312-50 Question 29
Single answer▪ Footprinting through Web ServicesDuring a permitted reconnaissance engagement, you need to gather publicly exposed information about a target organization's internet-facing assets without sending intrusive probes directly to its hosts. The client specifically asks you to identify externally reachable subdomains, IP addresses, and service relationships by using internet-based web services and passive sources as much as possible. Which approach is the MOST appropriate for this footprinting objective?
- A
Use passive web-based intelligence sources such as Netcraft, crt.sh, SecurityTrails, and Shodan to correlate subdomains, certificate transparency entries, historical DNS data, and exposed services
- B
Run an aggressive Nmap scan with service version detection and OS fingerprinting against the target's entire public IP range to discover all exposed assets
- C
Launch a vulnerability scan with Nessus against the target's web servers to enumerate missing patches and infer service relationships
- D
Use a password spraying tool against the target's cloud login portals to identify valid externally accessible services and accounts
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to perform footprinting through web services with minimal direct interaction with the target. In CEH-style reconnaissance, this points to passive intelligence gathering using third-party web services and public data sources. Certificate transparency search engines such as crt.sh are commonly used to discover subdomains from issued TLS certificates. DNS intelligence platforms such as SecurityTrails can help identify current and historical DNS records. Netcraft can provide hosting, technology, and site-related information. Shodan is also useful because it provides externally observed service data gathered by its own infrastructure rather than requiring the tester to scan the target directly.
By contrast, Nmap and Nessus are active tools that directly probe the target environment. They are useful later in an engagement when active enumeration is authorized and appropriate, but they do not best satisfy the passive, web-service-based footprinting requirement in this scenario. Password spraying is not reconnaissance and would be inappropriate unless explicitly authorized as part of an attack simulation.
This aligns with common reconnaissance best practices: start with passive OSINT and web services to reduce detection risk and build an initial asset inventory before moving to active validation if permitted. Relevant public sources include certificate transparency logs described by RFC 6962 and the documented use cases of Shodan, Netcraft, and DNS intelligence platforms for internet exposure analysis.
- A. Correct.
Correct. This option aligns with the scenario's requirement to perform footprinting through web services while minimizing direct interaction with the target. Netcraft can provide hosting and site profile information, crt.sh can reveal certificate transparency records that often expose subdomains, SecurityTrails can provide DNS and historical DNS intelligence, and Shodan indexes internet-exposed services from its own scanning infrastructure. Correlating these sources is a practical passive reconnaissance method for identifying subdomains, IPs, hosting relationships, and externally exposed services.
- B. Incorrect.
Incorrect. Nmap is a highly valuable reconnaissance tool, but this is an active scanning approach that sends probes directly to target systems. The scenario explicitly requires using internet-based web services and passive methods as much as possible, so aggressive Nmap scanning does not best fit the stated constraint.
- C. Incorrect.
Incorrect. Nessus is primarily a vulnerability assessment tool, not a passive footprinting-through-web-services method. It requires direct interaction with target systems and goes beyond identification of exposed assets into vulnerability enumeration, which is more intrusive than requested in the scenario.
- D. Incorrect.
Incorrect. Password spraying is an authentication attack technique, not a footprinting method. It is intrusive, risks account lockouts, and falls outside the scope of passive reconnaissance through web services. Choosing this option would reflect a misunderstanding between reconnaissance and active attack activity.