Maskfind

I wrote this because I couldn't find anything that could work out a remote subnet mask which is useful during the discovery phase of a penetration test. I noticed that sometimes people were missing some of the IP addresses on a router/firewall when port scanning a host.

As you can see in the diagram above, if somebody were to do a blind penetration test and they were to run a port scan against the web site's IP(x.236.50.2) after discovering the web site they would only come across 2 open ports. If they were to run maskfind against the websites IP after discovering the web site they would discover that the firewall actually has a /29 block assigned and then after port scanning all of the IP's they would be able to discover 4 open ports.

If you have any problems please post in the forums and I will help you out.