CREST OSINT & Reconnaissance Techniques 3

Question 1

What is the primary purpose of 'Google hacking' (Google dorking) in a penetration testing engagement?

Accepted Answer

Using advanced search operators to find sensitive information and misconfigured systems indexed by Google

Answer

Google dorking uses advanced search operators to uncover sensitive files, misconfigured directories, login portals, and exposed credentials indexed by Google.

Question 2

What is the Wayback Machine (web.archive.org) primarily used for during OSINT investigations?

Accepted Answer

Accessing historical archived snapshots of websites to find previously exposed information

Answer

The Wayback Machine archives historical website snapshots, allowing investigators to find information that was previously public but has since been removed, such as old directories or configuration pages.

Question 3

According to CREST penetration testing methodology, during which phase should OSINT and reconnaissance be conducted?

Accepted Answer

Pre-engagement and reconnaissance, before active testing begins

Answer

OSINT is conducted during the pre-engagement and reconnaissance phase to build maximum intelligence about the target before any active probing or exploitation begins.

Question 4

Why is identifying an organization's CIDR blocks an important step in OSINT during scope definition?

Accepted Answer

To map all IP address ranges owned by the target, ensuring complete and accurate test scope

Answer

Identifying CIDR blocks maps the complete IP address ranges owned by the target, which is essential to correctly define the authorized testing scope and avoid out-of-scope systems.

Question 5

Which technique involves querying historical DNS resolution data to find IP addresses previously associated with a domain?

Accepted Answer

Passive DNS analysis

Answer

Passive DNS analysis queries databases of historical DNS records to find IP addresses a domain has resolved to over time, without sending queries to the target's DNS servers.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST OSINT & Reconnaissance Techniques 3