Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Certified Ethical Hacker > Reconnaissance > Flashcards

Reconnaissance Flashcards

(61 cards)

Start Studying
1
Q

Footprinting

A

Part of reconnaissance, mapping out at a high level what the landscape looks like. During footprinting, you look for any information that might give you some insight into the target - no matter how big or small. Investigating web resources and competitive intelligence, mapping out network ranges, mining whois and DNS, social engineering, email tracking, Google Hacking.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Anonymous Footprinting

A

Obscure the source of footprinting activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Pseudonymous Footprinting

A

Attributing your actions to someone else when conducting footprinting.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Focus and Benefits of Footprinting

A
  1. Know the security posture
  2. Reduce the focus area (network range, number of targets)
  3. Identify vulnerabilities
  4. Draw a network map
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Active Footprinting

A

Requires the attacker to touch the device, network or resource.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Passive Footprinting

A

Collecting information from public records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Competitive Intelligence

A

Information gathered by a business entity about its competitors, customers, products and marketing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

www.attentionmeter.com

A

Compares website traffic from hosts of different sources and provides traffic data and graphs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Websites that provide information on company origins and how it developed during the years.

A

EDGAR database. Hoovers, LexisNexis, Business Wire

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Websites that provide company plans and financials

A

SEC Info, Experian, Market Watch, Wall Street Monitor, Euromonitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Web Mirroring Tools

A

Black Widow, GSA Email Spider, NCollector Studio, HTTRACK, GNU Wget

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Google Hacking: filetype:type

A

Searches for files only of a specific type. (DOC, XLS. etc.) Example: filetype:doc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Google Hacking: index of /string

A

Displays pages with directory browsing enabled. Example: “intitle:index of “ passwd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Google Hacking: info:string

A

Displays information Google stores about the page itself: Example: info:www.anycomp.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Google Hacking: intitle:string

A

Searches for pages that contain the string in the title. Example: intitle: login You can also use allintitle for multiple search strings: Example: allintitle:login password

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Google Hacking: inurl:string

A

Displays pages with the string in the URL. Example: inurl:password For multiple strings use allinurl, Example: allinurl: etc passwd

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Google Hacking: link:string

A

Displays linked pages based on a search term.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Google Hacking: related:webpagename

A

Shows webpages similar to webpagename

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Google Hacking: site:domain or web page string

A

Displays pages for a specific website or domain holding the search term. site:anywhere.com passwds

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Google Hacking: allinurl:tsweb/default.htm

A

Displays RDP Web pages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Google Hacking Tools

A

SiteDigger and Metagoofil (searches document meta tags)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

History Sites

A

www.archive.org and Google Cache

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Email tracking programs

A

www.emailtrackerpro.com
www.mailtracking.com
GetNotify
ContactMonkey
Yesware
ReadNotify,
WhoReadMe,
MSGTAG,
TraceEmail and
Zendio

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

DNS Name Resolvers

A

Answer DNS requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
DNS Authoritative Servers
Hold the records for a namespace
26
DNS Record Types - SRV
SRV - Hostname and Ports of servers providing specific services
27
DNS Record Types - SOA
Start of Authority - identifies the primary name server for the zone.
28
DNS Record Types - PTR
Maps an IP address to a Hostname
29
DNS Record Types - NS
Name Servers
30
DNS Record Types - MX
Email Servers
31
DNS Record Types - CNAME
Domain name aliases
32
DNS Record Types - A
Host name to IP address
33
DNS Poisoning
Changing the entries in DNS cache to point to alternative servers.
34
Domain Name System Security Extensions (DNSSEC)
DNSSEC is aimed at strengthening trust in the Internet by helping to protect users from redirection to fraudulent websites and unintended addresses. In such a way, malicious activities like cache poisoning, pharming, and man-in-the-middle attacks can be prevented. DNSSEC authenticates the resolution of IP addresses with a cryptographic signature, to make sure that answers provided by the DNS server are valid and authentic. In case DNSSEC is properly enabled for your domain name, the visitors can be ensured that they are connecting to the actual website corresponding to a particular domain name.
35
What makes up a DNS SOA record?
Source host, Contact Email, Serial Number, Refresh Time, Retry Time, Expire Time, TTL
36
Internet Corporation for Assigned Names and Numbers (ICANN)
ICANN manages IP address ranges.
37
Domain Name Registrants
www.godaddy.com www.register.com, etc.
38
Regional Internet Registries
1. American Registry for Internet Numbers (ARIN) - Canada, parts of the Caribbean and North Atlantic Islands and the United States 2. Asia-Pacific Network Information Center (APNIC) - Asia and the Pacific 3. Reseaux IP Europeens (RIPE) NCC - Europe, Middle East and parts of Central Asia/Northern Africa 4. Latin America and Caribbean Network Information Center (LACNIC) - Latin America and the Caribbean 5. African Network Information Center (AfriNIC) - Africa
39
whois database
Queries the registries and returns information including domain ownership, addresses, locations and phone numbers of domain owners.
40
Dig command
Like NSLOOKUP but for UNIX/Linux. Basic command structure: dig @server name type
41
Tracert
Traceroute - tracks a packet across the Internet and provides the route path and transit times. Uses ICMP ECHO packets (UDP datagrams in Linux versions).
42
ICMP Type 11, Code 0
TTL Expired
43
ICMP Type 3, Code 13
Administratively Blocked
44
Trace Route Tools
``` McAfee Visual Trace (NeoTrace), Trout, VisualRoute, Magic NetTrace, Network Pinger, GEO Spider, and Ping Plotter ```
45
Differences between Windows and Linux Trace Routers
Windows uses tracert whereas Linux uses traceroute. Windows uses ICMP, Linux uses TCP
46
OSRFRAMEWORK
Open source research framework in Python that helps in the task of user profiling by performing open source intelligence.
47
OSRFRAMEWORK - usufy.py
Verifies if a user profile exists in up to 306 different platforms
48
OSRFRAMEWORK - mailfy.py
Checks if a user name (email) has been registered in up to 22 different email providers.
49
OSRFRAMEWORK - searchfy.py
Looks for profiles using full names and other info. Exam may say this queries the OSRFramework platform itself.
50
OSRFRAMEWORK - domainfr.py
Verifies the existence of a given domain in up to 1567 different registries
51
OSRFRAMEWORK - phonefy.py
Checks for the existence of phone numbers
52
OSRFRAMEWORK - entify.py
Looks for regular expressions
53
Web Spiders
A robot program that automatically traverses the Web's hypertext structure by retrieving a document, and recursively retrieving all documents that are referenced. Normal Web browsers are not robots, because they are operated by a human, and don't automatically retrieve referenced documents (other than inline images). Web robots are sometimes referred to as Web Wanderers, Web Crawlers, or Spiders. These names are a bit misleading as they give the impression the software itself moves between sites like a virus; this not the case, a robot simply visits sites by requesting documents from them.
54
/robots.txt
Web site owners use the /robots.txt file to give instructions about their site to web robots; this is called The Robots Exclusion Protocol. It works likes this: a robot wants to vists a Web site URL, say http://www.example.com/welcome.html. Before it does so, it firsts checks for http://www.example.com/robots.txt, and finds: User-agent: * Disallow: / The "User-agent: *" means this section applies to all robots. The "Disallow: /" tells the robot that it should not visit any pages on the site.
55
Social Engineering Tools
Maltego, Social Engineering Framework
56
Competitive Intelligence Tools
Google Alerts, Yahoo! Site Explorer, SEO for Firefox, SpyFu, Quarkbase, DomainTools.com
57
Shodan
The hackers search engine. Designed to help you find specific types of computers (routers, servers, and IOT) connected to the Internet.
58
Vulnerability Research Databases and Sites
National Vulnerability Database, SecurityTracker, Hackerstorm Vulnerability Database, SecurityFocus
59
DNS ports
DNS lookups use UDP port 53 and zone transfers use TCP port 53
60
DNS command to initiate a zone transfer using NSLOOKUP
ls -d domainname
61
Can be used to check web pages for changes, automatically notifying you when there's an update:
website-watcher (http://aignes.com )

Certified Ethical Hacker (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions