CompTIA PenTest+ (PT0-003)Reconnaissance and EnumerationMedium
A penetration tester needs to gather information about a target's network infrastructure, including router details, ISP, and geographic location, without sending any direct traffic to the target's IP address. Which OSINT tool is specifically designed for querying Border Gateway Protocol (BGP) routing information from public sources?
- AMaltego
- BCensys
- CShodan
- DRIPEstat
Show answer & explanationAnswer & explanation
Correct answer: D. RIPEstat
RIPEstat is a service that provides detailed information about IP addresses, ASNs, and BGP routing data from the RIPE NCC database. It allows for passive querying of network infrastructure details without direct target interaction.
Why the other options are wrong
- A. Maltego is a link analysis tool that aggregates data from various sources, but RIPEstat is a direct source for BGP info.
- B. Censys also scans the internet for hosts and certificates, similar to Shodan but with different data sets.
- C. Shodan scans the internet for devices and services, it's more about open ports/services than BGP routing.
RIPEstat
A web-based tool provided by the RIPE NCC that offers a wide range of statistics and information about IP address space, ASNs, and BGP routing data.
- Provides BGP routing information, ASN details, and IP address allocations.
- A passive OSINT tool for network infrastructure reconnaissance.
- Leverages data from the RIPE NCC database.
Memory trick: Network maps, open sources, reveal the routes.