Examius
🌍 Ethical Hacking · flashcards
Ethical Hacking Footprinting and Reconnaissance Flashcards
51 question-and-answer cards covering Footprinting and Reconnaissance as it is examined in Ethical Hacking. 24 of them are printed below, taken from across the deck — no signup, no paywall on the preview.
24 sample cards from the Footprinting and Reconnaissance deck
Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.
What is an anonymizer (anonymous proxy) service?
An anonymizer is a web-based tool or proxy that removes identifying information from web requests, letting a user browse or query targets without revealing their IP, browser, or location details.
What does 'limiting public information' mean as a countermeasure to footprinting?
It means reducing the organization's information footprint by removing or restricting publicly available data (on websites, job posts, social media, WHOIS) that attackers could use during reconnaissance.
How can WHOIS-based footprinting be mitigated?
By using domain privacy/WHOIS redaction services (a proxy registrant), providing generic role-based contacts instead of individuals, and limiting personal details in registration records.
Why are job postings a footprinting risk, and how can this be limited?
Detailed postings reveal technologies, software versions, and infrastructure in use. Mitigation: keep listings generic, avoid naming specific product versions or internal tools, and route contacts through HR rather than technical staff.
What role do security policies play in defending against footprinting?
Security policies define rules for what information may be published, how data is handled and classified, acceptable use, and employee conduct, reducing inadvertent leakage of sensitive information.
What is security awareness training and why is it important against social engineering?
Security awareness training educates employees to recognize and resist social engineering, phishing, and pretexting. Since humans are the weakest link, trained staff are the primary defense against manipulation-based attacks.
Name three technical countermeasures to reduce DNS enumeration exposure.
Restrict zone transfers to authorized secondary servers only, split internal/external DNS (split-horizon DNS), and avoid descriptive hostnames that reveal function (e.g., 'payroll-db').
What is competitive intelligence gathering in footprinting?
It is the legal collection and analysis of publicly available information about a competitor or target organization's products, finances, personnel, and strategy from sources like websites, filings, and press releases.
What is website footprinting and what tools support it?
Website footprinting extracts information from a target's website (software, technologies, directory structure, contacts). Tools include web spiders/crawlers, HTTrack (mirroring), Burp Suite, and browser extensions like Wappalyzer/BuiltWith.
What is email footprinting and what can email headers reveal?
Email footprinting analyzes email headers and tracking to gather data. Headers reveal sender IP, mail servers traversed, originating client, timestamps, and sometimes internal server names and geolocation.
What is the 'nslookup' tool used for in reconnaissance?
nslookup is a command-line tool that queries DNS servers to obtain records (A, MX, NS, etc.) and can attempt zone transfers, helping enumerate a domain's hosts and mail infrastructure.
What does the 'dig' command do?
dig (Domain Information Groper) is a flexible DNS lookup tool that queries name servers for any record type and can request zone transfers (dig axfr), commonly used on Unix/Linux for DNS enumeration.
What is the difference between forward and reverse DNS lookup?
Forward lookup resolves a hostname to an IP address (A/AAAA records). Reverse lookup resolves an IP address back to a hostname using PTR records in the in-addr.arpa (or ip6.arpa) zone.
What is OSINT and how does it relate to footprinting?
OSINT (Open-Source Intelligence) is intelligence collected from publicly available sources. It underpins passive footprinting, drawing on search engines, social media, public records, and databases to profile a target.
Name two popular OSINT/footprinting automation tools.
Maltego (graph-based link analysis of relationships), theHarvester (emails, subdomains, hosts from public sources), Recon-ng, Shodan, and SpiderFoot are common examples.
What is Shodan and why is it valuable for reconnaissance?
Shodan is a search engine for Internet-connected devices that indexes banners and services. It lets a researcher find exposed servers, webcams, ICS/SCADA systems, and open ports across the Internet.
What is social media footprinting?
Social media footprinting harvests information from platforms like LinkedIn, Facebook, and X (Twitter) to learn employee names, roles, relationships, technologies, locations, and details usable for social engineering.
What is DNS cache snooping?
DNS cache snooping queries a DNS resolver (with recursion off) to determine whether a given record is already cached, revealing which external sites the organization's users have recently visited.
What is the purpose of the WHOIS 'registrar' vs 'registry' distinction?
The registry is the authoritative database operator for a TLD (e.g., Verisign for .com). The registrar is the accredited company that sells/manages domain registrations to customers and submits records to the registry.
What is 'Google cache' vs the 'Wayback Machine' for passive recon?
Google cache stores a recent snapshot of pages; the Wayback Machine (archive.org) stores historical snapshots over time, letting a researcher view past versions of a site that may expose removed sensitive content.
What is a ping sweep, and is it active or passive footprinting?
A ping sweep sends ICMP echo requests to a range of IP addresses to find live hosts. It is active footprinting because it directly probes the target and can be detected.
What is banner grabbing during footprinting?
Banner grabbing connects to a service (e.g., HTTP, FTP, SSH) to read its banner/response, revealing the software name and version, which helps identify potential vulnerabilities. It is an active technique.
State the general order of footprinting relative to other hacking phases.
Footprinting/reconnaissance is Phase 1, followed by scanning (Phase 2), gaining access (Phase 3), maintaining access (Phase 4), and clearing tracks (Phase 5).
Why is limiting information disclosure in error messages a footprinting countermeasure?
Verbose error messages can leak software versions, file paths, SQL queries, and stack traces. Configuring generic custom error pages prevents attackers from harvesting internal details during reconnaissance.
What this deck covers
The Footprinting and Reconnaissance deck follows the Ethical Hacking Footprinting and Reconnaissance syllabus — 3 chapters and 9 topics — so questions land on material that is genuinely examinable rather than trivia around it. That works out to roughly 17.0 cards per chapter.
Answers are written to be recallable, not just readable — averaging about 201 characters, which is long enough to carry the reasoning and short enough to say out loud.
A deck like this earns its keep on the second and third pass. Read the syllabus first so you know the shape of the subject, then use the cards to find the specific facts that have not stuck.
Footprinting and Reconnaissance flashcards FAQ
How many Footprinting and Reconnaissance flashcards are in this Ethical Hacking deck?
51 cards. This page previews 24 of them, sampled evenly across the deck so you can judge the difficulty before installing anything.
Are these Ethical Hacking flashcards free?
Yes. The preview here is free to read with no signup, and the full 51-card deck is free inside the Examius app.
What do the Footprinting and Reconnaissance cards cover?
They follow the Ethical Hacking Footprinting and Reconnaissance syllabus — 3 chapters and 9 topics — so the questions track what is actually examinable.
How should I use these flashcards?
Read the syllabus first so you know the shape of the subject, then drill the deck. Examius schedules each card with spaced repetition, so cards you keep missing come back sooner and ones you know drift further apart.