Information Gathering (Reconnaissance)

Question 1

Why is it important to validate your target?

Answer 1

Because people can send you the wrong IP by mistake!

Question 2

When searching for company emails, to what should you pay attention? Why?

Answer 2

To the company’s email addresses pattern. Because discovering the pattern allows you to make more precise guesses regarding valid email addresses from that company.

Question 3

True or false: A form of validating an email address is to looking for it in past data breaches.

Answer 3

True.

Question 4

What can you find by using the “Forgot Password” functionality?

Answer 4

You can find associated accounts and can be used to validate addresses.

Question 5

Name three tools to find email addresses.

Answer 5

Hunter.IO
Phonebook
Clear-Bit chrome extension

Question 6

How do you search for a domain while removing specific subdomains from the results in google?

Answer 6

site:domain.com -subdomain

Question 7

How do you specify a file type in a google search?

Answer 7

filetype:type

Question 8

Which of the following tools can be used for target validation? (multiple choice)

1. whois
2. nslookup
3. dnsrecon

Answer 8

1, 2 and 3

Question 9

If the Rules of Engagement state that ‘*.tcm-sec.com’ is in scope, which of the following targets can we legally attack? (multiple choice)
1. www.tcm-sec.com
2. dev.tcm-sec.com
3. dev.tcm.com
4. www.tcm-sec.co.uk
5. tcmsecurity.com
6. dev.tcm-sec.co.uk
7. tcm-blogs.com

Answer 9

1 and 2 only.

Question 10

What search phrase can be used to find subdomains of a website?

Answer 10

site:tcm-sec.com -www
This removes the most common subdomain “www” in order to display other search results.