312-50 Question 20
Single answer▪ Footprinting ConceptsDuring a reconnaissance engagement, you are authorized to perform only passive footprinting against a target company before the rules of engagement permit any direct interaction with its systems. The client wants you to identify the public IP ranges and external service providers associated with its internet-facing infrastructure without generating traffic to the company's hosts. Which action is the BEST choice to meet this requirement?
- A
Query Regional Internet Registry (RIR) and WHOIS databases for the company's registered netblocks, autonomous system information, and contact records
- B
Run an Nmap SYN scan against the company's public IP space to infer active ranges and exposed services
- C
Perform banner grabbing against the company's web and mail servers to identify hosting providers and address allocations
- D
Use traceroute to multiple company domains to map upstream providers and infer the organization's public IP allocations
Show answer and explanation
Correct answer: A
Explanation
The key distinction in this scenario is passive versus active footprinting. Passive footprinting collects intelligence from third-party or publicly available sources without directly engaging the target's systems. For identifying public IP ranges and related providers, WHOIS and RIR databases are among the most appropriate first steps because they are specifically intended to publish internet number resource registration data, including netblocks and organization details. Depending on the region, analysts should consult the appropriate RIR: ARIN, RIPE NCC, APNIC, LACNIC, or AFRINIC. Additional passive sources can include BGP/ASN lookup services, public certificate transparency logs, search engines, and company filings, but the best answer here is the direct use of RIR/WHOIS data because it most directly addresses public IP ownership and allocation. By contrast, Nmap scans, banner grabbing, and traceroute all transmit packets toward the target environment and are therefore active techniques, which would violate the rules of engagement in this case.
- A. Correct.
Correct. Querying WHOIS and RIR sources such as ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC is a classic passive footprinting technique. These records can reveal registered netblocks, ASN ownership or origin information, abuse and technical contacts, and sometimes the organizations or providers responsible for address space. This approach does not require sending packets to the target's hosts and aligns with a passive-only reconnaissance restriction.
- B. Incorrect.
Incorrect. An Nmap SYN scan is an active reconnaissance technique because it sends crafted packets directly to the target systems to determine host and port state. Although it is effective for discovering live hosts and services, it violates the passive footprinting requirement in the scenario.
- C. Incorrect.
Incorrect. Banner grabbing requires direct interaction with the target's exposed services, such as HTTP, SMTP, or other protocols. That makes it active footprinting, not passive. A candidate might choose this because banners can reveal providers and software, but it does not satisfy the rule prohibiting traffic to company hosts.
- D. Incorrect.
Incorrect. Traceroute can help identify network paths and intermediate providers, but it sends probe packets toward the target destination and therefore constitutes active reconnaissance. It may provide some insight into upstream connectivity, but it still interacts with the network path to the company's infrastructure and is not the best passive option.