312-50 Question 308
Single answer▪ Footprint Web InfrastructureDuring a pre-engagement reconnaissance phase, you are authorized to footprint the web infrastructure of a public-facing e-commerce site without sending intrusive probes that could trigger alerts. The client wants to know whether the site is behind a CDN or WAF and which origin technologies may be exposed through passive enumeration. Which action would provide the MOST useful passive evidence about the web infrastructure while minimizing direct interaction with the target application?
- A
Review historical DNS records, certificate transparency logs, and HTTP response headers from publicly cached sources to identify CDN/WAF indicators and origin hostnames
- B
Run a full Nmap service and OS detection scan against the target IP range to identify load balancers, web servers, and middleware versions
- C
Launch directory brute-forcing against the website to discover administration panels that may reveal backend server information
- D
Perform an authenticated vulnerability scan against the application to enumerate installed frameworks and plugins
Show answer and explanation
Correct answer: A
Explanation
In CEH-style reconnaissance, footprinting web infrastructure often begins with passive intelligence gathering before any active scanning. For a public-facing web application, the most appropriate low-noise approach is to collect information from public sources such as historical DNS databases, Certificate Transparency logs, search engine caches, and archived HTTP metadata. This can reveal whether a site uses a CDN or WAF, expose previously used origin IPs or hostnames, and identify related subdomains without directly probing the target. Active techniques such as Nmap version detection, directory brute-forcing, and vulnerability scanning are useful in later phases but do not meet a passive reconnaissance requirement. This approach is consistent with standard web reconnaissance practices and with public guidance around Certificate Transparency monitoring (RFC 6962 and successor CT ecosystem practices), DNS history analysis, and header-based identification of reverse proxies and content delivery platforms.
- A. Correct.
Correct. This is the best passive approach for footprinting web infrastructure. Historical DNS data can reveal prior A records, subdomains, or origin systems that are no longer directly exposed. Certificate Transparency logs can uncover related hostnames and certificates issued for subdomains, which is valuable for mapping web infrastructure. Publicly observable HTTP response headers from cached or previously indexed sources may indicate CDN or WAF providers through headers such as server patterns, proxy-related headers, or provider-specific behaviors. This aligns with passive reconnaissance goals because it relies primarily on third-party and publicly available data rather than intrusive scanning.
- B. Incorrect.
Incorrect. Nmap service/version detection and OS detection are active techniques, not passive footprinting methods. They generate direct traffic to the target and can trigger monitoring systems, IDS/IPS, or rate-limiting controls. Although useful later in an engagement when authorized, this does not meet the requirement to minimize direct interaction during early web infrastructure footprinting.
- C. Incorrect.
Incorrect. Directory brute-forcing is an active enumeration technique that sends many HTTP requests to the target application. It is not suitable when the goal is passive infrastructure footprinting with minimal chance of alerting defenders. While it may reveal admin panels or framework clues, it increases noise and is outside the scope of passive web infrastructure reconnaissance.
- D. Incorrect.
Incorrect. An authenticated vulnerability scan is highly intrusive compared with passive footprinting. It requires valid access, directly interacts with the application, and is designed for deeper assessment rather than low-noise reconnaissance. It may identify frameworks and plugins, but it does not satisfy the scenario's requirement to avoid intrusive probes.