eJPT Information Gathering and Reconnaissance 3 — Questions and Answers
Question 1: What information does the `traceroute` command provide during reconnaissance?
- Open ports on the target
- The network path and hops between source and destination (Correct answer)
- DNS records for the target
- WHOIS registration data
Correct answer: The network path and hops between source and destination
Traceroute reveals each network hop (router) between the source and destination, helping map network topology.
Question 2: An attacker queries `shodan.io` for a target company's IP range. This is an example of which reconnaissance method?
- Active reconnaissance
- Passive reconnaissance (Correct answer)
- Physical reconnaissance
- Social engineering
Correct answer: Passive reconnaissance
Querying Shodan retrieves data collected by third parties without directly touching the target, making it passive reconnaissance.
Question 3: Which Nmap scan type sends only SYN packets and never completes the TCP handshake, making it stealthier?
- -sT (TCP Connect)
- -sU (UDP)
- -sS (SYN Stealth) (Correct answer)
- -sA (ACK)
Correct answer: -sS (SYN Stealth)
The SYN scan (`-sS`) sends a SYN packet and, upon receiving SYN-ACK, sends RST without completing the 3-way handshake, leaving fewer logs.
Question 4: A tester uses `theHarvester` against a target domain. What type of information does this tool collect?
- Network packet captures
- Email addresses, subdomains, and employee names from public sources (Correct answer)
- Open ports and services
- Password hashes from databases
Correct answer: Email addresses, subdomains, and employee names from public sources
theHarvester gathers emails, subdomains, hosts, and employee names from search engines, LinkedIn, and other public sources.
Question 5: What does a 'wildcard DNS entry' (*.example.com) mean for subdomain enumeration?
- All subdomain queries will return NXDOMAIN
- Every subdomain query returns a valid response, making brute-force results unreliable (Correct answer)
- The domain has no subdomains
- The DNS zone transfer is enabled
Correct answer: Every subdomain query returns a valid response, making brute-force results unreliable
A wildcard entry makes all subdomain lookups resolve, so brute-force tools return false positives for every queried subdomain.
Question 6: Which HTTP response header can reveal the web server software and version during banner grabbing?
- Content-Type
- Server (Correct answer)
- Authorization
- Accept-Encoding
Correct answer: Server
The `Server` response header typically discloses the web server software (e.g., Apache/2.4.41) and can reveal attack surface details.
Question 7: During footprinting, a tester uses Google dork `filetype:pdf site:target.com`. What is the goal?
- Find all open ports on target.com
- Find PDF documents hosted on target.com (Correct answer)
- Identify email addresses at target.com
- Enumerate DNS records for target.com
Correct answer: Find PDF documents hosted on target.com
The `filetype:pdf site:target.com` Google dork searches for PDF files indexed by Google that belong to target.com.
eJPT Information Gathering and Reconnaissance 3
What information does the `traceroute` command provide during reconnaissance?