312-50 Question 26
Single answer▪ Footprinting through Search EnginesDuring an authorized reconnaissance phase, a CEH analyst is asked to identify publicly exposed login portals, administrative interfaces, and potentially sensitive documents associated with the target domain examplecorp.com without directly interacting with the target's servers. Which search-engine query is the most effective initial step for this purpose?
- A
site:examplecorp.com (inurl:admin OR inurl:login) (filetype:pdf OR filetype:xls OR filetype:docx)
- B
whois examplecorp.com
- C
nmap -sV examplecorp.com
- D
site:google.com examplecorp.com
- E
cache:examplecorp.com
Show answer and explanation
Correct answer: A
Explanation
The best answer is the targeted Google-style query using site:, inurl:, and filetype: operators. In CEH-style footprinting through search engines, the goal is to leverage indexed content to discover publicly exposed resources without sending probes directly to the target. Search operators such as site:, inurl:, intitle:, and filetype: are standard passive reconnaissance techniques for narrowing results to a specific domain and locating potentially sensitive pages or documents. By combining these operators, an analyst can efficiently surface login pages, administrative endpoints, and downloadable files that may reveal usernames, internal naming conventions, software versions, or metadata. WHOIS is relevant to reconnaissance but not to search-engine footprinting of indexed resources. Nmap is active scanning and would violate the passive requirement. Search syntax like site:google.com examplecorp.com demonstrates misunderstanding of domain scoping. The cache: operator may support follow-up review of specific pages but is not the strongest initial query for broad discovery. These practices are consistent with common OSINT and passive reconnaissance methodology emphasized in CEH and in search-engine advanced search documentation.
- A. Correct.
Correct. This query uses search engine operators commonly leveraged during footprinting through search engines. The site: operator restricts results to the target domain, inurl:admin and inurl:login help identify likely portals and administrative pages, and filetype:pdf/xls/docx helps uncover indexed documents that may contain useful metadata or sensitive information. This aligns with passive reconnaissance because the analyst is querying the search engine's index rather than directly probing the target host.
- B. Incorrect.
Incorrect. WHOIS can provide domain registration and ownership details, which is useful in footprinting, but it is not a search-engine query and does not specifically help identify indexed login pages, admin interfaces, or exposed documents through search engines. A candidate might choose this because WHOIS is part of reconnaissance, but it does not satisfy the scenario's stated objective.
- C. Incorrect.
Incorrect. Nmap performs active scanning against the target system and directly interacts with the target's servers. The scenario explicitly requires identifying information without directly interacting with the target. This option reflects a common mistake of confusing passive footprinting with active enumeration.
- D. Incorrect.
Incorrect. This query searches within google.com pages for the text examplecorp.com, rather than restricting results to the target organization's own domain. It is not an efficient or accurate way to find the target's exposed resources. A candidate might pick it due to misunderstanding how the site: operator works.
- E. Incorrect.
Incorrect. The cache: operator can sometimes retrieve a cached version of a specific page, but by itself it does not systematically identify login portals, admin pages, or document types across a domain. It is a niche operator and not the best initial step for broad passive discovery in this scenario.