Information Gathering & Vulnerability Identification Flashcards

A penetration tester uses Recon-ng to automate OSINT collection. Which of the following best describes Recon-ng's primary function?

Answer: A modular web reconnaissance framework for gathering open-source intelligence

Recon-ng is a full-featured web reconnaissance framework with a modular design for automating OSINT gathering from multiple sources.

During a pentest, a tester discovers a web server running an outdated version of Apache with a known CVE. What CVSS metric primarily describes whether the vulnerability can be exploited over the network without physical access?

Answer: Attack Vector

The Attack Vector metric in CVSS describes the context in which exploitation is possible, including Network, Adjacent, Local, and Physical.

Which tool is MOST commonly used to perform zone transfer attempts against a DNS server?

Answer: dig

The `dig` command with the AXFR query type (e.g., `dig axfr @nameserver domain`) is the standard tool for attempting DNS zone transfers.

A tester finds a web application that accepts user input in a URL parameter and reflects it back in the response. What vulnerability should be investigated FIRST?

Answer: Cross-site scripting (XSS)

When user input is reflected in the browser response without sanitization, cross-site scripting (XSS) is the primary vulnerability to investigate.

When scoping a penetration test, which document formally defines the boundaries of testing and provides legal authorization?

Answer: Rules of engagement (ROE)

The Rules of Engagement (ROE) document formally defines what systems can be tested, testing timeframes, and authorized techniques, providing the legal authorization for the pentest.

A tester performs a credentialed vulnerability scan versus an uncredentialed scan. What is the PRIMARY advantage of a credentialed scan?

Answer: It identifies vulnerabilities that are only visible from an authenticated perspective, such as patch levels

Credentialed scans authenticate to target systems and can inspect installed software versions, registry settings, and local configurations not visible externally.

Which Nmap scan type sends SYN packets but never completes the TCP handshake, making it less likely to be logged by the target application?

Answer: SYN stealth scan (-sS)

The SYN stealth scan (-sS) sends SYN packets and analyzes responses without completing the three-way handshake, so connections are never fully established and may avoid application-layer logging.