CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, a tester wants to gather email addresses, subdomains, and employee names associated with a target domain. Which of the following tools is specifically designed for such passive reconnaissance?
⚠ Common exam trap
EC-Council often tests the distinction between passive and active reconnaissance, and the trap here is that candidates confuse theHarvester with active tools like Nmap or Wireshark because they all involve network data, but only theHarvester gathers OSINT from third-party public sources without sending packets to the target.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
theHarvester
theHarvester is a passive reconnaissance tool specifically designed to gather email addresses, subdomains, employee names, and other open-source intelligence (OSINT) from public sources such as search engines (Google, Bing), PGP key servers, and the Shodan database. It operates without sending direct packets to the target, making it ideal for passive footprinting as defined in the CEH methodology.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Wireshark
Why it's wrong here
Wireshark is a powerful network protocol analyzer designed for capturing and interactively browsing live network traffic. While invaluable for deep packet inspection, troubleshooting, and protocol analysis, it operates by monitoring data flowing across a network interface. It cannot passively query public internet sources like search engines or social media for email addresses, which is the core requirement for OSINT email gathering. Therefore, it's not the appropriate tool for this specific reconnaissance task.
- ✓
theHarvester
Why this is correct
theHarvester is a specialized open-source intelligence (OSINT) tool explicitly designed for passive reconnaissance. It systematically queries multiple public data sources, including search engines (Google, Bing), PGP key servers, LinkedIn, and other platforms, to gather publicly available information such as email addresses, subdomains, hostnames, and employee names. Its passive approach means it does not directly interact with the target organization's systems, making it ideal for initial information gathering without alerting the target.
- ✗
Metasploit
Why it's wrong here
Metasploit Framework is a comprehensive penetration testing platform primarily used for developing, testing, and executing exploit code against remote target systems. While it includes some auxiliary modules for scanning and enumeration, its core functionality revolves around vulnerability exploitation, payload generation, and post-exploitation activities. It is fundamentally an active engagement tool and lacks the dedicated passive OSINT capabilities required to query public sources for email addresses without direct interaction.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is a renowned open-source utility for network discovery and security auditing. It operates by sending specially crafted packets to target hosts and analyzing their responses to identify open ports, running services, operating systems, and potential vulnerabilities. This direct interaction with the target makes Nmap an active scanning tool, which is distinct from passive reconnaissance that gathers information from publicly available sources without direct engagement. Therefore, it is not designed for harvesting email addresses from the internet.
Go deeper
Related to this question
Learn chapter
Footprinting and Reconnaissance
Key term
OSINT Techniques
OSINT techniques are methods used to collect information from publicly available sources for security assessments or investigations.
Key term
Passive reconnaissance
Passive reconnaissance is the process of gathering information about a target system or network without directly interacting with it, using publicly available sources and stealthy observation.
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.