Information Gathering & Vulnerability Identification Flashcards

A penetration tester uses theHarvester to collect email addresses and subdomains for a target organization. What category of reconnaissance does this represent?

Answer: Passive reconnaissance

theHarvester gathers data from public sources (search engines, DNS records) without directly interacting with the target, making it passive reconnaissance.

During OSINT gathering, a tester finds the target company's employees frequently post on LinkedIn with job titles referencing specific internal tools. How should this information be classified?

Answer: Technical intelligence that may reveal internal technology stack

Job postings and LinkedIn profiles can reveal internal technologies, frameworks, and tools, providing valuable technical intelligence for attack planning.

Which DNS record type would a penetration tester query to identify the mail servers associated with a target domain?

Answer: MX record

MX (Mail Exchanger) records specify the mail servers responsible for accepting email for a domain.

A tester performs a Shodan search and discovers an exposed industrial control system (ICS) device belonging to the target. What is the MOST appropriate next step?

Answer: Document the finding and report it to the client before any further action

Exposed ICS/SCADA systems carry significant risk; the tester should document the finding and consult the client before taking any action that could cause disruption.

Which technique involves sending specially crafted packets to a target and analyzing the responses to determine the operating system version?

Answer: OS fingerprinting

OS fingerprinting analyzes TCP/IP stack responses and timing characteristics to identify the target operating system and version.

A tester discovers that a web application returns different HTTP response codes (200 vs 302) depending on whether a username exists during login attempts. What vulnerability does this indicate?

Answer: Username enumeration

Differential responses based on whether a username exists allows attackers to enumerate valid usernames, enabling targeted credential attacks.

When using Nmap's -sV flag, what additional information does the tester receive compared to a standard port scan?

Answer: Service and version information for open ports

The -sV flag enables version detection, causing Nmap to probe open ports and report the service name and version running on each.