Examius

🌍 Ethical Hacking · subject

Ethical Hacking Footprinting and Reconnaissance Syllabus

The Footprinting and Reconnaissance syllabus for Ethical Hacking in full: 3 chapters and 9 topics, every one listed below, plus 51 Footprinting and Reconnaissance flashcards with answers.

3Chapters
9Topics
51Flashcards

Footprinting and Reconnaissance syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Types of Footprinting

     2 topics
    • Active Footprinting
    • Passive Footprinting

  2. Tools and Techniques

     4 topics
    • WHOIS Lookup
    • DNS Enumeration
    • Social Engineering
    • Google Hacking

  3. Countermeasures

     3 topics
    • Anonymization Techniques
    • Limiting Public Information
    • Security Policies and Awareness

Ethical Hacking Footprinting and Reconnaissance flashcards — 51 questions with answers

  1. What is footprinting (reconnaissance) in ethical hacking?

    Footprinting is the first phase of hacking: the process of gathering as much information as possible about a target system, network, or organization to identify ways to intrude. It creates a blueprint of the target's security profile.

  2. Define active footprinting and give two examples.

    Active footprinting involves directly interacting with the target system to gather information, which can be detected and logged. Examples: port scanning, ping sweeps, DNS zone transfers, social engineering, and querying servers directly.

  3. Define passive footprinting and give two examples.

    Passive footprinting gathers information without directly interacting with the target, using publicly available resources so the target cannot detect it. Examples: searching Google, reading news, WHOIS databases, job postings, and social media.

  4. Compare active vs. passive footprinting in terms of detectability.

    Active footprinting directly touches the target and can be detected/logged by IDS or firewalls, carrying legal risk. Passive footprinting uses third-party/public sources, leaves no trace on the target, and is essentially undetectable.

  5. What is WHOIS and what information does a WHOIS lookup typically reveal?

    WHOIS is a query/response protocol for querying databases that store registered domain/IP assignments. A lookup reveals the registrant name, organization, contact details, registrar, registration and expiry dates, and name servers.

  6. What are the two main data models used by WHOIS registries?

    The thick model (registry stores full contact details for all registrars) and the thin model (registry stores only the registrar and name servers, so you must query the registrar's WHOIS for full details).

  7. What protocol and default port does the WHOIS service use?

    WHOIS runs over TCP on port $43$. The newer RDAP (Registration Data Access Protocol) that supersedes it uses HTTPS on port $443$.

  8. What is DNS enumeration?

    DNS enumeration is the process of locating all DNS servers and their records for an organization to gather information such as hostnames, IP addresses, mail servers, and internal network layout.

  9. List five common DNS record types and what each maps to.

    A: hostname to IPv4 address; AAAA: hostname to IPv6 address; MX: mail exchange server; NS: authoritative name server; CNAME: canonical (alias) name; PTR: reverse (IP to hostname); SOA: start of authority; TXT: arbitrary text (e.g., SPF).

  10. What is a DNS zone transfer (AXFR) and why is it a security concern?

    A zone transfer (AXFR) copies the entire DNS zone database from a primary to a secondary server. If a misconfigured server allows anyone to request it, an attacker obtains a full map of all hostnames and IPs in the domain.

  11. What does an SOA (Start of Authority) DNS record contain?

    The SOA record holds the primary name server, the responsible party's email, a serial number, and timers: refresh, retry, expire, and minimum (negative-cache) TTL for the zone.

  12. What is social engineering in the context of footprinting?

    Social engineering is the psychological manipulation of people into divulging confidential information or performing actions that compromise security, exploiting human trust rather than technical vulnerabilities.

  13. Name four common social engineering techniques.

    Phishing (fraudulent messages), pretexting (inventing a scenario), baiting (offering something enticing like a USB drive), tailgating/piggybacking (following someone into a secure area), and vishing (voice phishing over phone).

  14. What is the difference between phishing and spear phishing?

    Phishing sends generic fraudulent messages to many recipients hoping some respond. Spear phishing is targeted at a specific individual or organization using personalized information to appear more credible.

  15. What is 'dumpster diving' and why is it relevant to reconnaissance?

    Dumpster diving is searching an organization's trash for discarded documents, media, or notes that reveal sensitive information such as passwords, network diagrams, phone lists, or internal memos.

  16. What is Google hacking (Google dorking)?

    Google hacking uses advanced search operators to find sensitive information exposed by websites, such as login pages, configuration files, error messages, and vulnerable devices indexed by search engines.

  17. What does the 'site:' Google dork operator do, and give an example?

    'site:' restricts results to a specific domain. Example: site:example.com returns only pages from example.com, useful for mapping a target's indexed pages.

  18. What does the 'filetype:' (or 'ext:') Google operator do?

    It limits results to a specific file extension. Example: filetype:pdf or filetype:xls site:example.com finds documents of that type on the target, often exposing sensitive data.

  19. What does the 'intitle:' Google operator do?

    'intitle:' finds pages whose HTML title contains the specified word. Example: intitle:"index of" reveals open directory listings; allintitle: requires all listed words in the title.

  20. What does the 'inurl:' Google operator do?

    'inurl:' returns pages whose URL contains the specified string. Example: inurl:admin or inurl:login helps locate administrative or login pages.

Show the other 31 Footprinting and Reconnaissance flashcards

  1. What is the Google Hacking Database (GHDB)?

    The GHDB (hosted by Exploit-DB/Offensive Security) is a curated repository of Google dork queries that reveal sensitive information, vulnerable systems, and exposed devices.

  2. What is the 'cache:' Google operator used for?

    'cache:' displays Google's cached (stored) version of a web page, allowing an attacker to view content even if the live page has been changed or removed, and often without contacting the target server.

  3. What are anonymization techniques in reconnaissance?

    Anonymization techniques hide an attacker's true identity and source when gathering information, using tools like proxy servers, VPNs, the Tor network, and anonymizers to mask IP address and location.

  4. How does a proxy server help anonymize reconnaissance activity?

    A proxy server acts as an intermediary, forwarding the attacker's requests so the target sees the proxy's IP address instead of the attacker's, hiding origin and optionally chaining multiple proxies (proxy chaining).

  5. What is the Tor network and how does it provide anonymity?

    Tor (The Onion Router) routes traffic through a volunteer-run series of relays, encrypting it in layers so no single node knows both source and destination, concealing the user's IP address and location.

  6. What is a VPN and how does it aid anonymization?

    A VPN (Virtual Private Network) creates an encrypted tunnel between the user and a VPN server, so traffic appears to originate from the VPN server's IP, hiding the user's real IP and encrypting data from the local network/ISP.

  7. What is the difference between a VPN and the Tor network for anonymity?

    A VPN routes traffic through a single provider-controlled server (fast, but the provider can see traffic). Tor routes through multiple independent relays with layered encryption (slower, but no single party knows both ends).

  8. What is an anonymizer (anonymous proxy) service?

    An anonymizer is a web-based tool or proxy that removes identifying information from web requests, letting a user browse or query targets without revealing their IP, browser, or location details.

  9. What does 'limiting public information' mean as a countermeasure to footprinting?

    It means reducing the organization's information footprint by removing or restricting publicly available data (on websites, job posts, social media, WHOIS) that attackers could use during reconnaissance.

  10. How can WHOIS-based footprinting be mitigated?

    By using domain privacy/WHOIS redaction services (a proxy registrant), providing generic role-based contacts instead of individuals, and limiting personal details in registration records.

  11. Why are job postings a footprinting risk, and how can this be limited?

    Detailed postings reveal technologies, software versions, and infrastructure in use. Mitigation: keep listings generic, avoid naming specific product versions or internal tools, and route contacts through HR rather than technical staff.

  12. What role do security policies play in defending against footprinting?

    Security policies define rules for what information may be published, how data is handled and classified, acceptable use, and employee conduct, reducing inadvertent leakage of sensitive information.

  13. What is security awareness training and why is it important against social engineering?

    Security awareness training educates employees to recognize and resist social engineering, phishing, and pretexting. Since humans are the weakest link, trained staff are the primary defense against manipulation-based attacks.

  14. Name three technical countermeasures to reduce DNS enumeration exposure.

    Restrict zone transfers to authorized secondary servers only, split internal/external DNS (split-horizon DNS), and avoid descriptive hostnames that reveal function (e.g., 'payroll-db').

  15. What is competitive intelligence gathering in footprinting?

    It is the legal collection and analysis of publicly available information about a competitor or target organization's products, finances, personnel, and strategy from sources like websites, filings, and press releases.

  16. What is website footprinting and what tools support it?

    Website footprinting extracts information from a target's website (software, technologies, directory structure, contacts). Tools include web spiders/crawlers, HTTrack (mirroring), Burp Suite, and browser extensions like Wappalyzer/BuiltWith.

  17. What is email footprinting and what can email headers reveal?

    Email footprinting analyzes email headers and tracking to gather data. Headers reveal sender IP, mail servers traversed, originating client, timestamps, and sometimes internal server names and geolocation.

  18. What is the 'nslookup' tool used for in reconnaissance?

    nslookup is a command-line tool that queries DNS servers to obtain records (A, MX, NS, etc.) and can attempt zone transfers, helping enumerate a domain's hosts and mail infrastructure.

  19. What does the 'dig' command do?

    dig (Domain Information Groper) is a flexible DNS lookup tool that queries name servers for any record type and can request zone transfers (dig axfr), commonly used on Unix/Linux for DNS enumeration.

  20. What is the difference between forward and reverse DNS lookup?

    Forward lookup resolves a hostname to an IP address (A/AAAA records). Reverse lookup resolves an IP address back to a hostname using PTR records in the in-addr.arpa (or ip6.arpa) zone.

  21. What is OSINT and how does it relate to footprinting?

    OSINT (Open-Source Intelligence) is intelligence collected from publicly available sources. It underpins passive footprinting, drawing on search engines, social media, public records, and databases to profile a target.

  22. Name two popular OSINT/footprinting automation tools.

    Maltego (graph-based link analysis of relationships), theHarvester (emails, subdomains, hosts from public sources), Recon-ng, Shodan, and SpiderFoot are common examples.

  23. What is Shodan and why is it valuable for reconnaissance?

    Shodan is a search engine for Internet-connected devices that indexes banners and services. It lets a researcher find exposed servers, webcams, ICS/SCADA systems, and open ports across the Internet.

  24. What is social media footprinting?

    Social media footprinting harvests information from platforms like LinkedIn, Facebook, and X (Twitter) to learn employee names, roles, relationships, technologies, locations, and details usable for social engineering.

  25. What is DNS cache snooping?

    DNS cache snooping queries a DNS resolver (with recursion off) to determine whether a given record is already cached, revealing which external sites the organization's users have recently visited.

  26. What is the purpose of the WHOIS 'registrar' vs 'registry' distinction?

    The registry is the authoritative database operator for a TLD (e.g., Verisign for .com). The registrar is the accredited company that sells/manages domain registrations to customers and submits records to the registry.

  27. What is 'Google cache' vs the 'Wayback Machine' for passive recon?

    Google cache stores a recent snapshot of pages; the Wayback Machine (archive.org) stores historical snapshots over time, letting a researcher view past versions of a site that may expose removed sensitive content.

  28. What is a ping sweep, and is it active or passive footprinting?

    A ping sweep sends ICMP echo requests to a range of IP addresses to find live hosts. It is active footprinting because it directly probes the target and can be detected.

  29. What is banner grabbing during footprinting?

    Banner grabbing connects to a service (e.g., HTTP, FTP, SSH) to read its banner/response, revealing the software name and version, which helps identify potential vulnerabilities. It is an active technique.

  30. State the general order of footprinting relative to other hacking phases.

    Footprinting/reconnaissance is Phase 1, followed by scanning (Phase 2), gaining access (Phase 3), maintaining access (Phase 4), and clearing tracks (Phase 5).

  31. Why is limiting information disclosure in error messages a footprinting countermeasure?

    Verbose error messages can leak software versions, file paths, SQL queries, and stack traces. Configuring generic custom error pages prevents attackers from harvesting internal details during reconnaissance.

Ethical Hacking Footprinting and Reconnaissance FAQ

What is in the Ethical Hacking Footprinting and Reconnaissance syllabus?

Ethical Hacking Footprinting and Reconnaissance is split into 3 chapters: Types of Footprinting, Tools and Techniques and Countermeasures. Together they contain 9 topics.

How many chapters are in Ethical Hacking Footprinting and Reconnaissance?

3 chapters, containing 9 topics. The largest chapter is Tools and Techniques, with 4 topics.

Are there flashcards for Ethical Hacking Footprinting and Reconnaissance?

Yes — a 51-card Footprinting and Reconnaissance deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.