{"id":20563707,"url":"https://github.com/trustedsec/hardcidr","last_synced_at":"2025-04-06T10:14:27.445Z","repository":{"id":18794912,"uuid":"85326659","full_name":"trustedsec/hardcidr","owner":"trustedsec","description":"hardCIDR is a Linux Bash script, but also functions under macOS. Your mileage may vary on other distros. The script with no specified options will query ARIN and a pool of BGP route servers. The route server is selected at random at runtime. ","archived":false,"fork":false,"pushed_at":"2022-02-04T17:10:44.000Z","size":3133,"stargazers_count":369,"open_issues_count":0,"forks_count":55,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-03-30T09:06:16.179Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/trustedsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-03-17T15:26:03.000Z","updated_at":"2025-03-22T11:17:56.000Z","dependencies_parsed_at":"2022-08-07T09:00:57.227Z","dependency_job_id":null,"html_url":"https://github.com/trustedsec/hardcidr","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2Fhardcidr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2Fhardcidr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2Fhardcidr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/trustedsec%2Fhardcidr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/trustedsec","download_url":"https://codeload.github.com/trustedsec/hardcidr/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247464226,"owners_count":20942970,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T04:20:24.072Z","updated_at":"2025-04-06T10:14:27.425Z","avatar_url":"https://github.com/trustedsec.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# hardCIDR\n\n## Background\nA Linux Bash script to discover the netblocks, or ranges, (in CIDR notation) \nowned by the target organization during the intelligence gathering phase of \na penetration test. This information is maintained by the five Regional Internet \nRegistries (RIRs):\n\n*ARIN*    (North America)  \n*RIPE*   (Europe/Asia/Middle East)  \n*APNIC*   (Asia/Pacific)  \n*LACNIC*  (Latin America)  \n*AfriNIC*  (Africa)  \n\nIn addition to netblocks and IP addresses, Autonomous System Numbers (ASNs) are \nalso of interest. ASNs are used as part of the Border Gateway Protocol (BGP) for \nuniquely identifying each network on the Internet. Target organizations may have \ntheir own ASNs due to the size of their network or as a result of redundant service \npaths from peered service providers. These ASNs will reveal additional netblocks \nowned by the organization.\n\n## Requirements\nipcalc\t(for RIPE, APNIC, LACNIC, AfriNIC queries)\n\n## LACNIC\nA note on LACNIC before diving into the usage. LACNIC only allows query of either \nnetwork range, ASN, Org Handle, or PoC Handle. This does not help us in locating \nthese values based upon the organization name. They do however publish a list of \nall assigned ranges on a publically accessible FTP server, along with their \nrate-limiting thresholds. So, there is an accompanying data file, which the script \nchecks for, used to perform LACNIC queries locally. The script includes an update \noption **-r**, that can be used to update this data on an interval of your choosing. \nApproximate run time is just shy of 28 hours.\n\n## Usage\nThe script with no specified options will query ARIN and a pool of BGP route servers. \nThe route server is selected at random at runtime. The **-h** option lists the help:\n\n![](https://www.trustedsec.com/wp-content/uploads/2017/03/img1.png)\n\nThe options may be used in any combination, all, or none. Unfortunately, none of the \n“other” RIRs note the actual CIDR notation of the range, so `ipcalc` is used to perform \nthis function. If it is not installed on your system, the script will install it for you.\n\nAt the prompts, enter the organization name, the email domain, and whether country codes \nare used as part of the email. If answered **Y** to country codes, you will be prompted as \nto whether they precede the domain name or are appended to the TLD. A directory will be \ncreated for the output files in /tmp/. If the directory is found to exist, you will be \nprompted whether to overwrite. If answered **N**, a time stamp will be appended to the \ndirectory name.\n\n![](https://www.trustedsec.com/wp-content/uploads/2017/03/img2.png)\n\nThe script queries each RIR, as well as a BGP route server, prompting along the way as \nto whether records were located. Upon completion, three files will be generated: a CSV \nbased on Org Handle, a CSV based on PoC Handle, and a line delimited file of all located \nraanges in CIDR notation.\n\n![](https://www.trustedsec.com/wp-content/uploads/2017/03/img3.png)\n\nCancelling the script at any time will remove any temporary working files and the directory \ncreated for the resultant output files.\n\n![](https://www.trustedsec.com/wp-content/uploads/2017/03/img4.png)\n\nIt should be noted that, due to similarity in some organization names, you could get back \nresults not related to the target. The CSV files will provide the associated handles and \nURLs for further validation where necessary. It is also possible that employees of the \ntarget organization used their corporate email address to register their own domains. \nThese will be found within the results as well.\n\n## Running with Docker\n\n```\ndocker build -t hardcidr .\n```\n\nBuilding the hardcidr image\n\n```\ndocker run -v $(pwd):/tmp -it hardcidr\n```\n\nRunning the container. Output will be saved to current directory\n\n## Additional Information\nFor more information, check out the blog post on the TrustedSec website:\n[Classy Inter-Domain Routing Enumeration](https://www.trustedsec.com/blog/classy-inter-domain-routing-enumeration/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustedsec%2Fhardcidr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftrustedsec%2Fhardcidr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftrustedsec%2Fhardcidr/lists"}