312-50 Question 25
Single answer▪ Footprinting through Search EnginesDuring an authorized reconnaissance engagement, a CEH analyst is asked to identify publicly exposed login portals and administrative interfaces belonging to target company examplecorp.com without actively scanning the company’s infrastructure. Which search-engine query would be the most effective first step to find indexed pages likely related to those interfaces while keeping results limited to the target domain?
- A
site:examplecorp.com (inurl:admin OR inurl:login OR intitle:"login")
- B
whois examplecorp.com admin login
- C
site:examplecorp.com filetype:exe password
- D
cache:examplecorp.com admin portal
Show answer and explanation
Correct answer: A
Explanation
In search-engine footprinting, the goal is to gather intelligence passively by using indexed content instead of sending probes directly to the target environment. For finding exposed portals on a specific organization’s site, the most effective approach is to combine site: with targeted operators such as inurl:, intitle:, and sometimes intext: to narrow results to likely authentication or administration pages. This aligns with common CEH reconnaissance practices and with publicly documented search syntax from major search engines such as Google Search operators. The other options misuse tools or operators: WHOIS provides registration data, filetype:exe is irrelevant to finding login pages, and cache: is for viewing cached content of known pages rather than broad discovery.
- A. Correct.
Correct. This query uses the site: operator to restrict results to the target domain and combines common search operators such as inurl: and intitle: to identify pages whose URLs or titles suggest login or administrative functionality. This is a standard passive footprinting technique because it relies on already indexed search-engine content rather than direct interaction with the target’s hosts.
- B. Incorrect.
Incorrect. WHOIS is useful for domain registration and contact metadata, not for locating indexed login or administrative pages. A search string written like this is also not a practical search-engine dork for discovering web interfaces on the target site.
- C. Incorrect.
Incorrect. Although site: and filetype: are valid search concepts, looking for executable files and the word password does not align with the requirement to identify login portals or admin interfaces. It also risks focusing on unrelated or non-web content rather than web application entry points.
- D. Incorrect.
Incorrect. The cache: operator shows a cached copy of a specific page known to the search engine; it is not an effective discovery query for enumerating multiple login or admin pages across a domain. It is more useful for viewing stored versions of already identified pages.