312-50 Question 307
Select 2▪ Footprint Web InfrastructureDuring an authorized reconnaissance engagement, you are asked to footprint a company’s public web infrastructure without sending intrusive traffic that could disrupt production systems. You need to identify the web server software, any reverse proxy or CDN in front of it, and related public-facing hosts used by the web application. Which TWO actions are the most appropriate initial steps?
- A
Review HTTP response headers and TLS certificate details from the target website, and correlate them with passive DNS and Certificate Transparency logs
- B
Run a full authenticated vulnerability scan with all web checks enabled against the production site during business hours
- C
Query public sources such as WHOIS, DNS records, search engine indexing, and subdomain enumeration data to map related web hosts
- D
Launch a high-rate directory brute-force scan and web fuzzing campaign to discover hidden application paths before collecting passive information
- E
Use packet fragmentation and spoofed source addresses to bypass perimeter monitoring while enumerating the web stack
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to start with low-impact, high-value reconnaissance methods that reveal the organization’s web infrastructure without risking service disruption. In practice, this means combining passive intelligence sources with minimally invasive inspection of publicly available metadata. HTTP headers may disclose products such as nginx, Apache, IIS, reverse proxies, WAFs, or CDNs, while TLS certificates often list additional hostnames in Subject Alternative Names. Passive DNS and Certificate Transparency logs can reveal current and historical hostnames tied to the organization. WHOIS and DNS records help map ownership and hosting relationships, while search engine indexing and subdomain intelligence can uncover exposed web properties. This approach aligns with common reconnaissance best practices used in ethical hacking: begin passively, validate carefully, and escalate to active testing only when needed and explicitly authorized. Relevant references include public Certificate Transparency ecosystems such as crt.sh, DNS record analysis practices, and standard web enumeration methodology that prioritizes passive discovery before active scanning.
- A. Correct.
Correct. Inspecting HTTP response headers can reveal technologies such as server banners, reverse proxies, load balancers, and CDN indicators, although some headers may be masked or modified. Reviewing TLS certificate details, including subject names and SAN entries, can expose related hostnames. Correlating this with passive DNS and Certificate Transparency logs is a standard low-impact way to identify associated public infrastructure without aggressively probing the target.
- B. Incorrect.
Incorrect. A full authenticated vulnerability scan is not an initial footprinting step and is far more intrusive than necessary for early reconnaissance. It can generate substantial traffic, trigger alerts, and potentially impact production systems. In CEH-style methodology, footprinting web infrastructure should begin with passive or minimally invasive information gathering.
- C. Correct.
Correct. Public record collection through WHOIS, DNS enumeration, search engine results, and subdomain intelligence is a core part of footprinting web infrastructure. These sources help identify external web hosts, alternate domains, development or staging sites exposed to the internet, mail and DNS providers, and cloud-hosted front ends, all with minimal impact on the target environment.
- D. Incorrect.
Incorrect. High-rate directory brute-forcing and fuzzing are active enumeration techniques that can create significant load and are not appropriate as initial steps when the goal is low-impact footprinting. These techniques may be useful later with authorization and careful rate limiting, but they are not the best first choice for safely mapping web infrastructure.
- E. Incorrect.
Incorrect. Packet fragmentation and source spoofing are not appropriate or ethical techniques for authorized web footprinting. They are associated with evasion attempts, can break normal TCP-based communication, and do not align with professional reconnaissance practices. Authorized CEH engagements emphasize lawful, controlled information gathering rather than stealthy bypass methods against the client’s own defenses.