CEH Footprinting, Reconnaissance and Scanning Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  dnsrecon

  Why this is correct

  dnsrecon is a specialized command-line utility designed for comprehensive DNS enumeration. It automates the process of gathering extensive DNS information about a target domain, including host records, MX records, NS records, and performing zone transfer attempts. Furthermore, it can conduct brute-force subdomain discovery using wordlists and leverage Google dorks for additional subdomain identification, making it highly effective for reconnaissance.

• ✗

  theHarvester

  Why it's wrong here

  theHarvester is an open-source intelligence (OSINT) tool primarily used for gathering publicly available information such as email addresses, subdomains, hostnames, and employee names from various sources like search engines, PGP key servers, and Shodan. While it can identify subdomains, its approach is broad OSINT-driven rather than focused on direct, comprehensive DNS record querying or zone transfer attempts. It acts more as an information aggregator than a dedicated DNS enumeration scanner.

• ✗

  Nmap

  Why it's wrong here

  Nmap, or Network Mapper, is fundamentally a powerful network scanner used for host discovery, port scanning, and service version detection across networks. Although Nmap can perform basic DNS lookups and has Network Scripting Engine (NSE) scripts that interact with DNS, it is not engineered as a primary tool for exhaustive DNS enumeration, such as retrieving all record types or attempting zone transfers. Its core functionality is centered on network topology mapping and service identification, not deep DNS reconnaissance.

• ✗

  Maltego

  Why it's wrong here

  Maltego is a graphical link analysis tool specifically designed for open-source intelligence and forensics, allowing users to visualize relationships between various entities like domains, IP addresses, individuals, and organizations. While it can incorporate DNS information as part of its broader data mining and visualization capabilities, it relies on 'transforms' to query external data sources rather than directly performing comprehensive DNS enumeration itself. It serves as an investigative platform for correlation, not a direct DNS querying utility.

• ✓

  dnsenum

  Why this is correct

  dnsenum is a versatile Perl script specifically crafted for DNS enumeration, automating the discovery of a wide array of DNS records and related information for a given target domain. It systematically retrieves name servers (NS), mail exchangers (MX), and host records, attempts zone transfers, and can brute-force subdomains from a provided wordlist. This tool is instrumental in mapping out a domain's infrastructure and identifying potential vulnerabilities through its comprehensive DNS data collection.

Go deeper

Related to this question