nerdexam
GIAC

GCIH · Question #761

An attacker is hoping to discover as many IP addresses associated with a target domain as possible. Which command would be helpful?

The correct answer is C. nslookup. nslookup is a DNS query utility that resolves domain names to IP addresses and enumerates DNS records, making it the primary tool for discovering IPs associated with a target domain.

Reconnaissance, Scanning, and Enumeration

Question

An attacker is hoping to discover as many IP addresses associated with a target domain as possible. Which command would be helpful?

Options

  • Amofcomp
  • Bipconfig
  • Cnslookup
  • Dnet view

How the community answered

(16 responses)
  • A
    6% (1)
  • B
    6% (1)
  • C
    88% (14)

Why each option

nslookup is a DNS query utility that resolves domain names to IP addresses and enumerates DNS records, making it the primary tool for discovering IPs associated with a target domain.

Amofcomp

mofcomp is a Windows Managed Object Format compiler used to process WMI schema files and has no capability for DNS queries or external IP address discovery.

Bipconfig

ipconfig displays only the local machine's own network configuration such as IP address, subnet mask, and gateway, and cannot query DNS to enumerate IPs for external domains.

CnslookupCorrect

nslookup queries DNS servers to resolve domain names to their associated IP addresses and can enumerate multiple record types (A, MX, NS, CNAME). An attacker can use it interactively or in non-interactive mode to discover all IP addresses tied to a domain, including mail servers and authoritative name servers, significantly expanding the reconnaissance scope.

Dnet view

net view lists shared resources like files and printers on a local network or Windows domain and is not designed for DNS-based enumeration of IP addresses for external target domains.

Concept tested: DNS enumeration using nslookup for host reconnaissance

Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup

Topics

#DNS lookup#nslookup#IP enumeration#domain reconnaissance

Community Discussion

No community discussion yet for this question.

Full GCIH Practice