eJPT Information Gathering and Reconnaissance 5 — Questions and Answers
Question 1: What is the function of the `host` command in Linux during DNS reconnaissance?
- Display current hostname of the local machine
- Perform DNS lookups to resolve domain names to IP addresses (Correct answer)
- List active network connections
- Capture network traffic
Correct answer: Perform DNS lookups to resolve domain names to IP addresses
The `host` command performs DNS lookups, resolving domain names to IPs and querying various DNS record types.
Question 2: During reconnaissance, a tester discovers the target uses Cloudflare. What challenge does this present?
- The target cannot be port scanned at all
- Cloudflare may mask the real origin IP, making it harder to identify the actual server (Correct answer)
- All traffic to the target becomes unencrypted
- DNS records for the domain become unavailable
Correct answer: Cloudflare may mask the real origin IP, making it harder to identify the actual server
Cloudflare acts as a reverse proxy, hiding the origin server's real IP address behind Cloudflare's IPs, complicating direct targeting.
Question 3: Which Nmap output format option saves results in all major formats simultaneously?
- -oN
- -oX
- -oG
- -oA (Correct answer)
Correct answer: -oA
`-oA <basename>` saves scan results in normal, XML, and grepable formats simultaneously with the specified base filename.
Question 4: What type of information can be extracted from website metadata (e.g., PDF, DOCX files) during OSINT?
- Database credentials
- Author names, software versions, and GPS coordinates (Correct answer)
- Firewall rules
- Password hashes
Correct answer: Author names, software versions, and GPS coordinates
Document metadata can reveal author names, creation software/versions, company names, and sometimes GPS coordinates embedded in images.
Question 5: A tester runs `nmap -sU -p 53,161 10.10.10.1`. Which protocols are being probed?
- TCP HTTP and HTTPS
- UDP DNS and SNMP (Correct answer)
- TCP FTP and SSH
- UDP SMTP and POP3
Correct answer: UDP DNS and SNMP
UDP port 53 is DNS and UDP port 161 is SNMP; the `-sU` flag specifies UDP scanning.
Question 6: Which search engine operator would a tester use to find login pages indexed by Google on a target domain?
- site:target.com inurl:login (Correct answer)
- filetype:login site:target.com
- intitle:target.com login
- link:target.com/login
Correct answer: site:target.com inurl:login
`site:target.com inurl:login` restricts results to the target domain and filters for URLs containing 'login'.
Question 7: What is the risk of performing a DNS zone transfer (`AXFR`) against a misconfigured DNS server?
- It can crash the DNS server permanently
- It exposes the complete list of DNS records for the domain to unauthorized parties (Correct answer)
- It overwrites the target's DNS records
- It triggers automatic firewall blocking
Correct answer: It exposes the complete list of DNS records for the domain to unauthorized parties
A successful AXFR zone transfer returns all DNS records (hosts, subdomains, IPs) for the zone, giving attackers a full map of the target's infrastructure.
eJPT Information Gathering and Reconnaissance 5
What is the function of the `host` command in Linux during DNS reconnaissance?