Section 3: Passive Reconnaissance

Question 1

Metagoofil

Answer 1

A Linux-based tool that can search the metadata associated with public documents located on a target’s website. This can be run on any OS

Question 2

Fingerprinting Organizations with Collected Archives (FOCA)

Answer 2

▪ Used to find metadata and hidden information in collected documents from an organization.

GUI version of Metagoofil, only runs on Windows.

Question 3

The Harvester

Answer 3

A program for gathering emails, subdomains, hosts, employee names, email addresses, PGP key entries, open ports, and service banners from servers

Question 4

Recon-ng

Answer 4

Uses a system of modules to add additional features and functions for your use
▪ It is a cross-platform web reconnaissance framework

Question 5

Maltego

Answer 5

▪ A piece of commercial software used for conducting open-source
intelligence that visually helps connect those relationships
▪ It can automate the querying of public sources of data and then compare it with other info from various sources

Question 6

Address (A) Record and AAAA Record

Answer 6

o Address (A) Record
▪ Links a hostname to an IPv4 address
o AAAA Record
▪ Links a hostname to an IPv6 address

Question 7

Canonical Name (CNAME) Record

Answer 7

Points a domain to another domain or subdomain

Question 8

Start of Authority (SOA) Record

Answer 8

Stores important information about a domain or zone

Question 9

Pointer (PTR) Record

Answer 9

Correlates an IP address with a domain name

Question 10

Text (TXT) Record

Answer 10

Adds text into the DNS

Question 11

Service (SRV) Record

Answer 11

Specifies a host and port for a specific service

Question 12

nslookup

Answer 12

A cross-platform tool used to query the DNS to provide the mapping between domain names and IP addresses or other DNS records

Question 13

HTTP Methods

Answer 13

● GET
o The principal method used with HTTP and is used to
retrieve a resource
● POST
o Used to send data to the server for processing by the
requested resource
● PUT
o Creates or replaces the requested resource
● DELETE
o Used to remove the requested resource
● HEAD
o Retrieves the headers for a resource only and ignores the
body

Question 14

HTTP Response Codes

Answer 14

200
o Indicates a successful GET or POST request (OK)

3xx
o Any code in this range indicates that a redirect has
occurred by the server

4xx
o Any code in this range indicates an error in the client
request

5xx
o Any code in this range indicates a server-side issue

Question 15

URl Encoding

Answer 15

Question 16

Certificate Revocation List (CRL)

Answer 16

An online list of digital certificates revoked by the certificate authority