D332 Penetration Testing and Vulnerability Analysis - Set 1 - Part 2

Correct Answer: The PenTesting team has no prior knowledge about the system

In an unknown environment test, the PenTesting team mimics the behavior of a real threat actor with no prior access to system information.

Correct Answer: The team is provided partial information, such as internal functionality or code

In a partially known environment test, some system details are provided, allowing the team to focus on specific vulnerabilities and system defects.

Correct Answer: The PenTesting team has limited information about the environment

In known environment testing, the team is provided with full knowledge about the system, allowing for a comprehensive security assessment.

Correct Answer: Scope, assets, strategy, timeline, and legal restrictions

It's essential to define the scope, in-scope assets, excluded areas, testing strategy, timeline, and any legal restrictions before the test.

Correct Answer: A contract that defines ongoing services and cost structures

An MSA outlines the terms for recurring services, cost structures, and additional fees that might arise during a project.

Correct Answer: A document outlining project deliverables, timelines, and payment terms

The SOW defines specific expectations for a business arrangement, including deliverables, milestones, and payment schedules.

Correct Answer: A contract outlining detailed service terms, including performance metrics

SLAs define the expected levels of service, performance metrics, and penalties if those levels are not met, including security and risk assessments.

Correct Answer: Mail Exchange, Name Server, Text, and Service

These DNS records help direct different kinds of network traffic. MX points to mail servers, NS identifies authoritative servers, TXT contains text information, and SRV provides service information like VoIP or IM services.

Correct Answer: Tools for querying DNS records and domains

Nslookup and Dig are tools that help in querying DNS servers to obtain domain information such as IP addresses, MX records, and more.

Correct Answer: These repositories store application source code and offer collaboration tools

GitHub, Bitbucket, CloudForge, and SourceForge are cloud-based repositories that provide features like version control, bug tracking, and project collaboration.

Correct Answer: Google, TinEye, Yandex

Google, TinEye, and Yandex offer reverse image search services, which allow users to upload an image to find related images or websites.

Correct Answer: Nmap, Metasploit, DirBuster, forced browsing, and web spiders

These tools are used for web investigation, including port scanning, exploiting vulnerabilities, and identifying unlinked URLs.

Correct Answer: A file that tells search engine bots where they are allowed to crawl

A robots.txt file is found in the root directory of a website and specifies which parts of the site search engines are allowed or disallowed from indexing.

Correct Answer: It identifies specific subdomains covered by the certificate

The Subject Alternative Name (SAN) field in a digital certificate allows for the inclusion of multiple subdomains or hostnames under one certificate.

Correct Answer: Logs of digital certificate authorities, which are publicly accessible

Certificate Transparency (CT) logs contain public records of certificates issued by Certificate Authorities (CAs), helping to detect rogue or misissued certificates.

Correct Answer: They check the status of certificates to determine validity

The Certificate Revocation List (CRL) and the Online Certificate Status Protocol (OCSP) are methods for checking whether a certificate has been revoked.

Correct Answer: By verifying against CRL or checking with OCSP

Certificates are validated by checking their status with either the CRL or OCSP to see if they have been revoked or are still valid.

Correct Answer: A Python-based tool for extracting metadata from public documents

Metagoofil is a Linux-based tool that searches Google for public documents and extracts metadata such as usernames and software versions.

Correct Answer: A Windows OSINT tool for discovering metadata in documents

FOCA (Fingerprinting Organizations with Collected Archives) is an open-source intelligence tool that extracts metadata from documents found online.

Correct Answer: A tool for automated gathering of open-source intelligence like subdomains and email addresses

TheHarvester automates the collection of OSINT, including subdomains, email addresses, and PGP key entries, from various public sources.