An analyst needs to obtain information about an organization as part of the initial phase of a black-box penetration test. Which of the following can the analyst use to gain intelligence without…

The correct answer is E. Email harvesting F. Whois search. The key constraint is gaining intelligence WITHOUT connecting to the target. Email harvesting (E) uses OSINT techniques - search engines, public sites, LinkedIn, data breach databases - to collect email addresses without touching the target's infrastructure. WHOIS searches (F)…

Enterprise Security Operations

Question

An analyst needs to obtain information about an organization as part of the initial phase of a black-box penetration test. Which of the following can the analyst use to gain intelligence without connecting to the target? (Select TWO)

Options

ATraceroute
BFingerprinting
CVulnerability scanning
DBanner grabbing
EEmail harvesting
FWhois search

How the community answered

(26 responses)

A
4% (1)
D
4% (1)
E
92% (24)

Explanation

The key constraint is gaining intelligence WITHOUT connecting to the target. Email harvesting (E) uses OSINT techniques - search engines, public sites, LinkedIn, data breach databases - to collect email addresses without touching the target's infrastructure. WHOIS searches (F) query public domain registration databases (ICANN, regional registries) for ownership, contact, and IP block information, again without connecting to the target. Traceroute (A) sends packets to the target network. Fingerprinting (B) requires connecting to target services to identify OS and application versions. Vulnerability scanning (C) actively probes the target. Banner grabbing (D) requires establishing a connection to a service port to read its response header. Only E and F are fully passive, offline OSINT techniques.

Topics

#passive reconnaissance#OSINT#email harvesting#whois

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice