Information Gathering & Vulnerability Identification Flashcards

A tester is enumerating a target network and discovers an SNMP service running with default community strings. What information can typically be extracted via SNMP v1/v2c?

Answer: Network topology, routing tables, and running processes

SNMP with default community strings like 'public' can expose network topology, interface information, routing tables, ARP tables, and running processes.

During passive reconnaissance, a tester reviews the target's robots.txt file and finds entries for '/admin/', '/backup/', and '/config/'. What should the tester do with this information?

Answer: Use the discovered paths as targets for further active enumeration

robots.txt disallowed entries often reveal sensitive directories; these paths should be noted and investigated during active testing within scope.

What is the purpose of running a vulnerability scan with 'safe checks' enabled in tools like Nessus or OpenVAS?

Answer: To avoid running plugins that could crash or disrupt target services

Safe checks prevent the scanner from running destructive or denial-of-service-inducing plugins that could crash or disrupt production systems.

A penetration tester uses Google dorks to find exposed configuration files. Which search operator would help find files with '.env' extension on a specific target domain?

Answer: site:target.com filetype:env

Google dork syntax uses `site:` to restrict results to a domain and `filetype:` to filter by file extension, making `site:target.com filetype:env` the correct operator combination.

When performing web application reconnaissance, what does 'spidering' or 'crawling' a target website accomplish?

Answer: It maps all reachable pages and resources by following links automatically

Spidering follows hyperlinks starting from a seed URL to systematically discover and map all accessible pages and resources on the web application.

A tester identifies a service responding on port 8443. What is the MOST likely service running on this port?

Answer: HTTPS alternate port (often used for admin panels or alternative SSL services)

Port 8443 is a common alternate port for HTTPS, frequently used for administrative interfaces, development servers, or secondary SSL/TLS services.

Which concept describes the process of correlating data from multiple OSINT sources to build a comprehensive profile of a target?

Answer: Intelligence fusion

Intelligence fusion involves combining and correlating data from multiple disparate OSINT sources to create a unified, comprehensive picture of the target.