PT0-003 · Question #9
A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet-facing resources have been…
The correct answer is B. Code repository scanning. When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Code Repository Scanning: Leaked Information: Code repositories (e.g., GitHub, GitLab) often contain sensitive information, including API keys…
Question
A penetration tester cannot find information on the target company's systems using common OSINT methods. The tester's attempts to do reconnaissance against internet-facing resources have been blocked by the company's WAF. Which of the following is the best way to avoid the WAF and gather information about the target company's systems?
Options
- AHTML scraping
- BCode repository scanning
- CDirectory enumeration
- DPort scanning
How the community answered
(55 responses)- A15% (8)
- B75% (41)
- C7% (4)
- D4% (2)
Explanation
When traditional reconnaissance methods are blocked, scanning code repositories is an effective method to gather information. Code Repository Scanning: Leaked Information: Code repositories (e.g., GitHub, GitLab) often contain sensitive information, including API keys, configuration files, and even credentials that developers might inadvertently Accessible: These repositories can often be accessed publicly, bypassing traditional defenses
Topics
Community Discussion
No community discussion yet for this question.