ASN and CIDR Mapping for Bug Bounty Scope Expansion

ASN and CIDR Mapping for Bug Bounty Scope Expansion

Some programs hand you a domain. Others hand you a legal entity and expect you to find their IP space. ASN and CIDR mapping is how you go from "Acme Corp" to a short list of netblocks worth resolving and probing—without pretending every address in a cloud ASN is fair game.

Name → org → ASN

Collect legal names, subsidiaries, and acquisition brands from the policy, press releases, and WHOIS on known company domains. Query PeeringDB, BGP view tools, and regional RIR whois for organisation objects. Note ASNs that list the company as the owner or maintainer.

Pull announced prefixes for those ASNs. You now have CIDRs. Stop. Not every prefix is equally useful.

Shared hosting and hyperscaler ASNs drown you. If the company only appears as a customer inside AS16509 (example pattern, not a universal claim), you need reverse WHOIS, RDAP remarks, or known seed IPs—not a scan of all of Amazon. Prefer ASNs the company operates themselves: office egress, hosting brands, regional ISPs under their name.

Seed IPs beat vanity AS data

From mail headers, SPF ip4: mechanisms, VPN configuration guides, and historical DNS A records, gather IPs that already belong to the target. Map those to ASN/CIDR, then expand to sibling prefixes under the same org object. That path produces fewer false friends than downloading an entire ASN dump.

Check for:

• Old data centers still announcing space after a cloud migration
• Acquired companies whose ASN never got renamed
• Dual announcements where only one prefix appears in scope notes

Document how each CIDR ties to the legal entity. Vague "might be them" blocks waste everyone's time.

From CIDR to assets you can test

Resolve PTR where it exists. Hunt certificates that include IPs or internal names. HTTP probe only rates and ports allowed by the program—many policies ban noisy sweeps across large ranges.

I've filed solid reports from a /24 that hosted a forgotten staging TLS cert with the corporate name, while a flashy /16 of shared cloud space produced nothing but abuse desk tickets. Smaller and attributed wins.

Mark cloud ranges carefully. An IP serving target.example today may be reassigned tomorrow. Prefer findings rooted in hostnames and certificates over "I found an open port in their ASN" alone, unless the program explicitly scores infrastructure issues.

RDAP and legacy WHOIS often disagree on contact emails and "remarks." Prefer the RIR object that matches the legal name in the bounty policy. Screenshot or quote that object in the report so triage can see the ownership chain without redoing your BGP homework.

Reporting the map

For recon-only submissions, keep it short: ASN, prefixes, evidence of ownership, and the interesting hosts derived. For vulnerabilities, the CIDR work is methodology background; lead with the bug on a concrete asset.

Recommend programs publish ASN/CIDR in scope when they want network testing. As a hunter, never assume acquisition brands or cloud customer space are included—ask or stick to named assets.

ASN mapping is a compass. It points at neighborhoods. You still need a door that is actually in scope.