Reconnaissance And Discovery

Question 1

theHarvester

Answer 1

Tool for gathering OSINT for a domain or company name.

Works by scanning multiple public data sources to gather emails, names, subdomains, IPs, urls, etc.

Question 2

dnsenum

Answer 2

Used to check that external DNS is not leaking too much Info.
-Command line tool that identifies essential DNS records like MX, NS, or A records.
-can also attempt zone transfers
-try reverse resolution
-try brute-forcing if subdomains and host names

-Perl script

Question 3

scanless

Answer 3

Utility that runs port scans through third-party websites to evade detection.

Question 4

curl

Answer 4

Utility for command-line manipulation of URL-based protocol requests.

This tool can be used to submit HTTP GET, POST, and PUT requests as part of web application vulnerability testing. curl supports many other data transfer protocols, including FTP, IMAP, LDAP, POP3, SMB, and SMTP.

Question 5

Nessus

Answer 5

One of the best-known commercial vulnerability scanners, produced by Tenable Network Security.

It is available in on-premises (Nessus Manager) and cloud (Tenable Cloud) versions, as well as a Nessus Professional version, designed for smaller networks. The product is free to use for home users but paid for on a subscription basis for enterprises. As a previously open-source program, Nessus also supplies the source code for many other scanners.

Question 6

Packet Analysis

Answer 6

The act of examining protocol headers and payloads within individual network packets or frames.

refers to deep-down frame-by-frame scrutiny of captured frames.

Question 7

Protocol Analysis

Answer 7

The act of examining protocol usage statistics over a network link.

means using statistical tools to analyze a sequence of packets, or packet trace.

Question 8

SPAN

Answer 8

switched port analyzer
(Mirror port)

Question 9

TAP

Answer 9

test access port

Sniffing can also be performed over a network cable segment - inserting device in the cabling to copy frames passing over it. There are passive and active (powered) versions.

Question 10

tcpdump

Answer 10

command line packet capture utility on Linux
Basic is tcpdump -i eth0
Need to use ctrl+c to stop

Question 11

hping

Answer 11

Open-source spoofing took that provides penetration tester with the ability to craft network packets to exploit vulnerable firewalls and IDSs.

Can probe IPs like nmap, can be similar to traceroute and change packet formats to TCP/UDP if ICMP is blocked, and can perform flood-based DoS attacks to test a system.

Question 12

pathping

Answer 12

Windows host : can be used to measure latency along a route