EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesEasy
A penetration tester is performing reconnaissance on an organization's public-facing web servers. They use the 'dirb' tool with a wordlist to discover hidden directories and files that are not linked from the main website. What enumeration technique is being employed here?
- AService Banner Grabbing
- BWeb Content Enumeration
- CSMB Share Enumeration
- DDNS Zone Transfer
Show answer & explanationAnswer & explanation
Correct answer: B. Web Content Enumeration
Using tools like 'dirb' or 'gobuster' with wordlists to find hidden web content (directories, files) is a common web content enumeration technique. It aims to discover parts of a web application not easily found through normal browsing.
Why the other options are wrong
- A. Service Banner Grabbing involves extracting version information from service banners, not discovering hidden files.
- C. SMB Share Enumeration is for discovering shared resources on Windows networks, not web content.
- D. DNS Zone Transfer is used to enumerate DNS records, not web server content.
Web Content Enumeration
The process of discovering hidden files, directories, and other sensitive content on a web server, often using brute-force with wordlists.
- Targets web servers
- Uses tools like dirb, gobuster, wfuzz
- Aims to find unlinked or forgotten content
Memory trick: Web content is like finding secret rooms in a website.