CREST OSINT & Reconnaissance Techniques 1 — Questions and Answers
Question 1: What does OSINT stand for in the context of penetration testing and intelligence gathering?
- Open System Information Network
- Open Source Intelligence (Correct answer)
- Operational Security Intelligence
- Online Security Information Technology
Correct answer: Open Source Intelligence
OSINT stands for Open Source Intelligence, referring to intelligence gathered from publicly available sources without direct interaction with the target.
Question 2: Which search engine is primarily used to discover internet-connected devices and their exposed service banners?
- Bing
- Shodan (Correct answer)
- DuckDuckGo
Correct answer: Shodan
Shodan indexes internet-connected devices and their banners, making it invaluable for finding exposed services, open ports, and vulnerable systems.
Question 3: Which Google dork operator is used to restrict search results to a specific domain during OSINT?
- inurl:
- site: (Correct answer)
- filetype:
- intitle:
Correct answer: site:
The 'site:' operator in Google advanced search restricts all results to a specified domain or subdomain.
Question 4: What is the primary purpose of WHOIS lookups during the reconnaissance phase of a CREST penetration test?
- To scan for open ports on a target
- To enumerate web application vulnerabilities
- To gather domain registration and ownership information (Correct answer)
- To find SQL injection entry points
Correct answer: To gather domain registration and ownership information
WHOIS lookups reveal domain registration details including registrant contact information, registration dates, expiry, and name servers.
Question 5: In penetration testing methodology, what term describes gathering information about a target exclusively from public sources before active testing begins?
- Exploitation
- Footprinting (Correct answer)
- Lateral movement
- Pivoting
Correct answer: Footprinting
Footprinting is the process of systematically gathering publicly available information about a target to build an intelligence profile prior to active engagement.
Question 6: What valuable reconnaissance data can be extracted from Certificate Transparency (CT) logs?
- Open port listings and running services
- Subdomains and SANs listed in issued SSL/TLS certificates (Correct answer)
- Employee usernames and email addresses
- Source code of web applications
Correct answer: Subdomains and SANs listed in issued SSL/TLS certificates
Certificate Transparency logs record all publicly issued SSL/TLS certificates, revealing subdomains listed in Subject Alternative Names (SANs).
Question 7: Which DNS record type is most useful during OSINT to identify an organization's mail server infrastructure?
- A record
- CNAME record
- MX record (Correct answer)
- PTR record
Correct answer: MX record
MX (Mail Exchanger) records specify the mail servers responsible for accepting email for a domain, directly revealing email infrastructure.
CREST OSINT & Reconnaissance Techniques 1
What does OSINT stand for in the context of penetration testing and intelligence gathering?