312-50V12 Question #243: Real Exam Question with Answer & Explanation

Question

A penetration tester is tasked with gathering information about the subdomains of a target organization's website. The tester needs a versatile and efficient solution for the task. Which of the following options would be the most effective method to accomplish this goal?

Options

• AAnalyzing LinkedIn profiles to find employees of the target company and their job titles
• BEmploying a tool like Sublist3r, which is designed to enumerate the subdomains of websites using
• CUsing a people search service, such as Spokeo or Intelius, to gather information about the
• DUtilizing the Harvester tool to extract email addresses related to the target domain using a search

Explanation

The most effective method for a penetration tester to gather information about subdomains is to employ specialized tools designed for subdomain enumeration, as they efficiently discover associated subdomains.

Common mistakes.

• A. Analyzing LinkedIn profiles is a technique for gathering information about personnel (OSINT), not for technical subdomain discovery.
• C. Using people search services like Spokeo or Intelius is for gathering personal information about individuals, not for enumerating technical subdomains of an organization.
• D. While the Harvester is an OSINT tool, its primary described function in this choice is extracting email addresses, which is not the direct goal of enumerating subdomains, even if it might incidentally find some.

Concept tested. Subdomain enumeration tools and techniques

Reference. https://owasp.org/www-project-web-security-testing-guide/v42/4-Information_Gathering/WSTG-INFO-04-Enumerate_Subdomains_and_Host_Names

No community discussion yet for this question.