OSINT Domain & Infrastructure Analysis 3 — Questions and Answers
Question 1: An analyst uses Shodan and finds a device with the banner 'Server: Apache/2.2.3' on port 443. Why is this significant from an OSINT/security perspective?
- Apache 2.2.3 is a rare server version indicating a custom build
- Apache 2.2.3 is over 15 years old and has numerous known critical vulnerabilities (Correct answer)
- Port 443 should never run Apache
- Banner information cannot be trusted for version fingerprinting
Correct answer: Apache 2.2.3 is over 15 years old and has numerous known critical vulnerabilities
Apache 2.2.3 (released 2006) is end-of-life and has dozens of public CVEs, making its presence a major security finding.
Question 2: What does the BGP (Border Gateway Protocol) routing table tell an OSINT analyst about a target organization's IP space?
- It reveals the internal subnet structure of the organization
- It shows which ASNs are advertising which IP prefixes globally (Correct answer)
- It provides the geographic location of each IP address
- It lists all open ports on addresses within the prefix
Correct answer: It shows which ASNs are advertising which IP prefixes globally
BGP routing tables, queryable via services like BGPlay or Team Cymru, show which ASN announces which CIDR blocks, mapping an org's public IP ownership.
Question 3: Which Shodan search filter would help an analyst find web servers in the US running on port 8080 with 'nginx' in the banner?
- port:8080 country:US product:nginx (Correct answer)
- ip:US port:8080 banner:nginx
- country:"US" port:8080 nginx
- hostname:US port:8080 server:nginx
Correct answer: port:8080 country:US product:nginx
Shodan's structured filters use 'port:', 'country:', and 'product:' syntax; 'port:8080 country:US product:nginx' is the correct combination.
Question 4: An investigator wants to determine if a domain was used for phishing 18 months ago. Which resource is most appropriate?
- Current WHOIS lookup
- Wayback Machine (archive.org) and passive DNS historical databases (Correct answer)
- Live Shodan scan of the IP
- Current SSL certificate details
Correct answer: Wayback Machine (archive.org) and passive DNS historical databases
The Wayback Machine archives web page content over time, and passive DNS databases store historical resolution records, both essential for retrospective domain investigations.
Question 5: What is DNS zone transfer (AXFR), and why is it relevant to OSINT?
- A method to cache DNS responses, speeding up lookups
- A protocol that replicates all DNS records from a primary to secondary nameserver, sometimes misconfigured to allow public queries (Correct answer)
- A technique for encrypting DNS traffic between resolvers
- A way to register new DNS records with a domain registrar
Correct answer: A protocol that replicates all DNS records from a primary to secondary nameserver, sometimes misconfigured to allow public queries
AXFR is designed for nameserver replication; when misconfigured, it allows anyone to enumerate all DNS records of a domain in one request.
Question 6: An analyst discovers that a suspicious domain's registrant email is 'abc123@privacy-protect.io'. What is the best next OSINT step?
- Contact the registrar to request the real email
- Search the privacy-protection email across breach databases and other WHOIS records to find domains that leaked real details (Correct answer)
- Report the domain as malicious immediately
- Treat the investigation as a dead end
Correct answer: Search the privacy-protection email across breach databases and other WHOIS records to find domains that leaked real details
Privacy-protected registrant emails can appear in breaches or older WHOIS snapshots; searching them in breach databases and historical WHOIS often uncovers the operator's real details.
Question 7: Which of the following tools is specifically designed to enumerate subdomains using passive sources (certificate logs, search engines, DNS datasets) without directly querying the target?
- Nmap
- Amass (in passive mode) (Correct answer)
- Gobuster
- Hydra
Correct answer: Amass (in passive mode)
Amass in passive mode collects subdomain data from CT logs, search APIs, and DNS datasets without sending queries to the target's infrastructure.
OSINT Domain & Infrastructure Analysis 3
An analyst uses Shodan and finds a device with the banner 'Server: Apache/2.2.3' on port 443.
Why is this significant from an OSINT/security perspective?