CREST OSINT & Reconnaissance Techniques 2 — Questions and Answers
Question 1: What is the primary function of the theHarvester tool in OSINT reconnaissance?
- Scanning target networks for open vulnerabilities
- Gathering emails, subdomains, and employee names from public search engines (Correct answer)
- Cracking password hashes obtained from target systems
- Exploiting web application injection vulnerabilities
Correct answer: Gathering emails, subdomains, and employee names from public search engines
theHarvester automates the collection of email addresses, subdomains, hostnames, and employee names from public sources including Google, Bing, and LinkedIn.
Question 2: What is 'metadata harvesting' in the context of OSINT document analysis?
- Collecting database schemas from target systems
- Extracting embedded information such as author names, software versions, and GPS coordinates from files (Correct answer)
- Gathering network topology diagrams from public sources
- Enumerating email server configuration details
Correct answer: Extracting embedded information such as author names, software versions, and GPS coordinates from files
Metadata harvesting extracts hidden embedded information from documents and images, including author details, software used, timestamps, and sometimes GPS coordinates.
Question 3: Which tool is specifically designed to extract and analyze metadata from publicly available documents to profile organizations?
- Nessus
- FOCA (Fingerprinting Organizations with Collected Archives) (Correct answer)
- OpenVAS
- Hydra
Correct answer: FOCA (Fingerprinting Organizations with Collected Archives)
FOCA is a tool that extracts metadata from documents found on the internet to reveal information about the target organization's internal structure and technology.
Question 4: What does ASN stand for, and why is identifying it important during network reconnaissance?
- Application Security Notification — used to report vulnerabilities to vendors
- Advanced Scanning Node — used to route probe packets
- Autonomous System Number — identifies IP ranges owned by an organization under a common routing policy (Correct answer)
- Attack Surface Navigator — used to map exploitable assets
Correct answer: Autonomous System Number — identifies IP ranges owned by an organization under a common routing policy
An Autonomous System Number (ASN) uniquely identifies a group of IP prefixes under a common routing policy, helping testers map all IP ranges belonging to a target organization.
Question 5: Which OSINT methodology involves analyzing an organization's job postings to infer details about their technology stack?
- Certificate transparency analysis
- Job intelligence gathering (Correct answer)
- Passive DNS enumeration
- Social graph mapping
Correct answer: Job intelligence gathering
Analyzing job postings reveals the specific technologies, tools, and products an organization uses, since employers list required technical skills and platforms.
Question 6: What is the primary advantage of passive OSINT reconnaissance compared to active scanning techniques?
- It provides more granular technical vulnerability details
- It is significantly faster to execute than active scans
- It does not generate traffic to the target, greatly reducing detection risk (Correct answer)
- It can bypass perimeter firewalls more effectively
Correct answer: It does not generate traffic to the target, greatly reducing detection risk
Passive reconnaissance gathers intelligence without directly interacting with the target, meaning the target's intrusion detection systems and logs will show no evidence of the activity.
Question 7: Which tool provides a graphical interface for mapping entity relationships—linking people, organizations, domains, and IP addresses from public sources?
- Wireshark
- Burp Suite
- Maltego (Correct answer)
- Metasploit
Correct answer: Maltego
Maltego uses transforms to discover and visualize connections between entities such as people, organizations, domains, and infrastructure from publicly available sources.
CREST OSINT & Reconnaissance Techniques 2
What is the primary function of the theHarvester tool in OSINT reconnaissance?