OSINT Data Collection & Aggregation Tools 2 — Questions and Answers
Question 1: Which Maltego transform type is used to discover email addresses associated with a domain?
- DNS to IP
- Domain to Email Address (Correct answer)
- Whois to Registrant
- URL to Web Page
Correct answer: Domain to Email Address
Maltego's 'Domain to Email Address' transform queries OSINT sources to enumerate emails linked to a target domain.
Question 2: What does the tool 'theHarvester' primarily collect during passive reconnaissance?
- Malware signatures and hashes
- Emails, subdomains, IPs, and hostnames from public sources (Correct answer)
- Social media posts and hashtags
- Darkweb marketplace listings
Correct answer: Emails, subdomains, IPs, and hostnames from public sources
theHarvester aggregates emails, subdomains, IPs, and hostnames from search engines, PGP servers, and other open sources.
Question 3: In Recon-ng, what is the purpose of a 'module'?
- A database schema for storing results
- A discrete unit that performs a specific reconnaissance task (Correct answer)
- A reporting template for exporting findings
- A firewall rule bypassed during scanning
Correct answer: A discrete unit that performs a specific reconnaissance task
Each Recon-ng module performs a specific OSINT task such as querying an API, harvesting contacts, or enumerating hosts.
Question 4: Which protocol does Shodan primarily use to fingerprint internet-connected devices?
- SMTP banner grabbing
- Banner grabbing over service ports (e.g., HTTP, FTP, SSH) (Correct answer)
- ICMP ping sweeping
- ARP broadcast flooding
Correct answer: Banner grabbing over service ports (e.g., HTTP, FTP, SSH)
Shodan connects to service ports and captures banners to identify device type, software version, and configuration.
Question 5: What is the primary advantage of using SpiderFoot's automated workflows over manual OSINT collection?
- It bypasses CAPTCHA without detection
- It chains multiple data sources automatically to build a complete target profile (Correct answer)
- It accesses private databases without authentication
- It stores findings only in encrypted cloud storage
Correct answer: It chains multiple data sources automatically to build a complete target profile
SpiderFoot automates chaining across 200+ OSINT modules so that output from one module feeds into others, reducing manual pivoting.
Question 6: When aggregating data from multiple OSINT sources, what is 'data deconfliction'?
- Encrypting data before storage
- Resolving contradictions or duplicates across datasets to produce a single accurate record (Correct answer)
- Removing personally identifiable information before sharing
- Converting data from JSON to CSV format
Correct answer: Resolving contradictions or duplicates across datasets to produce a single accurate record
Data deconfliction involves identifying and resolving conflicts or duplicate entries so analysts work with a consistent, authoritative dataset.
Question 7: Which feature of Censys differentiates it from Shodan for certificate-based OSINT?
- Censys performs active port scanning only
- Censys indexes the full X.509 certificate chain including SANs, enabling discovery of related domains (Correct answer)
- Censys requires a commercial API key for all queries
- Censys only monitors IPv6 address space
Correct answer: Censys indexes the full X.509 certificate chain including SANs, enabling discovery of related domains
Censys parses and indexes complete certificate data including Subject Alternative Names (SANs), making it powerful for discovering additional domains tied to an organization.
OSINT Data Collection & Aggregation Tools 2
Which Maltego transform type is used to discover email addresses associated with a domain?