Information Gathering and Reconnaissance Flashcards
6 cards from real EJPT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Gathering and Reconnaissance flashcards as text
A penetration tester is in the initial phase of an assessment and wants to gather information about a target company without directly interacting with its systems. Which of the following approaches is most appropriate?
Answer: Querying public WHOIS records and analyzing DNS information.
Querying public WHOIS records and analyzing DNS information are forms of passive reconnaissance. This method relies on publicly available data and does not involve sending packets directly to the target's infrastructure, making it ideal for initial, non-intrusive information gathering. The other options are all forms of active reconnaissance which involve direct interaction.
During a web application reconnaissance, a tester discovers a `robots.txt` file. What is the primary purpose of this file from a security perspective?
Answer: To suggest which directories search engines should not index, potentially revealing sensitive paths.
The `robots.txt` file is used to instruct search engine crawlers on which pages or directories of a website should not be indexed. For a penetration tester, this can be a valuable source of information, as it often points to directories that the website owner wants to keep private, such as administrative panels or resource folders, which may not be as hardened as public-facing parts of the site.
A junior penetration tester is tasked with finding subdomains for a target domain. Which of the following tools is specifically designed for subdomain enumeration using various public sources and brute-force techniques?
Answer: Sublist3r
Sublist3r is a Python-based tool specifically created to enumerate subdomains of websites by leveraging OSINT. It aggregates results from various search engines like Google and Bing, as well as services like VirusTotal and Netcraft, and can also perform brute-forcing to find more subdomains. Nmap is for network scanning, Wireshark for packet analysis, and Metasploit is an exploitation framework.
Which of the following Nmap commands would be used to perform a fast scan of the 100 most common ports on a target, discover service versions, and run default scripts, while treating the host as online and skipping the host discovery phase?
Answer: nmap -Pn -F -sV -sC 192.168.1.100
The command `nmap -Pn -F -sV -sC 192.168.1.100` breaks down as follows: `-Pn` skips host discovery and assumes the host is online. `-F` specifies a fast scan, which covers the 100 most common ports. `-sV` enables service version detection. `-sC` runs the default set of Nmap scripts. This combination precisely meets all the requirements of the scenario.
A penetration tester is performing OSINT on a target company and wants to gather employee names, email addresses, and subdomains from public sources like search engines. Which tool is best suited for this task?
Answer: theHarvester
theHarvester is an OSINT tool designed to gather emails, names, subdomains, IPs, and URLs from various public sources like search engines (Google, Bing) and PGP key servers. It's a staple in the passive information gathering phase of a penetration test. Gobuster is for directory/subdomain brute-forcing, Nikto is a web scanner, and Hydra is a password cracker.
When comparing active and passive reconnaissance, which of the following is a primary characteristic of active reconnaissance?
Answer: It involves direct interaction with the target's systems, creating network traffic that can be logged.
Active reconnaissance is defined by its direct engagement with the target's infrastructure. Activities like port scanning, banner grabbing, and sending DNS queries directly to the target's servers generate network traffic that can trigger alerts and be logged by security systems. In contrast, passive reconnaissance is stealthier because it uses third-party sources.