<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-autonomous-system-mapping
description: >-
  Map autonomous systems, BGP routes, IP ranges, and peering relationships
  to understand an organization's network infrastructure and identify
  all associated IP space.
domain: cybersecurity
subdomain: osint-recon
tags:
  - autonomous-system
  - bgp-analysis
  - ip-range-discovery
  - network-mapping
  - asn-lookup
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  asnmap, amass, BGPView, RIPE RIS, Hurricane Electric BGP Toolkit,
  Team Cymru, Shodan, Censys, ipinfo.io, whois.
metadata:
  mitre-attack:
    - "T1590.004"  # Gather Victim Network Information: Network Topology
    - "T1590.005"  # Gather Victim Network Information: IP Addresses
    - "T1596.002"  # Search Open Technical Databases: WHOIS/DNS
---

# Performing Autonomous System Mapping

## Overview

Autonomous System (AS) mapping identifies all IP address space owned or
operated by a target organization. By querying BGP routing data, WHOIS
registries, and internet routing databases, analysts discover IP ranges,
peering relationships, upstream providers, and geographically distributed
infrastructure. This reveals the full network footprint beyond what DNS
enumeration alone provides.

## Prerequisites

- asnmap from ProjectDiscovery for AS number discovery
- amass intel module for ASN discovery
- whois CLI for registry queries
- BGP toolkit access (Hurricane Electric, BGPView, RIPE RIS)
- ipinfo.io API key for enrichment

```bash
go install github.com/projectdiscovery/asnmap/cmd/asnmap@latest
go install -v github.com/owasp-amass/amass/v4/...@master
pip install ipwhois cymruwhois
```

## Quick Reference

| Task | Command |
|------|---------|
| ASN lookup | `asnmap -d target.com -silent` |
| ASN to CIDRs | `asnmap -a AS12345 -silent` |
| Amass ASN | `amass intel -org "Target Corp" -asn` |
| WHOIS ASN | `whois -h whois.radb.net -- "-i origin AS12345"` |
| BGPView API | `curl -s "https://api.bgpview.io/asn/12345/prefixes"` |
| IP to ASN | `curl -s "https://api.bgpview.io/ip/1.2.3.4"` |
| Team Cymru | `echo "1.2.3.4" \| nc whois.cymru.com 43` |
| RIPE lookup | `curl -s "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS12345"` |

## Workflow

### Step 1: Discover AS Numbers

```bash
# asnmap — domain to ASN mapping
asnmap -d target.com -silent -json -o asn_results.json

# Amass intel — organization name to ASN
amass intel -org "Target Corporation" -o amass_asn.txt

# Manual whois lookup
whois -h whois.radb.net -- "-i origin AS12345" | grep -E "^route"
```

### Step 2: Enumerate IP Prefixes

```bash
# BGPView API — all prefixes for an ASN
curl -s "https://api.bgpview.io/asn/12345/prefixes" \
  | jq -r '.data.ipv4_prefixes[].prefix'

# RIPE RIS — announced prefixes
curl -s "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS12345" \
  | jq -r '.data.prefixes[].prefix'

# asnmap — ASN to CIDR ranges
asnmap -a AS12345 -silent > cidrs.txt
```

### Step 3: Map Peering Relationships

```bash
# BGPView — peer ASNs
curl -s "https://api.bgpview.io/asn/12345/peers" \
  | jq '.data.ipv4_peers[] | {asn: .asn, name: .name, description: .description}'

# RIPE RIS — BGP routing data
curl -s "https://stat.ripe.net/data/asn-neighbours/data.json?resource=AS12345" \
  | jq '.data.neighbours[] | {asn: .asn, type: .type}'

# Hurricane Electric BGP Toolkit (manual)
# https://bgp.he.net/AS12345
```

### Step 4: Reverse IP Enrichment

```bash
# Shodan — scan ASN IP space
shodan search "asn:AS12345" --fields ip_str,port,product,hostnames --limit 1000

# Censys — enumerate hosts in prefix
censys search "autonomous_system.asn: 12345" \
  -f ip,services.port,services.service_name

# ipinfo.io — IP range details
curl -s "https://ipinfo.io/AS12345?token=$IPINFO_TOKEN" | jq '.prefixes'
```

### Step 5: Historical BGP Analysis

```bash
# RIPE RIS — routing history
curl -s "https://stat.ripe.net/data/routing-history/data.json?resource=AS12345&starttime=2024-01-01" \
  | jq '.data.by_origin[].prefixes'

# Check for BGP hijack indicators
curl -s "https://stat.ripe.net/data/rpki-validation/data.json?resource=AS12345&prefix=1.2.3.0/24"
```

## Detection Opportunities

- WHOIS and BGP queries are passive and rarely logged by targets
- Shodan/Censys scanning of ASN ranges may trigger IDS on target networks
- Bulk reverse DNS on IP ranges generates detectable query patterns
- RPKI validation queries are fully passive

## Verification

- [ ] All AS numbers associated with target identified
- [ ] IPv4 and IPv6 prefix ranges enumerated
- [ ] Peering relationships and upstream providers mapped
- [ ] IP ranges enriched with service and hostname data
- [ ] Historical routing changes analyzed for infrastructure shifts
- [ ] Results correlated with DNS and subdomain findings

## References

- [asnmap](https://github.com/projectdiscovery/asnmap)
- [BGPView](https://bgpview.io/)
- [RIPE RIS](https://ris.ripe.net/)
- [Hurricane Electric BGP Toolkit](https://bgp.he.net/)
- [Team Cymru](https://www.team-cymru.com/)
- [ipinfo.io](https://ipinfo.io/)

---
v1.0 | Validated: 2026-03-17
