Fill in the Blanks
This command line tool is built into Windows and Linux and is used to search DNS records to map names to IP addresses.
nslookup
An attacker who is performing reconnaissance techniques from inside the target network is operating at this layer.
Layer 3 - local access to the target
The Nmap option that would be used to find out the specific version of the web server software running on a target host.
-sV
A Google Dork (aka Google Hack) is a search string that uses ________ ______ _________to find _____ info that is hard to find with a simple search
Advanced Search Operators & OSINT
The _____ file is used to let web-crawling bots know which files and folders on a website should be identified with the Disallow: field.
Robots.txt
An attacker using nslookup -type=SOA can quietly discover which organization administers a domain, since the SOA record often exposes the domain’s primary nameserver along with its __________ contact information.
administrator
Identifying the specific OS or application running on a system.
Fingerprinting
Which of the following is not a reconnaissance goal?
A. Identifying active hosts and their IP addresses
B. Discovering open ports to profile possible services
C. Fingerprinting the operating system of networked machines
D. Enumerating internal file system structures and directory contents
E. Identifying running services and associated versions
D(requires deeper access → not recon)
Refer back to Layer 2 of the recon process. At this layer, the attack interacts with the system ____ and the techniques are initiated from outside the ________.
externally, target network
What is one common characteristic between A and AAAA records and what is one significant difference?
Both map domain (human-readable) names to IP addresses. However, A record is used for IPv4 and AAAA record is used for IPv6.
You are a cybersecurity analyst, brought in to investigate unusual activity on a startup’s internal network. Before diving deeper, you need to verify which machines are actually powered on and reachable, and then determine whether any suspicious services are running on the main application server. You suspect outdated software might be exposed, but you aren’t sure what operating system the server is running. What type of Nmap scan should you perform at each step? (Hint: order the 4 types of scans accordingly)
You should run a Host Discovery Scan to verify which machines are live. You should then use a Port Scan to find open ports. Then, use a Service/Version Scan to identify the specific software and versions. Finally, use the OS Detection Scan to determine which operating system the server is running.
More ____ bits in the subnet mask means more ____(s) in the network.
host (for both)
What is 127.0.0.1 called?
Loopback address
Suppose you are trying to force two PCs to only be able to communicate with each other between different LANs when using a router. How could you change the subnet mask to achieve this if the PCs share the same first two octets, but have a different last two?
Change the subnet mask to include the third or fourth octet, changing the network ID of the PCs