Actually, it's not that difficult. The v4 blocks assigned to DoD are quite well known, but that's a pretty large swath by itself (/8's), so one would want to tighten the target a little. That's not a hard task at all.
If you wanted to figure it out starting with something like whitehouse.gov is a bad place to begin. That's a public facing media engine at best, not really used for "government" per se. In fact, it's likely not even homed on a DoD or GOV network. Many of the media engine type sites in the government are outsourced to third party hosting.
You'd want to find something more specific, like perhaps a protected access web system, like a Sharepoint portal or website, or even a mail relay conveniently pointed out by an MX record. Trace that system back and you likely will find either its reverse proxy, a front end system, or an SMTP entry point. This gives you the parameter subnet (DMZ) that you can probe from there. Then, using available DNS records, you could start mapping out the parameter looking for proxies, mail relays, and web servers. If you had access to web traffic logs you could use them as well to look for egress points from networks. If you had e-mail traffic to look at you'd likely see leaked internal subnets as well in the headers. However, this would only work for services they have blessed for access to the public internet.
It is absolutely no different than how you'd map any other network.
If you wanted to figure it out starting with something like whitehouse.gov is a bad place to begin. That's a public facing media engine at best, not really used for "government" per se. In fact, it's likely not even homed on a DoD or GOV network. Many of the media engine type sites in the government are outsourced to third party hosting.
You'd want to find something more specific, like perhaps a protected access web system, like a Sharepoint portal or website, or even a mail relay conveniently pointed out by an MX record. Trace that system back and you likely will find either its reverse proxy, a front end system, or an SMTP entry point. This gives you the parameter subnet (DMZ) that you can probe from there. Then, using available DNS records, you could start mapping out the parameter looking for proxies, mail relays, and web servers. If you had access to web traffic logs you could use them as well to look for egress points from networks. If you had e-mail traffic to look at you'd likely see leaked internal subnets as well in the headers. However, this would only work for services they have blessed for access to the public internet.
It is absolutely no different than how you'd map any other network.