Module 1: Footprinting & Reconnaissance
36 Questions
1 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which organization is responsible for IP address management in the Asia Pacific region?

  • AFRINIC
  • RIPE
  • APNIC (correct)
  • LACNIC

    • What command would you use to perform a DNS query on a specific server using the Dig tool?

  • dig name type @server
  • dig @server name type (correct)
  • dig @hostname type name
  • dig -type=name @server

    • Which of the following tools uses open source intelligence to gather information about a target?

  • Shodan
  • Traceroute
  • Maltego (correct)
  • Dig

    • In Windows, which command performs a traceroute to determine the path to a target server?

    <p>tracert</p> Signup and view all the answers

    Which command in Nslookup is used for an interactive zone transfer?

    <p>set type=any ls -d domainname.com</p> Signup and view all the answers

    Which of the following statements regarding Whois is accurate?

    <p>It obtains registration information for domains.</p> Signup and view all the answers

    What is the primary purpose of DNS poisoning?

    <p>To change the cache on a machine to a malicious server</p> Signup and view all the answers

    Which tool can be used for DNS footprinting?

    <p>nslookup</p> Signup and view all the answers

    Which DNS record type specifies the authoritative nameserver for a namespace?

    <p>SOA Record</p> Signup and view all the answers

    What does DNSSEC primarily help prevent?

    <p>DNS poisoning</p> Signup and view all the answers

    Which field in the SOA record indicates the revision number that increments with each change?

    <p>Serial Number</p> Signup and view all the answers

    What is the purpose of the CNAME record in DNS?

    <p>To map a name to an A record</p> Signup and view all the answers

    What does the MX record specify in DNS footprinting?

    <p>The mailing server used for emails</p> Signup and view all the answers

    Which tool is designed to search for usernames on social media platforms?

    <p>UserRecon</p> Signup and view all the answers

    Which method involves gathering information by observing someone without their knowledge?

    <p>Shoulder Surfing</p> Signup and view all the answers

    What is the primary purpose of the TTL field in DNS records?

    <p>Set the duration for which a record is valid</p> Signup and view all the answers

    Which command is used with the tool 'sherlock' to gather username information?

    <p>python3 sherlock <username></p> Signup and view all the answers

    What is the primary function of the CNAME record in DNS?

    <p>To provide additional names or aliases for a domain</p> Signup and view all the answers

    Which Google dork operator would you use to find a string specifically in the page title?

    <p>intitle:</p> Signup and view all the answers

    What does the tool 'theHarvester' aim to collect information about?

    <p>Usernames from search engines</p> Signup and view all the answers

    What distinguishes active footprinting from passive footprinting?

    <p>Active footprinting involves direct interaction to gather information.</p> Signup and view all the answers

    Which tool is commonly used for active footprinting?

    <p>tracert</p> Signup and view all the answers

    What type of information can be obtained through passive footprinting?

    <p>Whois records and DNS records.</p> Signup and view all the answers

    Which of the following is NOT a common use of search engines in footprinting?

    <p>Compile real-time network traffic data.</p> Signup and view all the answers

    How can attackers refine their search using major search engines?

    <p>By creating sophisticated queries with advanced search operators.</p> Signup and view all the answers

    Which information category does NOT belong to the data obtained through footprinting?

    <p>Real-time user login attempts.</p> Signup and view all the answers

    Which tool is best suited for passive footprinting?

    <p>nslookup</p> Signup and view all the answers

    Which type of information is typically included in organization details during footprinting?

    <p>Web technologies used by the organization.</p> Signup and view all the answers

    Which Google Dork command would be most appropriate for finding directories that may expose sensitive information?

    <p>index of</p> Signup and view all the answers

    What is the primary purpose of using 'intitle:' in Google Dorks?

    <p>To find pages that contain a specific string in the title</p> Signup and view all the answers

    Which of the following tools is specifically listed for finding subdomains of a company?

    <p>Netcraft</p> Signup and view all the answers

    What is the function of the 'dmitry –w' command?

    <p>To perform a whois lookup on the domain name</p> Signup and view all the answers

    Which command would you use to search for all pages available on a specific site in Google?

    <p>site:</p> Signup and view all the answers

    What type of information does the Google Hacking Database (GHDB) primarily provide?

    <p>A compilation of Google Dorks and their usage</p> Signup and view all the answers

    Which tool can be used to quickly look up information about a specific Autonomous System Number (ASN)?

    <p>asnlookup.com</p> Signup and view all the answers

    What does the 'allintext:' command do in Google Dorking?

    <p>Find pages with specific keywords in the text of the page</p> Signup and view all the answers

    Study Notes

    Footprinting & Reconnaissance

    • Footprinting involves gathering data about a target network to identify potential points of intrusion.
    • Active Footprinting requires direct interaction with the target, while Passive Footprinting gathers information without direct interaction.

    Tools for Footprinting

    • Passive Tools:
      • Whois, nslookup, dig, netcraft, dnssumpster, mxtoolbox, theHarvester, Dmitry, peekyou, shodan.io, wapalyzer
    • Active Tools:
      • Tracert, ping, Maltego, Hunter.io, thehackertarget.com

    Types of Information Obtained

    • Organization Information:
      • Details about employees, contact numbers, location branches, web technologies, and relevant documents like news articles.
    • Network Information:
      • Domain and sub-domains, network blocks, IP addresses, and DNS records.
    • System Information:
      • Web server OS, email addresses, and publicly available usernames/passwords.

    Reconnaissance through Search Engines

    • Search engines are critical for gathering information about target organizations, including employee profiles and technological platforms.
    • Advanced search operators enhance query capabilities for filtering specific information.
    • Major search engines include Google, Bing, Yahoo!, DuckDuckGo, and Baidu.

    Advanced Google Hacking Techniques

    • Google Dorks:
      • Use specific syntax to find sensitive information:
        • filetype: for file types, intitle: matches keywords in titles, inurl: for specific URLs, link: finds linked pages, etc.
    • Google Hacking Database (GHDB):
      • Contains collections of Google Dorks for ethical hacking.

    Web Services for Footprinting

    • Tools for finding top-level domains (TLDs) and sub-domains include Netcraft, Sublist3r, and Assestfinder.
    • ASN Lookup tools provide details on IP addresses and organizations.

    Gathering Information from LinkedIn

    • Dmitry:
      • Use dmitry -w for whois lookups or dmitry -s for sub-domain information.

    DNS Footprinting

    • DNS records provide essential network information, such as A (IPv4), AAAA (IPv6), MX (mail server), and NS (name server).
    • DNS querying tools include Security Trails, Mxtoolbox, and DNSDumpster.

    Social Engineering Techniques

    • Eavesdropping: Intercepting unauthorized communication.
    • Shoulder Surfing: Observing targets to collect sensitive information.
    • Impersonation: Misleading individuals into revealing information by pretending to be someone else.

    User Reconnaissance Tools

    • UserRecon: Searches usernames across 75 social media platforms.
    • Sherlock: Similar to UserRecon but more focused on username searches.
    • TheHarvester: Collects information from public sources regarding email addresses and entities.

    DNS Record Types

    • A: Maps hostname to IPv4 address.
    • CNAME: Maps an alias to an A record.
    • MX: Lists mail servers.
    • NS: Lists name servers.

    IP Address Management Authorities

    • ARIN: North America
    • APNIC: Asia Pacific
    • RIPE: Europe, Middle East
    • LACNIC: Latin America
    • AFRINIC: Africa

    Tools for Network Footprinting

    • Traceroute: Maps the path data takes to reach its destination; uses ICMP echo for Windows (tracert) and Linux (traceroute).
    • OSRFramework: Utilizes open-source intelligence to gather data on targets.
    • Maltego and Shodan: Capture extensive network-related information from connected devices.

    DNS Security

    • DNS Poisoning: Redirects requests to malicious servers.
    • DNSSEC: Prevents DNS poisoning via encrypted records.

    SOA Record Fields

    • Contains information such as the source hostname, contact email, and serial numbers for zone file revisions.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Module 02 Footprinting & Reconnaissance PDF

    Description

    This quiz explores the concepts of footprinting and reconnaissance in information security. Learn about active and passive footprinting techniques, and discover various tools used for gathering data on target networks. Enhance your understanding of how these methods form the basis for potential cyberattacks.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser