Maskfind
For finding remote subnet masks
I wrote this because I couldn't find anything that could work out a remote subnet mask which is useful during the discovery phase of a penetration test. I noticed that sometimes people were missing some of the IP addresses on a router/firewall when port scanning a host.
As you can see in the diagram above, if somebody were to do a blind penetration test and they were to run a port scan against the web site's IP(x.236.50.2) after discovering the web site they would only come across 2 open...