port does not guarantee a live web server. `httpx` quickly probes each `ip:port` to verify HTTP/HTTPS responses, collect titles, status codes, and technologies.
Step‑by‑step guide:
1. Install httpx:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
2. Filter live web hosts from your open ports list:
httpx -l open_ports.txt -o live_hosts.txt -status-code -title -tech-detect
– `-l` – input file with `ip:port` entries
– `-status-code` – show HTTP response codes
– `-title` – extract page title
– `-tech-detect` – identify frameworks (nginx, Apache, etc.)
- To ignore 404 or unwanted status codes, add
-exclude-code 404,403.
Output example:
https://192.35.176.10:443 [bash] [NASA Home] [bash] http://128.102.45.12:8080 [bash] [Admin Area] [bash]
What this does: It sends HTTP requests to each target, follows redirects, and saves only endpoints that answer with a valid web response – drastically reducing false positives.
- Phase 4 – Automated Vulnerability Scanning with nuclei
Now you have a verified list of live web applications. `nuclei` uses a templated engine to scan for known CVEs, misconfigurations, exposed panels, and default credentials.
Step‑by‑step guide:
1. Install nuclei:
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
2. Update your template library:
nuclei -update-templates
3. Run a scan focusing on high and critical severity findings:
nuclei -l live_hosts.txt -severity high,critical -o critical_findings.txt -stats -si 10
– `-severity high,critical` – ignore info and low risk alerts
– `-stats` – show real‑time progress
– `-si 10` – update stats every 10 seconds
- For a broader scan including medium severity, use
-severity high,medium,critical. To test a specific template:nuclei -l live_hosts.txt -tags cve,exposed-panels -o cve_only.txt
What this does: It matches each live endpoint against thousands of community‑maintained signatures, returning only actionable vulnerabilities.
6. Building the Full Automation Pipeline (Bash Script)
Chain all phases into a single script for continuous monitoring or scheduled reconnaissance. Below is a production‑ready example that runs on a lightweight VPS (Linux).
!/bin/bash ASN Recon Pipeline - Usage: ./asn_recon.sh AS297 ASN=$1 OUTPUT_DIR="asn_scan_$(date +%Y%m%d_%H%M%S)" mkdir -p $OUTPUT_DIR echo "[] Extracting CIDRs for $ASN" echo "$ASN" | mapcidr -silent > $OUTPUT_DIR/cidrs.txt echo "[] Running naabu port scan" naabu -list $OUTPUT_DIR/cidrs.txt -p 80,443,3000,8080,8443 -c 500 -o $OUTPUT_DIR/open_ports.txt echo "[] Verifying live web hosts with httpx" httpx -l $OUTPUT_DIR/open_ports.txt -o $OUTPUT_DIR/live_hosts.txt -status-code -silent echo "[] Launching nuclei vulnerability scan" nuclei -l $OUTPUT_DIR/live_hosts.txt -severity high,critical -o $OUTPUT_DIR/critical_findings.txt echo "[] Done. Results in $OUTPUT_DIR"
Schedule it with cron:
`0 2 1 /home/user/asn_recon.sh AS297 >> /var/log/asn_recon.log 2>&1` (weekly every Monday at 2 AM).
Windows alternative: Use PowerShell with `Invoke-WebRequest` to call web‑based BGP APIs, then invoke the same Go binaries if installed. For pure Windows native, consider `nmap` for port scanning and custom PowerShell scripts for HTTP probing.
7. Mitigation and Defensive Countermeasures
Blue teams can detect and protect against ASN‑based reconnaissance by monitoring BGP announcements, implementing network segmentation, and hiding non‑production assets.
Step‑by‑step guide for defenders:
- Log and alert on mass port scans – Use Snort/Suricata rules that trigger on sequential port sweeps from a single source. Example Snort rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 1:1024 (msg:"Port scan detected"; flags:S; threshold: type both, track by_src, count 20, seconds 10;)
- Block ICMP and unnecessary services on shadow IT assets – use firewall rules (iptables on Linux, Windows Firewall with PowerShell).
Linux - drop all inbound except established iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 80,443 -j ACCEPT iptables -A INPUT -j DROP
- Deploy a honeypot within your ASN’s unused IP space. Any traffic hitting those IPs indicates an attacker is using ASN‑based enumeration.
- Regularly audit DNS and IP space – maintain an asset inventory. Use tools like `OpenVAS` or `DefectDojo` to track all owned IPs and ensure no forgotten services are exposed.
What Undercode Say:
- Key Takeaway 1: ASN‑based recon is superior to subdomain enumeration for finding shadow IT – it reveals assets that never had a DNS record, often forgotten development servers and staging environments.
- Key Takeaway 2: The ProjectDiscovery stack (mapcidr, naabu, httpx, nuclei) provides a modular, scriptable pipeline that scales from a single ASN to global internet scanning with minimal resources.
- Analysis: Traditional vulnerability management relies on DNS as the source of truth, creating a blind spot for infrastructure without domain names. Attackers have used BGP and ASN data for years; defenders must adopt the same techniques. The pipeline demonstrated here can be executed from a $5 VPS, scanning thousands of IPs in minutes. However, such scanning against non‑authorized targets violates laws and policies – always obtain written permission or use public VDPs like NASA’s. For blue teams, integrating ASN monitoring into continuous asset discovery closes the gap between “known DNS” and “actual owned IP space”. The future will see AI‑powered correlation between ASN changes and emerging vulnerabilities, but the core workflow of IP‑first enumeration remains a fundamental skill.
Prediction:
As cloud adoption and ephemeral infrastructure grow, DNS records will increasingly lag behind actual IP usage. Attackers will shift toward ASN‑centric reconnaissance as a primary initial access vector, forcing security teams to adopt BGP monitoring and continuous IP space auditing. We predict that within two years, ASN mapping will become a standard component of both offensive red teaming and defensive asset management, integrated into commercial vulnerability scanners. Simultaneously, ISPs and cloud providers will begin offering real‑time ASN change alerts, and regulatory frameworks like PCI DSS may expand scope to include all IPs announced under an organization’s ASN – not just those with DNS entries.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Zlatanh Zero – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
