CEH Day 2 Footprinting and Reconnaissance

What is reconnaissance?

The process of gathering information about a target to build an intelligence profile

What is passive reconnaissance?

Gathering information without directly interacting with the target infrastructure

What is active reconnaissance?

Gathering information through direct interaction with the target infrastructure

Why is passive reconnaissance usually performed first?

It helps build an initial target profile and identify leads before direct interaction

What is OSINT?

Intelligence gathered from publicly available sources

Does OSINT only contain nontechnical information?

No OSINT can include technical and nontechnical information

What is WHOIS primarily used for?

Retrieving domain registration information

What information can WHOIS reveal?

Registrar registration dates nameservers domain status and public contact information if available

What does a DNS A record map?

A domain name to an IPv4 address

What does a DNS AAAA record map?

A domain name to an IPv6 address

What does an MX record identify?

The mail server responsible for a domain

How does MX priority work?

A lower priority number is preferred before a higher number

What does an NS record identify?

The authoritative nameservers for a domain

What is a TXT record used for?

Storing text based DNS information such as SPF DKIM and domain verification

What is a CNAME record?

An alias that points one hostname to another hostname

What is TTL in a DNS record?

Time To Live or the period DNS information can generally be cached

What does MX 0 . indicate?

The domain does not accept email and uses a Null MX record

What command can query DNS records?

dig

What is nslookup used for?

Querying DNS information

What does site:example.com search for?

Indexed results associated with the example.com domain

What does filetype:pdf search for?

Indexed files of the PDF format

What does intitle: search for?

Text in a webpage title

What does inurl: search for?

Text in a webpage URL

What does intext: search for?

Text in a webpage body or content

What does site:example.com filetype:pdf do?

Finds indexed PDF files associated with example.com

What is Google Dorking?

Using advanced search operators to locate publicly indexed information

What information can social media reconnaissance reveal?

Employee roles organizational structure projects skills and technology clues

What is metadata?

Data about data

What can document metadata reveal?

Author names usernames organization dates and software used

What is theHarvester?

An information gathering tool that collects data from public sources

What information can theHarvester discover?

Email addresses hostnames subdomains IP addresses and names

What does theHarvester -d specify?

The target domain or company name

What does theHarvester -b specify?

The data source to use

What does theHarvester -l specify?

The limit on search results

What does theHarvester -r do?

Performs DNS resolution on discovered subdomains

What does theHarvester -n do?

Enables DNS server lookup

What does theHarvester -c do?

Performs DNS brute forcing

Is theHarvester always passive?

No its classification depends on how it is used

What is Certificate Transparency?

A public logging system for TLS certificates

How can Certificate Transparency help reconnaissance?

It can reveal publicly logged certificates and associated domains or hostnames

What is crt.sh commonly used for?

Searching Certificate Transparency logs

What is Shodan used for?

Viewing information about internet exposed systems and infrastructure collected by Shodan

Is viewing existing Shodan data active reconnaissance?

No it is passive reconnaissance from the analysts perspective

What can Shodan information include?

IP addresses ports services banners and technologies

What is Recon-ng?

A modular reconnaissance framework

What is a Recon-ng workspace?

A separate environment for organizing data for a target or project

What are Recon-ng modules?

Components that perform different reconnaissance functions

What is the purpose of the Recon-ng database?

To store and organize gathered reconnaissance information

What is the Recon-ng marketplace used for?

Managing available modules

What is the difference between a Recon-ng module and workspace?

A module performs a task while a workspace separates project data

What is Maltego primarily used for?

Visualizing and exploring relationships between pieces of information

What is an Entity in Maltego?

A piece of information represented as a node

Give examples of Maltego entities

Person organization domain email address and IP address

What is a Transform in Maltego?

An operation that discovers or retrieves related information from an entity

What is a Maltego graph?

A visual representation of entities and their relationships

What is the typical Maltego flow?

Entity then Transform then Related Entity

Which tool is best for collecting emails and subdomains from public sources?

theHarvester

Which tool is a modular reconnaissance framework?

Recon-ng

Which tool is best for mapping relationships between entities?

Maltego

Which tool provides domain registration information?

WHOIS

Which tool is commonly used for DNS queries?

dig

Which source can reveal hostnames through publicly logged certificates?

Certificate Transparency logs such as crt.sh

What is the key difference between passive and active reconnaissance?

Passive uses information without directly interacting with the target while active directly interacts with target infrastructur