312-50 Question 52
Single answer▪ Footprinting ToolsDuring the reconnaissance phase of an authorized assessment, you need to identify the public-facing subdomains of a target company while minimizing direct interaction with the company's infrastructure. The client specifically asks you to rely on publicly available information and avoid active probing such as port scanning or brute-force DNS queries against their name servers. Which tool is the MOST appropriate for this requirement?
- A
theHarvester
- B
Nmap
- C
Nikto
- D
Hydra
Show answer and explanation
Correct answer: A
Explanation
This question tests the ability to choose the correct footprinting tool based on operational constraints, not just tool recognition. In CEH-style scenarios, the key distinction is whether the engagement requires passive reconnaissance or allows active enumeration. theHarvester is commonly used in footprinting to collect subdomains and related OSINT from public data sources with minimal target interaction. By contrast, Nmap, Nikto, and Hydra are active tools used for scanning, vulnerability identification, and password attacks respectively, making them unsuitable here. This aligns with standard reconnaissance best practices: use passive information gathering first when the scope or rules of engagement restrict direct contact with target systems. Public documentation for theHarvester describes its use in collecting emails, subdomains, hosts, employee names, and URLs from public sources, which fits this scenario precisely.
- A. Correct.
Correct. theHarvester is designed for passive or low-impact footprinting by gathering information such as subdomains, email addresses, hostnames, and related data from public sources including search engines, certificate transparency data sources, and other OSINT repositories. In this scenario, it best matches the requirement to identify public-facing subdomains while minimizing direct interaction with the target's infrastructure.
- B. Incorrect.
Incorrect. Nmap is primarily an active network discovery and port scanning tool. Although it can perform host discovery and service enumeration, using it would directly probe the target's infrastructure, which violates the client's requirement to avoid active reconnaissance.
- C. Incorrect.
Incorrect. Nikto is a web server vulnerability scanner used to identify misconfigurations, dangerous files, outdated software, and common web vulnerabilities. It is not intended for passive subdomain footprinting and requires direct interaction with target web servers.
- D. Incorrect.
Incorrect. Hydra is a credential attack tool used for online password guessing against services such as SSH, FTP, HTTP, and others. It is unrelated to passive footprinting and would be inappropriate and intrusive in this scenario.