312-50 Question 54
Single answer▪ Footprinting ToolsDuring the reconnaissance phase of an authorized assessment, you need to identify the public-facing IP ranges and autonomous system number (ASN) used by a target company without sending packets directly to the company's hosts. Which footprinting tool is the most appropriate for this task?
- A
Amass
- B
theHarvester
- C
Nmap
- D
Wireshark
Show answer and explanation
Correct answer: A
Explanation
This question tests the ability to choose the correct footprinting tool for passive reconnaissance. In CEH-style scenarios, the key distinction is between OSINT/footprinting tools and active scanning tools. When the goal is to identify externally visible infrastructure such as ASNs and public IP ranges without directly touching target systems, a tool like Amass is appropriate because it aggregates data from public sources and infrastructure relationships. By contrast, Nmap is an active scanner, and Wireshark is a traffic analysis tool rather than a reconnaissance platform. theHarvester is valuable for email, subdomain, and contact intelligence, but it is less focused on ASN and netblock enumeration than Amass. This aligns with standard reconnaissance best practices: begin with passive intelligence gathering before moving to active validation. Relevant references include the OWASP Testing Guide's information gathering principles and official project documentation for Amass and theHarvester describing their intended reconnaissance use cases.
- A. Correct.
Correct. Amass is well-suited for passive and active external reconnaissance, including mapping domains, subdomains, ASNs, netblocks, and related infrastructure. In this scenario, its ability to correlate public data sources to identify ASN and IP ranges makes it the best fit for footprinting without directly probing target hosts.
- B. Incorrect.
Incorrect. theHarvester is useful for gathering OSINT such as email addresses, subdomains, employee names, and hosts from public sources like search engines and PGP servers. However, it is not the strongest choice when the primary objective is to enumerate the organization's ASN and associated public netblocks.
- C. Incorrect.
Incorrect. Nmap is primarily a network scanning and service discovery tool. Although it can help identify live hosts, open ports, and service versions, using it would generally involve sending packets to the target environment, which conflicts with the requirement to avoid direct interaction during this stage.
- D. Incorrect.
Incorrect. Wireshark is a packet capture and protocol analysis tool used to inspect traffic that you can already observe. It does not perform external footprinting to discover a company's ASN or public IP ranges from public intelligence sources.