Next Generation Web Scanning

Text-only Preview

Next generation web scanning
New Zealand: A case study
First presented at KIWICON III 2009
By Andrew Horton
aka urbanadventurer

NZ Web Recon
Goal: To scan all of New Zealand's web-space to see
what's there.
Requirements:
– Targets
– Scanning
– Analysis
Sounds easy, right?
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

Targets
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

Targets
What does 'NZ web-space' mean?
It could mean:
•Geographically within NZ regardless of the TLD
•The .nz TLD hosted anywhere
•All of the above
For this scan it means, IPs geographically within
NZ
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

Finding Targets
We need creative methods to find targets
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

DNS Zone Transfer
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

Find IP addresses on IRC and by
resolving lots of NZ websites
58.*.*.*
60.*.*.*
65.*.*.*
91.*.*.*
110.*.*.*
111.*.*.*
113.*.*.*
114.*.*.*
115.*.*.*
116.*.*.*
117.*.*.*
118.*.*.*
119.*.*.*
120.*.*.*
121.*.*.*
122.*.*.*
123.*.*.*
124.*.*.*
125.*.*.*
130.*.*.*
131.*.*.*
132.*.*.*
138.*.*.*
139.*.*.*
143.*.*.*
144.*.*.*
146.*.*.*
150.*.*.*
153.*.*.*
156.*.*.*
161.*.*.*
162.*.*.*
163.*.*.*
165.*.*.*
166.*.*.*
167.*.*.*
192.*.*.*
198.*.*.*
202.*.*.*
203.*.*.*
210.*.*.*
218.*.*.*
219.*.*.*
222.*.*.*
729,580,500 IPs. More than we want to try.
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

IP address blocks in the IANA IPv4
Address Space Registry
Prefix Designation Date Whois
Status [1]
-----
------
----
-----
----------
000/8 IANA - Local Identification 1981-09 RESERVED
001/8 IANA UNALLOCATED
002/8 RIPE NCC 2009-09 whois.ripe.net ALLOCATED
003/8 General Electric Company 1994-05 LEGACY
201/8 LACNIC 2003-04 whois.lacnic.net ALLOCATED
202/8 APNIC 1993-05 whois.apnic.net ALLOCATED
203/8 APNIC 1993-05 whois.apnic.net ALLOCATED
204/8 ARIN 1994-03 whois.arin.net ALLOCATED
205/8 ARIN 1994-03 whois.arin.net ALLOCATED
206/8 ARIN 1995-04 whois.arin.net ALLOCATED
207/8 ARIN 1995-11 whois.arin.net ALLOCATED
208/8 ARIN 1996-04 whois.arin.net ALLOCATED
209/8 ARIN 1996-06 whois.arin.net ALLOCATED
210/8 APNIC 1996-06 whois.apnic.net ALLOCATED
211/8 APNIC 1996-06 whois.apnic.net ALLOCATED
This list has 663,255,000 IPs. More than we want to try.
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

Failed methods to find targets
• DNS Zone transfers from top level domain
name servers
• Learn IP address ranges for well known
national websites and networks
• All IP addresses allocated to APNIC (Asia
Pacific NIC)
We need new methods to find IP addresses and
website hostnames for New Zealand
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

geoipgen and the
MaxMind GeoIP database
Use MaxMind’s free database of IP to Country allocations
Homepage: www.morningstarsecurity.com/research/geoipgen
Produces 6,319,348 New Zealand IP addresses
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com