Information Gathering and Reconnaissance Flashcards

What information does the `traceroute` command provide during reconnaissance?

Answer: The network path and hops between source and destination

Traceroute reveals each network hop (router) between the source and destination, helping map network topology.

An attacker queries `shodan.io` for a target company's IP range. This is an example of which reconnaissance method?

Answer: Passive reconnaissance

Querying Shodan retrieves data collected by third parties without directly touching the target, making it passive reconnaissance.

Which Nmap scan type sends only SYN packets and never completes the TCP handshake, making it stealthier?

Answer: -sS (SYN Stealth)

The SYN scan (`-sS`) sends a SYN packet and, upon receiving SYN-ACK, sends RST without completing the 3-way handshake, leaving fewer logs.

A tester uses `theHarvester` against a target domain. What type of information does this tool collect?

Answer: Email addresses, subdomains, and employee names from public sources

theHarvester gathers emails, subdomains, hosts, and employee names from search engines, LinkedIn, and other public sources.

What does a 'wildcard DNS entry' (*.example.com) mean for subdomain enumeration?

Answer: Every subdomain query returns a valid response, making brute-force results unreliable

A wildcard entry makes all subdomain lookups resolve, so brute-force tools return false positives for every queried subdomain.

Which HTTP response header can reveal the web server software and version during banner grabbing?

Answer: Server

The `Server` response header typically discloses the web server software (e.g., Apache/2.4.41) and can reveal attack surface details.

During footprinting, a tester uses Google dork `filetype:pdf site:target.com`. What is the goal?

Answer: Find PDF documents hosted on target.com

The `filetype:pdf site:target.com` Google dork searches for PDF files indexed by Google that belong to target.com.