2.0 Reconnaissance Techniques CEH Practice Quiz

• A. Passive reconnaissance gathers intelligence without directly interacting with the target system; active reconnaissance directly probes or interacts with the target, risking detection
• B. Passive reconnaissance is only performed by defenders; active reconnaissance is exclusively used by offensive penetration testers
• C. Passive reconnaissance uses automated scanning tools; active reconnaissance relies exclusively on manual OSINT research techniques
• D. Passive reconnaissance is always legal; active reconnaissance always requires law enforcement authorization before proceeding

Passive reconnaissance gathers intelligence about a target using publicly available information sources, search engines, WHOIS databases, social media, DNS records, job postings, without sending any traffic directly to the target's systems. The target has no awareness of the activity. Active reconnaissance involves direct interaction with the target's infrastructure, port scanning with Nmap, banner grabbing, network enumeration, which generates traffic that the target's IDS/SIEM may detect and log.

• B. Perform a full Nmap scan of the target IP range to identify all active hosts and open services
• A. Define the scope and obtain written authorization, confirming what targets are in scope, what techniques are permitted, and having signed permission from the target organization
• C. Send phishing emails to identified employee email addresses to harvest credentials for deeper access
• D. Query the target's WHOIS records to identify the registrar and registration contact information

Before any footprinting activity, passive or active, an ethical hacker must have clearly defined scope and written authorization. The Rules of Engagement (RoE) and/or Statement of Work must specify: which IP ranges, domains, and systems are in scope; what reconnaissance techniques are permitted (passive only, or including active scanning); testing windows; emergency contacts; and escalation procedures. Without written authorization, all footprinting activities, even passive OSINT, may violate computer fraud laws or professional ethics codes. Scope definition prevents unauthorized reconnaissance of third-party systems adjacent to the target.

• A. Only the organization's financial earnings and stock price, the target's cybersecurity posture cannot be inferred from operational information
• B. Nothing public is useful, effective footprinting only works by obtaining confidential internal documents through insider access
• C. Network ranges, IP addresses, domain names, employee names and emails, technologies in use, operating hours, physical locations, security policies, business partners, and internet-facing services, a complete intelligence picture enabling targeted attack planning
• D. Only the CEO and CISO names, spear-phishing these two executives provides sufficient access to all organizational resources

Comprehensive footprinting collects intelligence across multiple dimensions: Technical (domain names, IP ranges, internet-facing services, OS and application versions, SSL certificates, DNS records), Organizational (employee names/titles/emails, org chart, business units, physical locations), Operational (business hours, maintenance windows, third-party vendors and partners), and Security posture (published security policies, incident reports, job postings for security roles). This complete picture enables the attacker to prioritize attack vectors, craft targeted phishing lures, identify vulnerable systems, and plan the attack timeline.

• A. site:targetorg.com intitle:"login" OR intitle:"admin" OR intitle:"sign in" OR intitle:"portal"
• B. site:targetorg.com filetype:pdf OR filetype:doc, finds all document files that may contain embedded login credentials
• C. site:targetorg.com intext:"server error", finds pages with error messages revealing login endpoints
• D. site:targetorg.com cache:login, retrieves Google's cached version of all pages containing login functionality

Combining site: (domain scoping) with intitle: (title matching) and OR operators creates a highly targeted search for authentication interfaces. Pages with 'login', 'admin', 'sign in', or 'portal' in their HTML title tags are explicitly designed as authentication entry points. Discovering these pages identifies potential attack surfaces for password attacks, credential stuffing, authentication bypass, or session management vulnerabilities. The GHDB (Google Hacking Database at exploit-db.com) documents hundreds of refined dorks for specific login page types.

• A. Finds all web servers owned by Target Corporation running on non-standard ports, used for HTTP enumeration of alternative web services
• B. Identifies all internet-facing systems belonging to Target Corporation with Remote Desktop Protocol (RDP) open on port 3389, facilitating targeted RDP credential attacks, brute-force, or exploitation of RDP vulnerabilities (BlueKeep, DejaBlue)
• C. Maps Target Corporation's email infrastructure by identifying mail exchange servers on port 3389
• D. Finds Target Corporation's DNS servers on port 3389 for zone transfer reconnaissance and domain enumeration

The org: operator filters by organization name (ASN-registered organization), and port:3389 filters for systems with RDP open. The combined query returns all internet-exposed RDP services registered to the target organization. This intelligence directly facilitates: (1) RDP credential brute-force attacks using tools like Hydra, (2) Password spray attacks using common enterprise passwords, (3) Testing for unpatched RDP vulnerabilities like BlueKeep (CVE-2019-0708) or DejaBlue (CVE-2019-1182), and (4) Identification of systems that should never be internet-exposed but are due to misconfiguration, a finding with immediate remediation value.

• B. Active reconnaissance, directly querying WHOIS and LinkedIn sends probes directly to target company servers, risking detection by their security team
• A. Passive reconnaissance, information is gathered from public third-party sources without any direct interaction with the target's own infrastructure, making detection extremely unlikely
• C. Social engineering reconnaissance, the tester is impersonating an employee to gather information through human interaction
• D. Semi-active reconnaissance, WHOIS queries are passive but LinkedIn searches are classified as active because they require a login account to search employee profiles

All described activities use public third-party sources: LinkedIn (a social network platform), WHOIS databases (maintained by registrars and ICANN, not the target), and job posting sites (public HR content). None of these activities send any traffic to the target organization's own servers or infrastructure, the target has no technical means to detect these activities through their network monitoring tools. This is the defining characteristic of passive reconnaissance.

• A. The job postings reveal the salary ranges for security roles, helping the red team calculate the organization's security budget for report benchmarking purposes
• B. The postings indicate the organization is growing its security team, which has no direct bearing on attack surface identification or vulnerability exploitation planning
• C. Nothing, job postings are human resources documents with no technical information relevant to attack planning or vulnerability identification
• D. The postings reveal specific security product brands and versions in use. Palo Alto GlobalProtect (VPN/ZTNA) and Fortinet FortiClient EMS (endpoint management), allowing the red team to research CVEs for those specific products, identify attack techniques for those platforms, and craft targeted phishing lures referencing these familiar technologies

'Senior Palo Alto Networks Engineer' with GlobalProtect experience reveals a Palo Alto Networks NGFW/ZTNA deployment. 'FortiGate VPN Administrator' with FortiClient EMS reveals Fortinet's endpoint management and VPN infrastructure. This intelligence: (1) Narrows CVE research to Palo Alto and Fortinet product vulnerability databases, (2) Enables testing of known attack techniques for these specific platforms (e.g., CVE-2024-3400 PAN-OS command injection, CVE-2023-27997 FortiGate heap overflow), (3) Enables creation of realistic phishing lures referencing GlobalProtect or FortiClient updates, and (4) Provides context for social engineering scripts referencing the organization's actual security tools.

• A. To find all Excel and CSV spreadsheet files indexed by Google on the target's domain, which may contain sensitive data like employee lists, financial data, customer PII, or internal system configurations inadvertently published to the web
• B. To enumerate all web server IP addresses associated with the target domain by examining Excel file metadata
• C. To download a copy of the target organization's website for offline analysis without network traffic to the target
• D. To identify all subdomains of the target organization using Excel files as a DNS enumeration data source

Subdomain enumeration uses DNS zone transfers, brute-force subdomain guessing, and certificate transparency logs, not Excel file searches. While Excel files might incidentally contain internal hostnames, searching for XLS/CSV files is specifically for data discovery, not subdomain enumeration.