A penetration tester is gathering information and wants to retrieve hostnames and IP addresses. Which of the following should the tester do?

Obtaining password dumps provides user credentials, not primarily hostnames and IP addresses, although compromised systems might eventually reveal this network information.

SSL/TLS certificate analysis can reveal hostnames listed in certificates (e.g., Common Name, Subject Alternative Names) but is not the primary or most comprehensive method for systematically gathering a broad range of hostnames and IPs.

DNS (Domain Name System) lookups are a fundamental and highly effective method for resolving hostnames to IP addresses and vice-versa. Tools like `nslookup` or `dig` allow a penetration tester to query DNS servers directly, providing explicit mappings of hostnames to their associated IP addresses for reconnaissance.

Web scraping involves extracting data from web pages, which might indirectly yield some hostnames, but it is not a direct or efficient technique for systematically mapping hostnames to IP addresses across a network.