Google Dorking: A Passive Reconnaissance Technique for Footprinting
An ethical hacker wants to discover subdomains of a target domain using only public information. Which of the following techniques is MOST effective?
⚠ Common exam trap
EC-Council often tests the misconception that WHOIS records contain subdomain information, but WHOIS only holds domain registration data, not DNS resource records like A or CNAME entries for subdomains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the site: operator in search engines
The `site:` operator in search engines (e.g., Google) allows an ethical hacker to enumerate publicly indexed subdomains of a target domain by querying `site:*.targetdomain.com`. This technique leverages the search engine's crawl data to discover subdomains that are publicly accessible but may not be linked from the main site, making it the most effective method for passive, public-information-only reconnaissance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a traceroute to the main domain
Why it's wrong here
Running a traceroute maps the network path (routers, firewalls) between a source and a destination IP address by sending packets with incrementing Time-To-Live (TTL) values. While it reveals network topology and latency, it does not query DNS records for subdomains or list hostnames beyond the immediate hop. Therefore, it is entirely ineffective for enumerating subdomains associated with a target domain.
- ✗
Check the WHOIS record for the domain
Why it's wrong here
WHOIS records provide publicly available information about a domain's registration, including the registrant's contact details, registration and expiration dates, and associated nameservers. While essential for identifying domain ownership and administrative contacts, WHOIS databases do not store or expose information about specific subdomains configured under the main domain, as subdomains are managed within the domain's private DNS zone files.
- ✓
Use the site: operator in search engines
Why this is correct
The `site:` operator in search engines like Google restricts search results to a specific domain, including all its indexed subdomains. By querying `site:target.com`, an ethical hacker can leverage the vast indexing capabilities of search engines to passively discover publicly accessible subdomains that have been crawled and cataloged. This provides a quick and effective method for initial reconnaissance without directly interacting with the target's servers.
- ✗
Perform a reverse DNS lookup on the target IP range
Why it's wrong here
Performing a reverse DNS lookup translates an IP address back into a hostname using Pointer (PTR) records. While useful for identifying the primary hostname associated with a specific IP address, it is not a comprehensive method for subdomain discovery. This is because not all subdomains resolve to unique IP addresses with corresponding PTR records, and many subdomains might share an IP address or simply lack a PTR record altogether, limiting its effectiveness for full enumeration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, you discover that the target organization uses a cloud-based email service. Which technique would allow you to gather employee email addresses and potentially infer internal organizational structure?
hard- A.Perform a WHOIS lookup on the domain
- B.Attempt a DNS zone transfer
- C.Run an nmap scan against the mail server
- ✓ D.Use Google dorking to find publicly exposed email lists
Why D: Google dorking (advanced search operators) can uncover publicly exposed documents, such as PDFs or spreadsheets, that contain employee email addresses. These documents are often indexed by search engines and can reveal email patterns (e.g., first.last@company.com) and departmental groupings, allowing inference of the internal organizational structure without interacting directly with the target's infrastructure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.