312-50 Question 34
Single answer▪ Website FootprintingDuring a sanctioned reconnaissance phase, you are asked to footprint a public-facing web application hosted at https://portal.example.com without sending aggressive scans that might trigger alerts or affect availability. You need to identify the site's technology stack, discover historical content that may reveal old directories or files, and gather basic DNS and ownership information using primarily passive techniques. Which option is the MOST appropriate approach?
- A
Use Netcraft to profile the site, review the Internet Archive/Wayback Machine for historical pages, and query WHOIS/DNS records for domain and hosting details
- B
Run a full Nmap service scan with version detection and NSE web scripts against the target, then brute-force directories with Gobuster
- C
Launch SQL injection tests with sqlmap to determine backend technologies and enumerate the database schema
- D
Perform a UDP scan against all ports and capture packets with Wireshark to identify the web server software
Show answer and explanation
Correct answer: A
Explanation
Website footprinting in CEH focuses on gathering information about a target's web presence with minimal interaction, especially during early reconnaissance. For a public website, passive and low-impact sources are preferred when the goal is to identify technologies, historical exposure, and registration/infrastructure details. Netcraft is commonly used to profile hosting and web technologies based on public observations. The Internet Archive's Wayback Machine is valuable for finding legacy pages, backup files, prior application paths, and content that may aid later testing. WHOIS and DNS queries help map domain ownership, nameservers, mail infrastructure, and hosting relationships. In contrast, tools such as Nmap with service detection, Gobuster, and sqlmap are active techniques that are more appropriate in later enumeration or testing phases when expressly authorized. Best practice in reconnaissance is to start with passive OSINT sources before escalating to active probing. Relevant references include Netcraft site reports, ICANN WHOIS/RDAP guidance for registration data, standard DNS record lookups, and the Internet Archive for historical web content.
- A. Correct.
Correct. This approach aligns with website footprinting using low-impact, primarily passive reconnaissance. Netcraft can reveal publicly observable details such as hosting provider, server-side technologies, and historical hosting changes. The Internet Archive's Wayback Machine can expose older pages, directories, file names, and application structure that are no longer linked but may still exist. WHOIS and DNS lookups provide registration, nameserver, MX, and related infrastructure details without directly probing the application in an intrusive way. This combination is practical and consistent with CEH-style reconnaissance objectives.
- B. Incorrect.
Incorrect. Although Nmap and Gobuster are legitimate security tools, this option is more active and noisy than the scenario allows. Version detection, NSE scripting, and directory brute-forcing generate substantial traffic and are more likely to trigger alerts or affect monitoring baselines. The misconception is that any enumeration tool is appropriate during footprinting; in reality, the scenario explicitly prioritizes passive methods.
- C. Incorrect.
Incorrect. sqlmap is an exploitation and validation tool for SQL injection, not a primary website footprinting tool. Using it at this stage goes beyond reconnaissance and attempts active attack behavior against application inputs. A candidate might choose this because backend database details are valuable, but obtaining them this way is intrusive and not consistent with the requirement to avoid aggressive scans.
- D. Incorrect.
Incorrect. A broad UDP scan is not an appropriate method for website footprinting a web application and is unlikely to identify web technologies effectively. Wireshark can analyze packets you are authorized to capture, but passive packet capture alone does not provide ownership records, historical site content, or reliable web stack profiling for an Internet target you do not control at the network level. This option reflects a misunderstanding of both the protocol focus of web services and the distinction between network scanning and website footprinting.