EC-Council Certified Ethical Hacker (CEH) v12Reconnaissance TechniquesEasy
An ethical hacker is conducting initial reconnaissance for a penetration test. The client has provided a list of publicly accessible company websites. The hacker wants to gather as much information as possible about the organization's network infrastructure, domain registration details, and employee contacts without directly interacting with the target systems. Which of the following techniques would be most effective for this objective?
- AUtilizing WHOIS lookups, DNS queries, and OSINT tools like Maltego.
- BActive port scanning using Nmap against the target's public IP addresses.
- CPerforming a comprehensive vulnerability scan with Nessus against all web servers.
- DSocial engineering attacks like phishing emails to internal employees.
Show answer & explanationAnswer & explanation
Correct answer: A. Utilizing WHOIS lookups, DNS queries, and OSINT tools like Maltego.
Footprinting involves gathering information about a target without direct interaction. WHOIS lookups provide domain registration details, DNS queries reveal network structure, and OSINT tools aggregate public information, all aligning with the objective of passive reconnaissance.
Why the other options are wrong
- B. Active port scanning is an active reconnaissance technique that interacts directly with target systems, increasing the risk of detection.
- C. Vulnerability scanning is an active technique used later in the penetration testing process, not for initial passive information gathering.
- D. Social engineering is an active attack vector and is not primarily a footprinting technique for network infrastructure or domain details.
Footprinting
Footprinting is the first phase of ethical hacking, involving the collection of as much information as possible about a target system or network without directly interacting with it, often using publicly available sources.
- It is a passive reconnaissance technique.
- Aims to gather information about domains, IP ranges, network topology, and employee details.
- Utilizes publicly available resources like search engines, WHOIS, DNS records, and social media.
Memory trick: Footprints in the sand, leave no trace, gather all you can.