CEH Footprinting, Reconnaissance and Scanning Practice Question
During a penetration test, the tester uses a tool that queries search engines with specific operators to find sensitive information such as login pages, exposed directories, and file types. Which tool or technique is being used?
⚠ Common exam trap
Watch out — candidates often confuse Google dorking with Shodan, because both involve search engines, but Shodan searches for devices and services (e.g., open ports, banners) rather than web content indexed by Google's crawlers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Google dorking
Google dorking (also known as Google hacking) uses advanced search operators (e.g., intitle:, filetype:, inurl:) to uncover sensitive information indexed by search engines, such as login pages, exposed directories, and specific file types. This technique directly matches the description of querying search engines with operators to find hidden or sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shodan
Why it's wrong here
Shodan's primary function is to index banners and metadata from various network services (e.g., HTTP, FTP, SSH, Telnet) found on public IP addresses. It uses its own proprietary scanning engine and query language, not general-purpose search engine operators like `site:` or `filetype:`, to discover and categorize devices, services, and vulnerabilities exposed to the internet. Therefore, it does not fit the description of using search engine operators for data discovery.
- ✗
theHarvester
Why it's wrong here
theHarvester is an open-source intelligence (OSINT) tool designed to gather information like email addresses, subdomains, hostnames, and employee names from various public sources. While it can query search engines like Google, Bing, and Baidu, it does so programmatically to extract specific data types, rather than relying on a human tester manually crafting advanced search engine *operators* for direct data discovery within the search engine's interface. Its core function is automated data aggregation, not interactive dorking.
- ✓
Google dorking
Why this is correct
Google dorking, also known as Google Hacking, involves using advanced search operators (dorks) within search engines like Google to uncover publicly accessible, yet often unintendedly exposed, sensitive information. Operators such as `site:`, `filetype:`, `intitle:`, `inurl:`, and `cache:` allow testers to narrow down searches to specific domains, file types, page titles, URLs, or cached versions, effectively querying the search engine's index for misconfigurations or leaked data. This directly matches the scenario of a tester using a tool that queries via search engine operators.
- ✗
DNS zone transfer
Why it's wrong here
A DNS zone transfer is a mechanism used to replicate DNS database information from a primary DNS server to a secondary DNS server, ensuring redundancy and load balancing. It involves querying a name server directly for a copy of its entire zone file, which contains all DNS records (A, MX, NS, etc.) for a specific domain. This process is entirely distinct from querying a web search engine using specialized operators to find indexed content, as it operates at the DNS infrastructure level, not the content indexing level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.