312-50 Question 35
Single answer▪ Website FootprintingDuring the reconnaissance phase of an authorized web application assessment, you need to identify hidden directories, old backup files, and technologies used by a target website without authenticating to the application. The client specifically asks you to minimize direct interaction with dynamic application functions while still gathering useful footprinting data. Which approach is MOST appropriate for this requirement?
- A
Use a web spider and forced browsing tool against the site, review robots.txt, and inspect HTTP response headers and page source for framework and server information
- B
Launch an SQL injection test against all input fields to enumerate database names, tables, and version information
- C
Perform password spraying against the web application's login portal to identify valid user accounts and authentication mechanisms
- D
Upload a web shell through file submission forms to determine the underlying operating system and web server privileges
Show answer and explanation
Correct answer: A
Explanation
Website footprinting focuses on passively or minimally invasively collecting information about a target web presence, such as directory structure, publicly exposed resources, technologies in use, metadata, and configuration clues. In this scenario, the best answer is the combination of crawling, forced browsing, robots.txt review, and HTTP/page-source inspection because these are standard reconnaissance methods used to enumerate exposed content and fingerprint the application stack without heavily engaging dynamic business logic. Common CEH-aligned techniques include examining robots.txt, sitemap.xml, HTTP headers, TLS certificate details, page comments, JavaScript files, and using directory enumeration tools to discover hidden content. References include OWASP guidance on information gathering and application mapping, as well as general HTTP behavior documented in RFC 9110 for response headers and server disclosures. The incorrect choices are all more intrusive and belong to later phases such as authentication attacks, injection testing, or exploitation.
- A. Correct.
Correct. This is a classic website footprinting approach that stays within reconnaissance and content discovery. Reviewing robots.txt can reveal disallowed paths, forced browsing can uncover hidden directories and backup files, and inspecting HTTP headers and page source can identify technologies such as web servers, frameworks, CMS indicators, and client-side libraries. This method aligns with the client's requirement to minimize interaction with dynamic application functionality while still collecting meaningful footprinting data.
- B. Incorrect.
Incorrect. SQL injection testing is an active exploitation technique, not website footprinting. It directly interacts with application inputs and attempts to manipulate backend database queries. While it may reveal valuable information, it exceeds the stated requirement to minimize interaction with dynamic functions and moves into vulnerability assessment/exploitation rather than reconnaissance.
- C. Incorrect.
Incorrect. Password spraying targets authentication systems and is used to identify valid credentials or weak access controls. This is not website footprinting and introduces unnecessary risk and noise during reconnaissance. It also directly targets dynamic application functionality, which the client asked you to minimize.
- D. Incorrect.
Incorrect. Uploading a web shell is post-exploitation activity and is far beyond footprinting. It requires a successful compromise of the application and is not an acceptable method for reconnaissance. This option reflects a misunderstanding between information gathering and exploitation.