Chapter 42 Quiz: Advanced OSINT & Attack Surface Mapping¶
Test your knowledge of passive and active reconnaissance, OSINT tools and concepts, certificate transparency, DNS enumeration, and MITRE ATT&CK Reconnaissance techniques.
Questions¶
1. An analyst discovers a target organization's internal hostnames by querying Certificate Transparency (CT) logs. Which type of reconnaissance does this represent?
- A) Active reconnaissance, because the analyst interacted with the target's infrastructure
- B) Passive reconnaissance, because CT logs are publicly accessible third-party records
- C) Semi-active reconnaissance, because certificates were issued by a third party
- D) Social engineering, because the analyst obtained information the organization did not intend to share
Answer
B — Passive reconnaissance, because CT logs are publicly accessible third-party records
Certificate Transparency logs (e.g., crt.sh, Censys) are publicly maintained records of SSL/TLS certificates issued by Certificate Authorities. Querying these logs does not send any traffic to the target organization's infrastructure, making it a passive reconnaissance technique. CT logs frequently expose internal hostnames, subdomain structures, and organizational hierarchy that were not intended to be public.
2. During attack surface mapping, a red team operator uses DNS zone transfer requests (AXFR) against the target's authoritative name servers. What category of reconnaissance is this, and why?
- A) Passive reconnaissance — DNS is a public protocol
- B) Active reconnaissance — it directly queries the target's infrastructure and may be logged
- C) Passive reconnaissance — zone transfers are standard DNS operations
- D) OSINT collection — DNS records are open-source information
Answer
B — Active reconnaissance — it directly queries the target's infrastructure and may be logged
DNS zone transfer (AXFR) requests are sent directly to the target's name servers and request a complete copy of the DNS zone. This is active reconnaissance because it involves direct interaction with target infrastructure, can be detected and logged, and may be blocked by properly configured DNS servers. Successful zone transfers reveal the complete DNS record inventory.
3. Which MITRE ATT&CK technique ID corresponds to "Gather Victim Network Information" during the Reconnaissance tactic?
- A) T1590
- B) T1595
- C) T1592
- D) T1589
Answer
A — T1590
T1590 (Gather Victim Network Information) covers adversary activities to collect network configuration details such as IP ranges, domain names, network topology, and DNS records. T1589 covers Gather Victim Identity Information, T1592 covers Gather Victim Host Information, and T1595 covers Active Scanning. These all fall under the Reconnaissance tactic (TA0043).
4. An OSINT analyst uses Google dorking with the query site:target.com filetype:pdf "confidential". What is the primary risk this technique identifies?
- A) SQL injection vulnerabilities in the target's web application
- B) Sensitive documents unintentionally indexed by search engines and publicly accessible
- C) Misconfigured DNS records exposing internal infrastructure
- D) Weak TLS configurations on the target's web servers
Answer
B — Sensitive documents unintentionally indexed by search engines and publicly accessible
Google dorking leverages advanced search operators to find information indexed by search engines that organizations may not realize is publicly accessible. The query searches for PDF files on the target domain containing the word "confidential," which could reveal policy documents, financial reports, or internal communications. This is a passive OSINT technique since it queries Google, not the target directly.
5. During subdomain enumeration, an analyst discovers that several subdomains (e.g., staging.target.com, dev-api.target.com) resolve to IP addresses but return no HTTP content. What attack surface risk do these represent?
- A) No risk — inactive subdomains cannot be exploited
- B) Subdomain takeover risk if the subdomains point to decommissioned cloud resources or dangling DNS records
- C) DNS poisoning vulnerability due to missing DNSSEC
- D) Certificate pinning bypass opportunity
Answer
B — Subdomain takeover risk if the subdomains point to decommissioned cloud resources or dangling DNS records
Dangling DNS records — subdomains pointing to decommissioned cloud services (S3 buckets, Azure web apps, Heroku instances) — create subdomain takeover vulnerabilities. An attacker can claim the unclaimed cloud resource and serve malicious content under the target's legitimate domain, enabling phishing, cookie theft, and reputation damage. This is a critical finding in attack surface assessments.
6. Which OSINT data source would most effectively reveal the technology stack and frameworks used by a target organization's web application?
- A) WHOIS registration records
- B) HTTP response headers, JavaScript library references, and Wappalyzer-style fingerprinting
- C) BGP routing tables
- D) Certificate Transparency logs
Answer
B — HTTP response headers, JavaScript library references, and Wappalyzer-style fingerprinting
Technology stack fingerprinting examines HTTP headers (X-Powered-By, Server), JavaScript libraries loaded in pages, HTML meta tags, cookie naming conventions, and URL structures. Tools conceptually similar to Wappalyzer, BuiltWith, and WhatWeb automate this analysis. This information reveals frameworks, CMS platforms, and server software that can be mapped to known vulnerabilities.
7. An analyst is mapping an organization's external attack surface and discovers that the company's MX records point to a third-party email provider. What additional OSINT value can be derived from this finding?
- A) The organization's internal Active Directory structure
- B) The email security posture (SPF, DKIM, DMARC records) and potential phishing attack surface
- C) The organization's firewall rule set
- D) Employee password policies
Answer
B — The email security posture (SPF, DKIM, DMARC records) and potential phishing attack surface
MX record analysis leads to examining SPF, DKIM, and DMARC DNS records that define the organization's email authentication posture. Weak or missing email authentication records (e.g., DMARC set to p=none, overly broad SPF includes) indicate susceptibility to email spoofing and phishing. This is critical intelligence for social engineering attack planning in red team engagements.
8. Which passive reconnaissance technique can reveal an organization's IP address ranges, ASN assignments, and peering relationships without sending any traffic to the target?
- A) Port scanning with Nmap
- B) BGP and ASN lookups using ARIN/RIPE databases and tools like BGPView
- C) Traceroute to the target's web servers
- D) Banner grabbing against exposed services
Answer
B — BGP and ASN lookups using ARIN/RIPE databases and tools like BGPView
Regional Internet Registries (ARIN, RIPE, APNIC) maintain publicly queryable databases of IP allocations, ASN assignments, and organizational ownership. Tools like BGPView, Hurricane Electric BGP Toolkit, and RIPE Stat allow analysts to map an organization's entire IP footprint, peering relationships, and hosting providers without sending any traffic to the target — a purely passive technique.
9. An OSINT analyst discovers that target employees have posted screenshots on social media that reveal internal application interfaces, internal IP addresses, and software version numbers. Under MITRE ATT&CK, which reconnaissance sub-technique does this map to?
- A) T1593.001 — Search Open Websites/Domains: Social Media
- B) T1595.002 — Active Scanning: Vulnerability Scanning
- C) T1590.004 — Gather Victim Network Information: Network Topology
- D) T1591.004 — Gather Victim Org Information: Identify Roles
Answer
A — T1593.001 — Search Open Websites/Domains: Social Media
T1593.001 covers adversary use of social media platforms to gather information about the target organization. Employee social media posts inadvertently disclosing internal systems, software versions, network configurations, or organizational details represent a significant OSINT risk. This is passive reconnaissance since the information is voluntarily published on third-party platforms.
10. During attack surface mapping, an analyst discovers that the target organization has numerous forgotten API endpoints exposed on various subdomains. What is the security term for these unmanaged, undocumented interfaces?
- A) Zero-day vulnerabilities
- B) Shadow IT APIs or zombie APIs
- C) Honeypot endpoints
- D) API gateway misconfigurations
Answer
B — Shadow IT APIs or zombie APIs
Shadow IT APIs (also called zombie APIs or rogue APIs) are endpoints that exist in production but are not documented, monitored, or maintained by the organization's security team. They often lack authentication, rate limiting, and input validation, making them attractive targets. Attack surface management programs specifically aim to discover and remediate these forgotten interfaces.
11. Which DNS record type is most valuable for identifying third-party services and SaaS platforms used by a target organization?
- A) A records
- B) CNAME records pointing to external service providers
- C) SOA records
- D) PTR records
Answer
B — CNAME records pointing to external service providers
CNAME records create aliases that often point to external service providers (e.g., target.com CNAME to target.zendesk.com, target.s3.amazonaws.com). Enumerating CNAME records reveals the organization's third-party service ecosystem, cloud hosting providers, CDN usage, and SaaS platforms — all of which expand the attack surface and may be vulnerable to subdomain takeover.
12. An organization's job postings on LinkedIn mention specific technologies: "Experience with Splunk Enterprise, CrowdStrike Falcon, and Palo Alto Cortex XDR required." How should a red team classify and use this information?
- A) Irrelevant — job postings do not provide actionable intelligence
- B) As OSINT revealing the defensive technology stack, enabling the red team to tailor evasion techniques to bypass those specific security controls
- C) As evidence of the organization's budget for security tools
- D) As confirmation that the organization has a mature security program and should not be tested
Answer
B — As OSINT revealing the defensive technology stack, enabling the red team to tailor evasion techniques to bypass those specific security controls
Job postings are a rich OSINT source that inadvertently reveals technology stacks, security tools, infrastructure platforms, and organizational structure. Knowing the exact EDR, SIEM, and firewall products allows red teams to test their payloads and C2 infrastructure against those specific solutions in a lab environment before the engagement, significantly increasing operational effectiveness.
13. What is the primary advantage of using passive DNS databases (e.g., historical DNS resolution records) compared to live DNS queries during reconnaissance?
- A) Passive DNS provides faster query response times
- B) Passive DNS reveals historical records including previously used IP addresses, decommissioned subdomains, and infrastructure changes over time — without alerting the target
- C) Passive DNS provides more accurate current DNS records
- D) Passive DNS bypasses DNSSEC validation
Answer
B — Passive DNS reveals historical records including previously used IP addresses, decommissioned subdomains, and infrastructure changes over time — without alerting the target
Passive DNS databases (e.g., Farsight DNSDB, SecurityTrails, VirusTotal) aggregate historical DNS resolution data collected from sensors worldwide. They reveal infrastructure that no longer exists in live DNS but may still be accessible, IP address changes indicating hosting migrations, and temporal patterns in infrastructure deployment — all without generating any queries to the target's DNS servers.
14. An analyst uses Shodan to search for internet-facing devices belonging to a target organization. Which of the following queries would most effectively identify exposed industrial control systems?
- A)
org:"Target Corp" port:80 - B)
org:"Target Corp" port:502,44818 product:"Modbus" OR product:"EtherNet/IP" - C)
org:"Target Corp" http.title:"login" - D)
org:"Target Corp" ssl.cert.subject.cn:"target.com"
Answer
B — org:"Target Corp" port:502,44818 product:"Modbus" OR product:"EtherNet/IP"
Shodan indexes internet-facing devices and their service banners. Port 502 (Modbus) and port 44818 (EtherNet/IP) are industrial control system protocols. Combining organization filters with ICS-specific ports and protocol identifiers effectively surfaces exposed SCADA/ICS devices — a critical finding since these systems should never be directly internet-accessible. Shodan queries are passive from the target's perspective since Shodan performs the scanning.
15. During an attack surface assessment, the team discovers that the target organization's GitHub repositories contain hardcoded API keys, database connection strings, and internal service URLs in historical commits. Even though the secrets have been removed from current code, why do they remain a security risk?
- A) GitHub automatically caches all files indefinitely
- B) Git retains full commit history, and secrets in previous commits remain accessible unless the repository history is rewritten using tools like git filter-branch or BFG Repo Cleaner
- C) GitHub does not support secret deletion
- D) The secrets are cached by search engines and cannot be removed
Answer
B — Git retains full commit history, and secrets in previous commits remain accessible unless the repository history is rewritten using tools like git filter-branch or BFG Repo Cleaner
Git's design preserves complete commit history. Simply deleting a secret in a new commit does not remove it from the repository — anyone with access can view previous commits containing the exposed credentials. Remediation requires rewriting git history (git filter-branch, BFG Repo Cleaner), rotating all exposed credentials, and implementing pre-commit hooks or GitHub secret scanning to prevent future exposure.
Scoring¶
| Score | Performance |
|---|---|
| 14–15 | Expert — Advanced OSINT and attack surface mapping concepts fully internalized |
| 11–13 | Proficient — Ready to conduct structured reconnaissance operations |
| 8–10 | Developing — Review Chapter 42 passive/active recon and OSINT tool sections |
| <8 | Foundational — Re-read Chapter 42 before proceeding |
Return to Chapter 42 | Next: Chapter 43 Quiz