Ethical Hacking Footprinting and Reconnaissance Syllabus

Footprinting and Reconnaissance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Footprinting and Reconnaissance in Ethical Hacking, not a summary of it.

1. 1

   Types of Footprinting

   2 topics

   • Active Footprinting
   • Passive Footprinting
2. 2

   Tools and Techniques

   4 topics

   • WHOIS Lookup
   • DNS Enumeration
   • Social Engineering
   • Google Hacking
3. 3

   Countermeasures

   3 topics

   • Anonymization Techniques
   • Limiting Public Information
   • Security Policies and Awareness

Footprinting and Reconnaissance flashcards for Ethical Hacking

25 of 51 cards from the Footprinting and Reconnaissance deck — real questions with worked answers.

1. What is footprinting (reconnaissance) in ethical hacking?

   Footprinting is the first phase of hacking: the process of gathering as much information as possible about a target system, network, or organization to identify ways to intrude. It creates a blueprint of the target's security profile.

2. Define active footprinting and give two examples.

   Active footprinting involves directly interacting with the target system to gather information, which can be detected and logged. Examples: port scanning, ping sweeps, DNS zone transfers, social engineering, and querying servers directly.

3. Define passive footprinting and give two examples.

   Passive footprinting gathers information without directly interacting with the target, using publicly available resources so the target cannot detect it. Examples: searching Google, reading news, WHOIS databases, job postings, and social media.

4. Compare active vs. passive footprinting in terms of detectability.

   Active footprinting directly touches the target and can be detected/logged by IDS or firewalls, carrying legal risk. Passive footprinting uses third-party/public sources, leaves no trace on the target, and is essentially undetectable.

5. What is WHOIS and what information does a WHOIS lookup typically reveal?

   WHOIS is a query/response protocol for querying databases that store registered domain/IP assignments. A lookup reveals the registrant name, organization, contact details, registrar, registration and expiry dates, and name servers.

6. What are the two main data models used by WHOIS registries?

   The thick model (registry stores full contact details for all registrars) and the thin model (registry stores only the registrar and name servers, so you must query the registrar's WHOIS for full details).

7. What protocol and default port does the WHOIS service use?

   WHOIS runs over TCP on port $43$. The newer RDAP (Registration Data Access Protocol) that supersedes it uses HTTPS on port $443$.

8. What is DNS enumeration?

   DNS enumeration is the process of locating all DNS servers and their records for an organization to gather information such as hostnames, IP addresses, mail servers, and internal network layout.

9. List five common DNS record types and what each maps to.

   A: hostname to IPv4 address; AAAA: hostname to IPv6 address; MX: mail exchange server; NS: authoritative name server; CNAME: canonical (alias) name; PTR: reverse (IP to hostname); SOA: start of authority; TXT: arbitrary text (e.g., SPF).

10. What is a DNS zone transfer (AXFR) and why is it a security concern?

    A zone transfer (AXFR) copies the entire DNS zone database from a primary to a secondary server. If a misconfigured server allows anyone to request it, an attacker obtains a full map of all hostnames and IPs in the domain.

11. What does an SOA (Start of Authority) DNS record contain?

    The SOA record holds the primary name server, the responsible party's email, a serial number, and timers: refresh, retry, expire, and minimum (negative-cache) TTL for the zone.

12. What is social engineering in the context of footprinting?

    Social engineering is the psychological manipulation of people into divulging confidential information or performing actions that compromise security, exploiting human trust rather than technical vulnerabilities.

13. Name four common social engineering techniques.

    Phishing (fraudulent messages), pretexting (inventing a scenario), baiting (offering something enticing like a USB drive), tailgating/piggybacking (following someone into a secure area), and vishing (voice phishing over phone).

14. What is the difference between phishing and spear phishing?

    Phishing sends generic fraudulent messages to many recipients hoping some respond. Spear phishing is targeted at a specific individual or organization using personalized information to appear more credible.

15. What is 'dumpster diving' and why is it relevant to reconnaissance?

    Dumpster diving is searching an organization's trash for discarded documents, media, or notes that reveal sensitive information such as passwords, network diagrams, phone lists, or internal memos.

16. What is Google hacking (Google dorking)?

    Google hacking uses advanced search operators to find sensitive information exposed by websites, such as login pages, configuration files, error messages, and vulnerable devices indexed by search engines.

17. What does the 'site:' Google dork operator do, and give an example?

    'site:' restricts results to a specific domain. Example: site:example.com returns only pages from example.com, useful for mapping a target's indexed pages.

18. What does the 'filetype:' (or 'ext:') Google operator do?

    It limits results to a specific file extension. Example: filetype:pdf or filetype:xls site:example.com finds documents of that type on the target, often exposing sensitive data.

19. What does the 'intitle:' Google operator do?

    'intitle:' finds pages whose HTML title contains the specified word. Example: intitle:"index of" reveals open directory listings; allintitle: requires all listed words in the title.

20. What does the 'inurl:' Google operator do?

    'inurl:' returns pages whose URL contains the specified string. Example: inurl:admin or inurl:login helps locate administrative or login pages.

21. What is the Google Hacking Database (GHDB)?

    The GHDB (hosted by Exploit-DB/Offensive Security) is a curated repository of Google dork queries that reveal sensitive information, vulnerable systems, and exposed devices.

22. What is the 'cache:' Google operator used for?

    'cache:' displays Google's cached (stored) version of a web page, allowing an attacker to view content even if the live page has been changed or removed, and often without contacting the target server.

23. What are anonymization techniques in reconnaissance?

    Anonymization techniques hide an attacker's true identity and source when gathering information, using tools like proxy servers, VPNs, the Tor network, and anonymizers to mask IP address and location.

24. How does a proxy server help anonymize reconnaissance activity?

    A proxy server acts as an intermediary, forwarding the attacker's requests so the target sees the proxy's IP address instead of the attacker's, hiding origin and optionally chaining multiple proxies (proxy chaining).

25. What is the Tor network and how does it provide anonymity?

    Tor (The Onion Router) routes traffic through a volunteer-run series of relays, encrypting it in layers so no single node knows both source and destination, concealing the user's IP address and location.

See more Footprinting and Reconnaissance flashcards →

Planning Footprinting and Reconnaissance for Ethical Hacking

Footprinting and Reconnaissance (Ethical Hacking) FAQ