Next Generation Web Scanning

Next generation web scanning
New Zealand: A case study
First presented at KIWICON III 2009
By Andrew Horton
aka urbanadventurer

---

NZ Web Recon
Goal: To scan all of New Zealand's web-space to see
what's there.
Requirements:
– Targets
– Scanning
– Analysis
Sounds easy, right?
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

Targets
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

Targets
What does 'NZ web-space' mean?
It could mean:
•Geographically within NZ regardless of the TLD
•The .nz TLD hosted anywhere
•All of the above
For this scan it means, IPs geographically within
NZ
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

Finding Targets
We need creative methods to find targets
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

DNS Zone Transfer
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

Find IP addresses on IRC and by
resolving lots of NZ websites
58.*.*.*
60.*.*.*
65.*.*.*
91.*.*.*
110.*.*.*
111.*.*.*
113.*.*.*
114.*.*.*
115.*.*.*
116.*.*.*
117.*.*.*
118.*.*.*
119.*.*.*
120.*.*.*
121.*.*.*
122.*.*.*
123.*.*.*
124.*.*.*
125.*.*.*
130.*.*.*
131.*.*.*
132.*.*.*
138.*.*.*
139.*.*.*
143.*.*.*
144.*.*.*
146.*.*.*
150.*.*.*
153.*.*.*
156.*.*.*
161.*.*.*
162.*.*.*
163.*.*.*
165.*.*.*
166.*.*.*
167.*.*.*
192.*.*.*
198.*.*.*
202.*.*.*
203.*.*.*
210.*.*.*
218.*.*.*
219.*.*.*
222.*.*.*
729,580,500 IPs. More than we want to try.
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

IP address blocks in the IANA IPv4
Address Space Registry
Prefix Designation Date Whois
Status [1]
-----
------
----
-----
----------
000/8 IANA - Local Identification 1981-09 RESERVED
001/8 IANA UNALLOCATED
002/8 RIPE NCC 2009-09 whois.ripe.net ALLOCATED
003/8 General Electric Company 1994-05 LEGACY
201/8 LACNIC 2003-04 whois.lacnic.net ALLOCATED
202/8 APNIC 1993-05 whois.apnic.net ALLOCATED
203/8 APNIC 1993-05 whois.apnic.net ALLOCATED
204/8 ARIN 1994-03 whois.arin.net ALLOCATED
205/8 ARIN 1994-03 whois.arin.net ALLOCATED
206/8 ARIN 1995-04 whois.arin.net ALLOCATED
207/8 ARIN 1995-11 whois.arin.net ALLOCATED
208/8 ARIN 1996-04 whois.arin.net ALLOCATED
209/8 ARIN 1996-06 whois.arin.net ALLOCATED
210/8 APNIC 1996-06 whois.apnic.net ALLOCATED
211/8 APNIC 1996-06 whois.apnic.net ALLOCATED
This list has 663,255,000 IPs. More than we want to try.
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

Failed methods to find targets
• DNS Zone transfers from top level domain
name servers
• Learn IP address ranges for well known
national websites and networks
• All IP addresses allocated to APNIC (Asia
Pacific NIC)
We need new methods to find IP addresses and
website hostnames for New Zealand
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---

geoipgen and the
MaxMind GeoIP database
Use MaxMind’s free database of IP to Country allocations
Homepage: www.morningstarsecurity.com/research/geoipgen
Produces 6,319,348 New Zealand IP addresses
urbanadventurer (Andrew Horton)
www.morningstarsecurity.com

---