Recon & OSINT
A tester who wants to view a page as it appeared previously, even if it's since changed, would look at this stored copy.
What is the cached version of the page?
This is the go-to tool for network port scanning and host discovery.
What is Nmap?
After testing, a pentester should do this to any system they modified.
What is return it to its original state?
Report templates exist primarily to do this with the information a report must contain.
What is standardize the needed information?
This metadata embedded in photos can reveal location, device, and timestamps.
What is EXIF data?
This early phase of an engagement focuses on gathering information about the target.
What is reconnaissance (information gathering)?
This command scans all UDP and TCP ports on a host: nmap -sU -sT -p 1-65535 example.com
What is a full-range TCP and UDP port scan?
Capturing payment card data at the point of entry describes this attack.
What is card skimming?
When new findings shift, what matters the most during mid-engagement.
What is goal reprioritization?
Running host -t axfr attempts to pull an entire DNS zone via this.
What is a zone transfer?
This command resolves each entry in a file against a domain: cat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com
What is subdomain enumeration (brute-forcing hostnames)?
This attack exploits servers still supporting SSLv2 to break TLS connections.
What is the DROWN attack?
This framework is used to hook and exploit web browsers.
What is BeEF?
This document defines what testers may and may not do during an engagement.
What are the rules of engagement?
The command enum -passive -d belongs to this subdomain-discovery tool.
What is amass?
Setting DIR_MODE=0777 in adduser.conf creates this risk for newly added accounts.
What is exposing other users' sensitive data?
Using BlobServiceClient and upload_blob in an engagement accomplishes this objective.
What is exfiltrating data to cloud storage?
If a client's system behaves abnormally after an engagement, this is the likely cause.
What is configuration changes were not reverted?
Keeping one client's assessment data separate from another's is this practice.
What is data isolation?
This modular framework organizes OSINT collection into "modules" and workspaces.
What is Recon-ng?
Mr. Green's favorite car (Make, Model & Year)
What is a 2018 Gran Sport Corvette?
The full name of the President's at WTC?
Who is Margie Aguilar?
The name of the PenTest exam.
What is PT0-003?
Reusing a captured authentication token against OpenID Connect/OAuth describes this.
What is a replay attack?
This tool maps relationships between people, domains, and infrastructure using visual link analysis.
What is Maltego?