finding asn and finding the ips for a company for recon:
Command curl -s https://api.bgpview.io/search?query_term=paypal | jq Figure 2.3 BGPview API query results. Alternatively, Nmap script “target-asn” can also be utilized for extracting IP ranges based upon an ASN. For instance, the following script will reveal results against ASN “26444”. Command nmap --script targets-asn --script-args targets-asn.asn=26444
Reverse IP lookup involves querying an IP address to identify domains hosted on the same IP address. This is popular across shared hosting environments, where multiple domains are hosted on same IP address. There are various online tools available providing the ability to perform a reverse IP look, such as YouGetSignal, ViewDNS.info, rapiddns.io, and many others
Alternatively, we can use curl command to extract domain information from RapidDNS for a specific IP range associated with PayPal. Command curl -s 'https://rapiddns.io/sameip/64.4.250.0/24?full =1#result' | grep 'target=" ' -B1 | egrep -v '(--|) ' | rev | cut -c 6- | rev | cut -c 5- | sort -u